Pwn2Own hacking competition expands to industrial control systems

This is a “radical concept" for ICS vendors, one organizer said.

For years, Pwn2Own, a competition that rewards researchers for finding previously unknown software flaws, has focused on code used in enterprise IT networks rather than programs that support critical infrastructure operations.

That is all going to change in January, when the contest heads to Miami and exposes white-hat hackers to popular software and protocols used in industrial control systems (ICS).

Contestants will have a matter of minutes to demonstrate zero-day exploits that they’ve developed beforehand. Cash and other prizes worth a total of $250,000 will be available to winners, Zero Day Initiative (ZDI), the organization that runs Pwn2Own, said Monday.

For an ICS industry accustomed to non-disclosure agreements related to security testing, the Pwn2Own free-for-all format is a “radical concept,” said Dale Peterson, the founder of the annual S4 security conference, which will host the Pwn2Own competition. The vulnerabilities that Pwn2Own participants discover are revealed to the vendor responsibly so they can be fixed.

“That’s saying, ‘We have some confidence in our equipment. In order to make it better, we need people to test it for us,’” he said.

Organizers say they expect the competition to attract top-tier hacking talent who know the peculiarities of ICS.

“We do anticipate seeing some old and some new faces,” said Brian Gorenc, the director of ZDI, which is backed by cybersecurity company Trend Micro. “There’s not a lot of overlap between security researchers in the ICS sector and other sectors, but those people do exist.”

Some vendors considered offering their systems up for testing at Pwn2Own, but shied away over customer or legal concerns, according to Peterson. One vendor scheduled to be present is Rockwell Automation. The Milwaukee-based industrial software company will provide virtual machines for contestants to pick apart.

Participants will try to demonstrate flaws in protocols that are key to industrial environments, including one that is popular in the electric transmission and distribution sectors. Human machine interface (HMI) software — a dashboard that connects an operator to industrial equipment— will also be available for hacking.

Organizers chose industrial software that has already been security tested and wouldn’t be too easy to hack, according to Peterson.

“We wanted to pick equipment that had a large footprint out there,” he told CyberScoop. “So if they found something it’s not just some trivial HMI that nobody uses.”

This will be the second time in a year that Pwn2Own has broken ground in a new industry or set of industries. Last March, a pair of white-hat hackers demonstrated the first zero-day exploit specific to the car industry in the event’s history.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure