Hackers Earn $200,000 for VM Escapes at Pwn2Own 2017

20.3.2017 securityweek Congress
White hat hackers earned more than $250,000 for the vulnerabilities they disclosed on the third day of the Pwn2Own 2017 competition, including a couple of exploits that involved escaping VMware virtual machines.

Due to the unprecedented number of contestants and entries, Pwn2Own was extended to three days this year. On the third day, participants targeted the Microsoft Edge browser and VMware Workstation.

First, the 360 Security team earned $105,000 for hacking Edge and achieving a virtual machine (VM) escape. Experts leveraged a heap overflow in Edge, a type confusion in the Windows kernel and an uninitialized buffer flaw in VMware to complete the task.

Tencent Security’s Team Sniper earned $100,000 for a VMware Workstation exploit that can be used to escape VMs. The group leveraged a use-after-free in Windows, and information disclosure and uninitialized buffer flaws in VMware.

The Zero Day Initiative (ZDI) pointed out that a complete exploit was not easy to pull off in this category due to the fact that VMware Tools was not installed in the guest operating system.

Richard Zhu, aka fluorescence, also targeted Edge, but he only earned $55,000 as his exploit chain did not result in a VM escape. The researcher leveraged two use-after-free vulnerabilities in Edge and a buffer overflow in the Windows kernel to escalate privileges to SYSTEM.

ZDI paid out a total of $833,000 for the 51 vulnerabilities disclosed at Pwn2Own 2017. In comparison, participants only earned $460,000 at last year’s event for 21 new flaws.

360 Security obtained the highest number of Master of Pwn points this year, earning them 65,000 ZDI points worth $25,000.

On the first day of Pwn2Own 2017, white hat hackers received $233,000 for hacking Edge, Safari, Ubuntu and Adobe Reader. On the second day of the competition, experts took home $340,000 for exploits targeting Windows, macOS, Firefox, Edge, Safari and Flash Player.