
[ad_1]
Security researchers nabbed $552,500 in bounties at this year’s Pwn2Own hacking contest, demonstrating exploits against the top four Web browsers, plus Adobe Reader and Flash Player.
On Thursday, the second and final day of the competition, the star of the show was South Korean security researcher JungHoon Lee, aka “lokihardt,” who nabbed the single biggest payout of the competition and Pwn2Own history: $75,000 for a Chrome bug affecting both the stable and beta versions of Google’s browser. For that same bug, he also earned an extra $25,000 for gaining SYSTM access, and another $10,000 for hitting the beta version for a grand total of $110,000.
“To put it another way, lokihardt earned roughly $916 a second for his two-minute demonstration,” HP’s security research team wrote in a blog post(Opens in a new window) Thursday. “There are times when ‘Wow’ just isn’t enough.”
Sponsored by HP’s Zero Day Initiative program, the Pwn2Own contest takes place at the CanSecWest security conference in Vancouver, Canada. All told, the hackers who participated in this year’s event discovered five bugs in the Windows operating system; four in Internet Explorer 11; three each in Mozilla Firefox, Adobe Reader and Flash; two in Apple’s Safari; and the one aforementioned bug in Chrome.
The prolific lokihardt also on Thursday took out 64-bit Internet Explorer 11 and Safari, bringing his day’s cash prize total to $225,000.
“This is an amazing accomplishment for anyone, but it’s especially impressive considering he is an individual competitor rather than a team,” HP said.
On Wednesday, researchers from Team509 and KeenTeam kicked off the first day of the competition by exploiting Adobe Flash and successfully bypassing all its defensive measures, earning $60,000 for the bug and another $25,000 for the SYSTEM escalation.
Not to be outdone, researcher Nicolas Joly followed this up with his own Flash exploit, earning $30,000. Joly also took down Adobe Reader with a stack buffer overflow flaw, netting him $60,00, bringing his total payout to $90,000.
“Not bad for writing the final part of the exploit chain on the flight to the conference, according to him,” HP said.
Another highlight on Wednesday was researcher Mariusz Mlynski’s takedown of Mozilla Firefox in just .542 seconds, earning $30,000 for the flaw and an extra $25,000 for privilege escalation. New entrant 360Vulcan Team also earned some bragging rights, exploiting 64-bit Internet Explorer 11 to earn $32,500.
[ad_2]
Source link : https://www.pcmag.com/news/all-major-web-browsers-fall-in-pwn2own-hacking-contest