Pwn2Own 2033 yakaitirwa muVancouver
Munguva pfupi yapfuura mhedzisiro ye mazuva matatu emakwikwi Pwn2Own 2023, iyo inoitwa gore negore sechikamu chemusangano weCanSecWest muVancouver.
Muchinyorwa chitsva ichi matekiniki akaratidzirwa kushanda kushandisa kusasimba yaimbozivikanwa yeUbuntu, Apple macOS, Oracle VirtualBox, VMWare Workstation, Microsoft Windows 11, Microsoft Teams, Microsoft SharePoint uye yeTesla mota.
Kurwiswa kwakabudirira kwe27 kwakaratidzwa iyo yakashandisa kusasimba kwaimbozivikanwa kare.
Kune avo vasina kujairana nePwn2Own, iwe unofanirwa kuziva kuti ichi chiitiko chepasi rose chekubira chakarongwa neTrend Micro Zero-Day Initiative (ZDI), icho chave kuitika kubva 2005. Mariri, mamwe emhando yepamusoro zvikwata zvekubira anokwikwidzana nezvinangwa zvetekinoroji. . defaults uye mumwe nemumwe, uchishandisa 'zero-day' zviitiko.
Ava eelite hacker bounty vavhimi uye vaongorori vezvekuchengetedza vane nguva yakasimba yekugumira kuti vabudirire 'pwn' zvinangwa zviri mubvunzo. Kubudirira kunopihwa mibairo yese nemapoinzi ari kuwedzerwa kuMasters ePwn leaderboard, uye kudos kuPwn2Own hakufanire kushoreswa sezvo hunhu hwemakwikwi hwakasimba pano, pamwe nekubhadharwa kunokatyamadza. Pakazara, Pwn2Own Vancouver 2023 ine mubairo homwe inodarika miriyoni imwe.
Wekutanga kudonha aive Adobe Reader muchikamu chebhizinesi rekunyorera mushure meAbdul Aziz Hariri (@abdhariri) kubva kuHaboob SA akashandisa cheni ye ugamba yakanangana ne6-bug logic cheni iyo yakashandisa zvigamba zvakakundikana akawanda kutiza muSandbox uye ikadarika rondedzero yeakarambidzwa APIs muMacOS kuhwina zviuru makumi mashanu zvemadhora.
Mumakwikwi yakaratidza kuedza kushanu kwakabudirira kuputika zvaisazivikanwa kusasimba mukati Ubuntu Desktop, yakagadzirwa nezvikwata zvakasiyana zvevatori vechikamu.
Zvinetso zvakakonzerwa nekusunungurwa kaviri kwendangariro (a $30k bhonasi), the ndangariro kuwana mushure memahara (a $30k bhonasi), isiriyo pointer kubata (a $30k bhonasi). Mumadhemo maviri, atozivikanwa, asi asina kugadziriswa, kushaya simba kwakashandiswa (mabhonasi maviri e15 zviuru zvemadhora). Mukuwedzera, kuedza kwechitanhatu kurwisa Ubuntu kwakaitwa, asi kushandiswa hakuna kushanda.
Nezve zvikamu zvedambudziko hazvisati zvaziviswa, maererano nemamiriro emakwikwi, ruzivo rwakadzama nezvese zvakaratidzwa zero zuva kusanetsekana kuchaburitswa chete mushure memazuva makumi mapfumbamwe, ayo anopiwa kugadzirira kwekuvandudzwa nevagadziri kuti vabvise kusagadzikana.
Nezve mamwe mademo yekubudirira kurwiswa kunotevera kunotaurwa:
- Matatu Oracle VirtualBox hacks anoshandisa kusadzivirirwa kunokonzerwa neMemory Access Mushure meKusagadzikana Kwemahara, Buffer Kufashukira, uye Verenga Kunze kweBuffer (mbiri $40k mabhonasi uye $80k bhonasi yekushandisa zvisina kunaka 3 iyo yakabvumira kuurayiwa kwekodhi padivi reanotambira).
- Apple's macOS Elevation ($40K Premium).
- Kurwiswa kuviri paMicrosoft Windows 11 izvo zvakavabvumira kuwedzera maropafadzo avo ($30.000 mabhonasi).
- Kusagadzikana kwakakonzerwa ne-post-yemahara memory yekuwana uye isiriyo yekuisa yekusimbisa.
- Kurwiswa kweMicrosoft Teams uchishandisa cheni yemabhugi maviri mukushandisa ($75,000 premium).
- Kurwisa paMicrosoft SharePoint ($100,000 bhonasi).
- Kurwisa paVMWare workstation nekuwana yemahara ndangariro uye uninitialized variable ($80 premium).
- Kuita kodhi paunenge uchipa zvirimo muAdobe Reader. Cheni yakaoma yezvikanganiso zvitanhatu yakashandiswa kurwisa, kupfuura bhokisi rejecha, uye kuwana iyo yakarambidzwa API ($6 mubayiro).
Kurwiswa kuviri paTesla mota infotainment system uye Tesla Gateway, ichibvumira kuwana midzi yekuwana. Mubairo wekutanga waive $100,000 nemota yeTesla Model 3, uye mubairo wechipiri waive $250,000.
Iko kurwiswa kwakashandisa yazvino yakagadzikana vhezheni yezvishandiso, mabhurawuza, uye masisitimu anoshanda ane ese aripo ekugadzirisa uye default marongero. Mari yese yemuripo yakabhadharwa yaive $1,035,000 uye mota. Chikwata chine mapoinzi akawanda chakagamuchira madhora mazana mashanu nemakumi matatu ezviuru uye Tesla Model 530,000.
Chekupedzisira, kana iwe uchifarira kuziva zvakawanda nezvazvo, unogona kutarisa ruzivo Mune inotevera chinongedzo.