Pwn2Own Miami 2022 has come to an end, and Zero Day Initiative says the competitors earned $400,000 for 26 zero-day exploits (and multiple vulnerability collisions) targeting ICS and SCADA products exhibited during the contest held last week.
The contest, organized by Trend Micro’s Zero Day Initiative (ZDI), saw 11 participants targeting multiple production categories: Control Server, OPC Unified Architecture (OPC UA) Server, Data Gateway, and Human Machine Interface (HMI).
"Thanks again to all of the competitors who participated. We couldn’t have a contest without them," Trend Micro's Zero Day Initiative (ZDI) said today. “Thanks also to the participating vendors for their cooperation and for providing fixes for the bugs disclosed throughout the contest.”
After the safety vulnerabilities abused throughout Pwn2Own are reported, distributors are given 120 days to launch patches till ZDI publicly discloses them.
The highest payout went to Computest Sector 7 researchers Daan Keuper (@daankeuper) and Thijs Alkemade (@xnyhps). During day one, they earned $20,000 after executing code on the Inductive Automation Ignition SCADA control server solution using a missing authentication vulnerability.
The same day they used an uncontrolled search path bug to secure remote code execution (RCE) in AVEVA Edge HMI/SCADA software and were awarded $20,000 for their efforts. The next day, Computest Sector 7 exploited an infinite loop condition to trigger a DoS state against the Unified Automation C++ Demo Server and earned $5,000.
Last but not least, on day two of Pwn2Own Miami 2022, the Computest Sector 7 team earned $40,000 for successfully bypassing the trusted application check on the OPC UA .NET standard. This was the maximum amount that Pwn2Own participants could earn for a single exploit, and Computest’s attempt involved what ZDI described as one of the most interesting bugs ever seen at Pwn2Own. In fact, the Computest team earned the most points and a total of $90,000.
This year's Pwn2Own Miami took place at the S4 conference in Miami South Beach in person and also allowed remote participation. In 2020, in the first edition of Pwn2Own on ICS, participants won a total of $ 280,000. This event did not take place in 2021 due to the COVID-19 pandemic.