Microsoft Teams, Windows 11 hacked on first day of Pwn2Own

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/microsoft-teams-windows-11-hacked-on-first-day-of-pwn2own/

During the first day of Pwn2Own Vancouver 2022, contestants won $800,000 after successfully exploiting 16 zero-day bugs to hack multiple products, including Microsoft's Windows 11 operating system and the Teams communication platform.

The first to fall was Microsoft Teams in the enterprise communications category after Hector Peralta exploited an improper configuration flaw.

The STAR Labs team (Billy Jheng Bing-Jhong, Muhammad Alifa Ramdhan, and Nguyễn Hoàng Thạch) also demonstrated a zero-click exploit chain of 2 bugs (injection and arbitrary file write).

Microsoft Teams was hacked a third time by Masato Kinugawa, who exploited a 3-bug chain of injection, misconfiguration, and sandbox escape.

Each of them earned $150,000 for successfully demonstrating their Microsoft Teams zero-days.

STAR Labs also earned an extra $40,000 after elevating privileges on a system running Windows 11 using a Use-After-Free weakness and an additional $40,000 by achieving privilege escalation on Oracle Virtualbox.

Manfred Paul (@_manfp) also successfully demoed 2 bugs (prototype pollution and improper input validation) to hack Mozilla Firefox and an out-of-band write on Apple Safari to earn $150,000.

Other highlights from the first day of Pwn2Own include Marcin Wiązowski, Team Orca of Sea Security, and Keith Yeo demonstrating more zero-days in Windows 11 and Ubuntu Desktop,

 

[Trooper]

Thank you sir. Was just about to post this.

 

[Local Host]

Is nice to see the exploits on Microsoft Teams were mostly due to misconfiguration, which means user error.

 

[Gandalf_The_Grey]

Windows 11 hacked again at Pwn2Own, Telsa Model 3 also falls

During the second day of the Pwn2Own Vancouver 2022 hacking competition, contestants hacked Microsoft's Windows 11 OS again and demoed zero-days in Tesla Model 3's infotainment system.

The first demonstration of the day came from the @Synacktiv team, who successfully demoed two unique bugs (Double-Free & OOBW) and a sandbox escape collision while targeting the Tesla Model 3 infotainment system, earning $75,000 for their efforts.

@Jedar_LZ also failed to demo a zero-day exploit against Tesla's car. Although the bug wasn't exploited within the allotted time, Trend Micro's Zero Day Initiative (ZDI) acquired the exploit details and disclosed them to Tesla.

A third elevation of privileges zero-day caused by an improper access control bug in Windows 11 was demoed on the second day by T0, with namnp failing to demonstrate a second Windows 11 privilege escalation zero-day within the time allotted.

Two more local privilege escalation vulnerabilities were successfully demoed by the STAR Labs team and Marcin Wiązowski during the first round of the Pwn2Own contest.

Ubuntu Desktop was also hacked twice, with Bien Pham (@bienpnn) and Team TUTELARY from Northwestern University escalating privileges using two Use After Free bugs and earning $40,000 each.

Windows 11 hacked again at Pwn2Own, Telsa Model 3 also falls

During the second day of the Pwn2Own Vancouver 2022 hacking competition, contestants hacked Microsoft's Windows 11 OS again and demoed zero-days in Tesla Model 3's infotainment system.

www.bleepingcomputer.com

 

[Trooper]

I tell you. As time goes by, this, plus all of the other MS decisions over the past few years makes me want to drop Windows and just run Linux full time.

 

[M4RT1NE2]

I tell you. As time goes by, this, plus all of the other MS decisions over the past few years makes me want to drop Windows and just run Linux full time.

You're right. But will another system be better ?
Linux may be better (I never had it I admit - but not perfect).
The world is so complicated that no matter what you have you will still complain. There are no perfect things. Every thing has its advantages and disadvantages. Windows annoys me too many times.
It is like with a woman. At the beginning you love her, live with her and then some disadvantages come out which you have to accept unless the disadvantages / problems are so big that divorce saves the situation.
I hope you understand my message

 

[Gandalf_The_Grey]

Windows 11 hacked three more times on last day of Pwn2Own contest

On the third and last day of the 2022 Pwn2Own Vancouver hacking contest, security researchers successfully hacked Microsoft's Windows 11 operating system three more times using zero-day exploits.

The first attempt of the day targeting Microsoft Teams failed after Team DoubleDragon could not demo their exploit within the allotted time.

All other contestants hacked their targets, earning $160,000 after taking down Windows 11 three times and Ubuntu Desktop once.

The first to demonstrate a Windows 11 escalation of privilege zero-day (via Integer Overflow) on the third day of Pwn2Own was nghiadt12 from Viettel Cyber Security.

Bruno Pujos from REverse Tactics and vinhthp1712 also escalated privileges on Windows 11 using Use-After-Free and Improper Access Control vulnerabilities, respectively.

Last but not least, STAR Labs' Billy Jheng Bing-Jhong hacked a system running Ubuntu Desktop using a Use-After-Free exploit.

Windows 11 hacked three more times on last day of Pwn2Own contest

On the third and last day of the 2022 Pwn2Own Vancouver hacking contest, security researchers successfully hacked Microsoft's Windows 11 operating system three more times using zero-day exploits.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

And a summary article from Ghacks:

Pwn2Own 2022: Windows 11, Ubuntu, Firefox, Safari, Tesla and more hacked - gHacks Tech News

The hacking event Pwn2Own took place from May 18 to May 20 of 2022. This year, security researchers managed to hack Windows 11 and Ubuntu, Firefox, Safari, Microsoft Teams, a Tesla and other targets successfully during the three days of the event.

www.ghacks.net

 

[upnorth]

Spoiler: Ubuntu :P

 

[Local Host]

I tell you. As time goes by, this, plus all of the other MS decisions over the past few years makes me want to drop Windows and just run Linux full time.

That comment makes no sense on this topic, finding and patching exploits makes it more secure, you have no idea how many unpatched holes Linux has due to the huge fragmentation.

 

[Trooper]

That comment makes no sense on this topic, finding and patching exploits makes it more secure, you have no idea how many unpatched holes Linux has due to the huge fragmentation.

Neither does yours. If you had my job, you would understand.