Tag: Contest | SpinSafe

DARPA is hosting a Black Hat contest to create cyber-security AI models

August 11, 2023/in Computer Security

Forward-looking: The Black Hat Def Con conference portrays itself as an internationally recognized cybersecurity event showcasing the most “technical and relevant” information security research in the business. For the next two years, the event will host a DARPA-funded contest to put AI algorithms to work on the increasingly pressing software security problem.

DARPA’s Artificial Intelligence Cyber Challenge (AIxCC) is a two-year competition for the “best and brightest” minds in the AI field, the contest’s official site explains. The Pentagon’s research agency wants companies and experts to create novel AI systems; machine learning models designed to secure the critical software code that runs beneath financial systems, public utilities and other digital infrastructures enabling modern life.

Software runs everything these days, DARPA states, which unfortunately provides an “expanding” attack surface for cyber-criminals and other malicious actors. The new AI capabilities developed during the past decade have shown “significant potential” to help address key societal challenges like cybersecurity, the US agency says. AIxCC will reward people and organizations that can actualize this theoretical potential.

DARPA says it will award a cumulative $18.5 million in prizes to the teams with the best AI systems. An additional $7 million will be awarded to small business ventures taking part in the contest. With AIxCC, the US military is seeking the development of ML models capable of identifying, and maybe fixing, dangerous security flaws within critical software projects.

DARPA will work with “leading” AI companies Anthropic, Google, Microsoft, and OpenAI to give AIxCC competitors access to the most advanced technology and expertise. With their help, contestants will likely increase their chances of developing a true “state-of-the-art” cybersecurity system infused with AI algorithms. The Open Source Foundation will contribute as well, as most modern software needing protection is based on open-source code projects.

The AIxCC challenge has already started during this year’s Def Con conference held in Las Vegas. AI teams will compete in a series of preliminary trials during 2024, with the…

Source…

Windows, macOS, and Tesla exploits debuted at Pwn2Own hacking contest

March 23, 2023/in Internet Security

Security researchers have successfully exploited zero-day vulnerabilities found in macOS, Windows, and Tesla software at the Zero Day Initiative’s Pwn2Own conference.

Day one of the 2023 competition, hosted in Vancouver, saw 12 unique zero-day vulnerabilities exploited in Microsoft SharePoint, Windows 11, Adobe Reader, Oracle VirtualBox, Tesla Gateway, and macOS.

Abdul Aziz Hariri of security firm Haboob successfully exploited vulnerabilities in Adobe Reader. Hariri used a six-bug chained exploit to escape the Adobe sandbox and circumvent APIs on macOS, earning a $50,000 prize in the process.

A key talking point on day one of Pwn2Own came when STAR Labs successfully executed a chained exploit against Microsoft SharePoint. The team also hacked Ubuntu Desktop with a previously known vulnerability which saw them scoop a combined prize of $115,000.

Synacktiv secured a $140,000 prize haul – and a Tesla Model 3 – after hacking Apple’s macOS kernel through an elevation of privilege attack as well as a successful vulnerability exploit of Tesla Gateway. This attack saw the team execute a time-of-check to time-of-use (TOCTOU) attack against the Gateway.

Tesla’s Gateway is a system in its Powerwall product which controls a vehicle’s connection to the grid. The Gateway automatically detects outages and provides a “seamless transition” to backup power in the event of an outage.

This isn’t the first time Tesla Gateway has been exploited successfully. In 2020, researchers at security firm Rapid7 highlighted security risks due to the Gateway’s connection to the internet.

Meanwhile, security researcher Marcin Wiazowski used an improper input validation bug to elevate privileges on Windows 11 which saw him secure a $30,000 prize.

Bien Pham rounded off the first day with a successful exploit against Oracle VirtualBox, earning a prize of $40,000.

More to come at Pwn2Own

The annual competition saw $375,000 in prizes awarded over the course of day one, with Justin Childs, head of threat awareness at the Zero Day Initiative, stating that the contest is “well on its way to a million dollars”.

Last year’s contest saw researchers take home more than $1.1 million in…

Source…

Hackers Score Nearly $1M at Device-Focused Pwn2Own Contest

December 13, 2022/in Computer Security

Security researchers and hackers demonstrated 63 zero-day vulnerabilities in popular devices at the latest Pwn2Own, exploiting printers from Canon, HP, and Lexmark, and routers and network-attached storage device from Synology and Netgear.

According to Trend Micro’s Zero Day Initiative (ZDI), which organized the competition last week, the collection of vulnerabilities earned $989,750 for the offensive cybersecurity specialists competing in the contest. While some attacks chained together a series of exploits to take control of the remote devices, including one that used five vulnerabilities, others found a single security weakness to target, such as the Pentest Limited team, which found a reliable single-click exploit in the Samsung Galaxy S22 mobile phone that required less than a minute to attack.

The Samsung exploit highlighted that significant vulnerabilities are out there to find, says Dustin Child, head of threat awareness at Trend Micro’s Zero Day Initiative.

“Just click a link on an affected device and you get owned,” he says. “It’s a very reliable bug, too. Very impressive research and quite the effective demonstration of why clicking unknown links can be dangerous.”

Focusing on IoT and Mobile

Pwn2Own started in 2007 as an annual contest connected with the annual CanSecWest conference, but has since branched out into two contests: one focused on computer operating systems and applications, and the other — which includes the latest contest — focused on devices and the Internet of Things.

Over the four days of the contest, offensive cybersecurity specialists discovered a significant number of vulnerabilities in printers and routers from major brands, but also targeted Bluetooth speakers and network-attached storage, ZDI stated in a summary of the contest results.

Because many of the devices are commonly used by small and medium-sized businesses (SMBs), companies should take the results of the competition as a warning, Child says.

“If anything, SMBs should understand that, while they may feel they aren’t large enough to be a target, their devices can and will be targeted by threat actors,” he says. “At [this] time, the attackers are just looking to add nodes to their botnet,…

Source…