Pwn2Own 2021: Zoom, Teams, Exchange, Chrome and Edge “fully owned”

The annual Pwn2Own contest features live hacking where top cybersecurity researchers duke it out under time pressure for huge cash prizes.

Their quest: to prove that the exploits they claim to have discovered really do work under real-life conditions.

Indeed, Pwn2Own is a bug bounty program with a twist.

The end result is still responsible disclosure, where the affected vendor gets a chance to fix any flaws before they are made public, but the bug hunters don’t just submit their bug descriptions with a list of instructions for the vendor to follow and investigate.

The competitors are faced with a standardised, patched, vanilla configuration of the system they’re targeting, set up for them on hardware they didn’t choose theselves, and they have just 20 minutes in which to complete their attack during the competition.

That means there is very little time to adjust, adapt, rethink and rewrite code during the timed part of the event itself, so this really is a showcase for meticulous research, scrupulous preparation, careful rehearsal…

…mixed with a dash of je ne sais quoi and a dose of plain old luck.

The “plain old luck” factor exists because the participants do their demonstrations one after another over three days, with the order chosen randomly just before the competition starts.

If two teams show up with the same exploit, and both of those exploits succeed within the allotted time, then the winner isn’t the one who can prove they found it first during their research phase, but the one who just happened to get the earlier demonstration slot in the draw.

Clearly, the earlier the slot you draw, the less likely you are to get scooped by someone else who just happened to have found the same bug as you.

Greetz from Texas

Traditionally, the North American Pwn2Own event has taken place alongside the annual CanSecWest security conference held in Vancouver, Canada, but this year the official host city was Austin, Texas.

For obvious reasons, the actual hacking teams were distributed all over the world, rather than all travelling to meet in one place.

The full results for 2021 can be found on the Pwn2Own blog, including those who tried but failed, or those who tried but didn’t win any money because some part of their exploit chain was already known.

In some cases, competitors lost out because their exploits had been reported to the vendor before the competition by someone else, but not yet publicly disclosed; in other cases, they lost out simply through the bad luck of drawing a later slot in the competition than other participants who had brought along and exploited the same bugs.

We’ve listed the money-winning entries below – note that this year’s prize money totalled a very healthy $1.21 million!

The prize hierarchy looked like this:

  • $200k for code execution on a server or messaging platform
  • $100k for code execution via a browser
  • $40k for breaking out of a virtualised guest OS into the host OS
  • $40k for “getting root” (more properly, SYSTEM) on Windows 10
  • $30k for “getting root” on Linux

In case you are wondering, EoP below is short for elevation of privilege, which means exactly what it says: it doesn’t get you into a system in the first place, but it does gets you up to superpower level once you’re in.

Particpant                    Platform            Pwnership level   Prize
----------------------------  ------------------  ----------------  --------
DEVCORE                       Microsoft Exchange  Server takeover   $200,000
'OV’                          Microsoft Teams     Remote code exec  $200,000
Daan Keuper/Thijs Alkemade    Zoom Messenger      Remote code exec  $200,000
Bruno Keith/Niklas Baumstark  Chrome and Edge     Remote code exec  $100,000
Jack Dates                    Apple Safari        Kernel code exec  $100,000
Jack Dates                    Parallels Desktop   Escape to host     $40,000
Sunjoo Park                   Parallels Desktop   Escape to host     $40,000
Dao Lao                       Parallels Desktop   Escape to host     $40,000
Benajmin McBride              Parallels Desktop   Escape to host     $40,000
Team Viettel                  Windows 10          EoP to SYSTEM      $40,000
Tao Yan                       Windows 10          EoP to SYSTEM      $40,000
'z3r09’                       Windows 10          EoP to SYSTEM      $40,000
Marcin Wiazowski              Windows 10          EoP to SYSTEM      $40,000
Ryota Shiga                   Ubuntu Desktop      EoP to root        $30,000
Manfred Paul                  Ubuntu Desktop      EoP to root        $30,000
Vincent Dehors                Ubuntu Desktop      EoP to root        $30,000
                                                           TOTAL  $1,210,000

Interestingly, there was a tenth product that was attacked in the competition, but that doesn’t show up in the list above because it remained unpwned within the allotted time: Oracle’s VirtualBox virtualisation software.

See you next year!

Congratulations to everyone who took part…

…and good news for all the rest of us, because all the bugs that were painstakingly uncovered, understood and used in the attacks above – and note that many attacks required a number of different exploits to be unleashed in a specfic sequence – will now all be fixed.

To learn more about vulnerabilities and how attackers chain them together for more devastating results, listen to our Understanding Vulnerabilities podcast below:


Podcast originally recorded in 2010. You can also listen directly on Soundcloud.