Pwn2Own waa tartan jabsiga ah oo sanadkiiba mar lagu qabto shirka amniga ee CanSecWest, laga bilaabo 2007. Ka-qaybgalayaashu waxay la kulmaan caqabadda ah ka faa'iideysiga barnaamijyada software-ka iyo aaladaha gacanta si ballaaran loogu adeegsaday nuglaanta illaa iyo hadda aan la garanayn.
Ku guuleystayaasha tartanka waxay helayaan qalabkii ay ka faa'iideysteen, abaalmarin lacageed, iyo "MastersU dabaal degaya sanadka guushiisa. Magaca "Pwn2Own" waxaa laga soo qaatay xaqiiqda ah in kaqeybgalayaashu ay "pwn" ama jabsadaan qalabka si ay "u leeyihiin" ama uga guuleystaan.
Tartanka Pwn2Own waxaa loo isticmaalaa in lagu muujiyo u nuglaanta qalabka iyo barnaamijyada sida ballaaran loo isticmaalo waxayna sidoo kale bixisaa bar koontarool oo ku saabsan horumarka laga sameeyay xagga amniga tan iyo sanadkii ka horreeyay.
Ku saabsan Pwn2Own 2020
Daabacaddan cusub ee Pwn2Own 2020, sannadkan tartamada ayaa si caadi ah loo qabtay waxaana weerarada lagu soo bandhigay internetka, dhibaatooyinka ka dhashay faafitaanka cudurka 'Cornonavirus' (Covid-19), iyadoo ay tahay markii ugu horreysay ee qabanqaabiyahaagu Initiative Zero Day (ZDI), go'aansadeen inay abaabulaan munaasabadda u oggolaanaysa ka qaybgalayaasha inay mudaharaad muujiyaan meel fog ka faa'iideysigiisa.
Intii tartanku socday farsamooyin shaqo oo kala duwan ayaa la soo bandhigay si looga faa'iideysto nuglaanta hore loo aqoon gudaha Ubuntu Desktop (Linux kernel), Windows, macOS, Safari, VirtualBox iyo Adobe Reader.
Wadarta guud ee lacagaha waxay gaarayaan 270 kun oo doolar (Wadarta guud ee abaalmarinta waxay ka badneyd US $ 4 milyan).
Isku soo wada duuboo, natiijooyinka laba maalmood ee tartanka Pwn2Own 2020 oo sanadkiiba mar lagu qabto shirka CanSecWest waa sida soo socota:
-
- Inta lagu jiro maalinta koowaad ee Pwn2Own 2020, koox ka socota Georgia Software iyo Security Lab Nidaamka Tech (@AbdihakimAinte) Safari khawano leh sare u qaadista heerka mudnaanta macOS kuna bilaabi kalkuleytarka mudnaanta asalka. Silsiladda weerarku waxay ku lug lahayd lix nuglaansho waxayna u oggolaatay kooxda inay kasbato $ 70,000.
- Intii ay socotay munaasabaddu Manfred Paul oo ka socda "RedRocket" ayaa mas'uul ka ahaa muujinta kordhinta mudnaanta maxalliga ah ee Ubuntu Desktop iyada oo loo marayo ka faa'iideysiga nuglaanta kumbuyuutarka 'Linux' ee la xidhiidha xaqiijinta khaldan ee qiimaha la gelinayo. Tani waxay u horseeday inuu ku guuleysto abaalmarin dhan $ 30.
- Sidoo kale Banaanbaxa waxaa loo sameeyay ka tagida jawiga martida ee VirtualBox oo lagu fulinayo koodh leh xuquuqda hypervisorAdoo ka faa'iideysanaya laba nuglaansho: awood u lahaanshaha akhrinta xogta aag ka baxsan keydka loo qoondeeyay iyo qalad markii lala shaqeynayay doorsoomayaasha aan la ogaan, abaalmarinta cadeynta cilladan waxay ahayd $ 40. Ka baxsan tartanka, wakiilo ka socda Zero Day Initiative ayaa sidoo kale soo bandhigay khiyaano kale oo VirtualBox ah, taas oo u oggolaaneysa marin u helka nidaamka martigelinta iyada oo loo marayo khalkhalgelinta deegaanka martida.
- Laba banaanbax oo kordhinta mudnaanta deegaanka ee Windows iyadoo laga faa'iideysanayo nuglaanta taasi waxay horseed u tahay helitaanka goob xasuus horeyba looga sii daayay, iyadoo labadan abaalmarin oo midkiiba 40 kun oo doolar la siiyay.
- Ka hel marin-u-helka maamulka Windows-ka marka aad furayso dukumiinti PDF ah si gaar ah loogu qaabeeyey Adobe Reader. Weerarku wuxuu ku lug leeyahay nuglaanta Acrobat iyo Windows kernel ee la xidhiidha helitaanka aagagga xusuusta ee horay loo sii daayay ($ 50 abaalmarin).
Magacaabista haray ee aan la sheegan waxaa loo gudbiyay jabsiga Chrome, Firefox, Edge, Microsoft Hyper-V Client, Microsoft Office, iyo Microsoft Windows RDP.
Waxaa sidoo kale jiray isku day lagu jabsaday Xarunta VMware Workstation, laakiin isku daygaas waa lagu guuleysan waayey. Sidii sanadkii hore, jabsiga inta badan mashaariicda furan (nginx, OpenSSL, Apache httpd) ma galin qeybaha abaalmarinta.
Dhanka kale, waxaan eegi karnaa arrinta jabsiga nidaamyada macluumaadka gaariga Tesla.
Ma jirin isku day lagu jabsaday Tesla tartanka.a, in kasta oo lacagta ugu badan ee $ 700 kun, laakiin waxaa jiray macluumaad gooni ah oo ku saabsan ogaanshaha nuglaanta DoS (CVE-2020-10558) Tesla Model 3, oo u oggolaaneysa in la joojiyo bog si gaar ah loogu talagalay oo ku jira ogeysiisyada autopilot-ka ee lagu dhex rakibo oo lagu joojiyo howlaha qaybaha sida xawaaraha, xawaaraha, hawo-qaboojinta, nidaamka hagidda, iwm.
source: https://www.thezdi.com/