Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner.

Trend Micro's Zero Day Initiative (ZDI), which runs Pwn2Own, posted the results but had not published how the three exploits work as of October 9. The wins were demonstrations on contest phones, and at least two of the three used a bug that was already known before the attempt.

The contest rules require each entry to use bugs that are not already known to the vendor or to the organizer. An entry that uses an already-known bug, which ZDI calls a collision, can still be accepted at a lower prize.

Together, the three wins paid $562,500. All three teams were competing for the same listed prize of $300,000 and 30 points.

Xint went first. Its win was first announced with the full prize still to be confirmed, then set at $150,000 and 15 points, half the listed amounts.

Ikotas Labs went second and received the full $300,000 and 30 points. Its entry is also labeled a collision in the results, with no explanation of the label or of why the full prize was paid.

All three Pixel 10 entries were registered as remote exploits. Under the rules, that means breaking into the phone through web content opened in its default browser or over one of four radio links: NFC, Wi-Fi, Bluetooth or baseband.

Source link