This year marks the 14th anniversary of Pwn2Own, which has grown from a small, browser-focused event to become one of the most well-known security contests in the industry, with millions of dollars of cash and prizes made available to contestants over the years. Every year the contest changes a bit as we reflect on the changing world around us. As cloud computing grew, we added the Virtualization category. In 2019, we added the Automotive category. For this year’s event, we’re adding the Enterprise Communications category.
As the workforce moves out of the office and goes remote, the tools needed to support that change become greater targets. That’s one reason we added this new category and teamed up with
Zoom to have them in the contest. Microsoft Teams will also be a target. A successful demonstration of an exploit in either of these products will earn the contestant $200,000 – quite the payout for a new category.
Tesla returns for this year’s contest but driving off with a brand-new Model 3 will be more of a challenge this year. Of course, that means the rewards are greater as well, with the top prize going for $600,000 (plus the car itself).
For 2021, we’ll have a bit of a hybrid contest. Starting on April 6 and running through April 8, 2021, we’ll have ZDI staff in Toronto and Austin running the exploits. Contestants can be anywhere in the world and won’t need to travel. As we did with our fall event, everything will be live-streamed on Twitch, YouTube, and more. All told, more than $1,500,000 USD in cash and prizes are available to contestants, including the Tesla Model 3, in the following categories:
-- Virtualization Category
-- Web Browser Category
-- Enterprise Applications Category
-- Server Category
-- Local Escalation of Privilege Category
-- Enterprise Communications Category
-- Automotive Category
And, of course, Pwn2Own would not be complete without us crowning a Master of Pwn. Since the order of the contest is decided by a random draw, contestants with an unlucky draw could still demonstrate fantastic research but receive less money since subsequent rounds go down in value. However, the points awarded for each successful entry do
not go down. Someone could have a bad draw and still accumulate the most points. The person or team with the most points at the end of the contest will be crowned Master of Pwn, receive 65,000 ZDI reward points (instant
Platinum status), a killer
trophy, and a
pretty snazzy jacket to boot.
