Pwn2Own

Pwn2Own
Name	Pwn2Own
Established	2007
Venue	Vancouver
Organizer	Trend Micro Zero Day Initiative
Discipline	Vulnerability research
Reward currency	USD, devices, and prizes
Notable winner	Google Project Zero; Chaouki Bekrar; Vupen; Team Fluoroacetate

Pwn2Own is an annual computer security contest that challenges researchers to exploit widely used software and devices under controlled conditions. Participants demonstrate zero-day vulnerabilities against targets such as web browsers, mobile phones, virtualization platforms, and industrial control systems, with successful entries earning cash, devices, and coordinated disclosure to vendors. The event serves as both a competitive showcase for exploit development and a coordinated mechanism for improving product security through mandatory vendor patching.

Overview

Pwn2Own is organized by Trend Micro's Zero Day Initiative and typically held alongside technology conferences such as CanSecWest and Black Hat USA. The contest targets proprietary products from firms including Apple Inc., Google LLC, Microsoft Corporation, Mozilla Foundation, Samsung Electronics, Tesla, Inc., and Qualcomm Incorporated. Rewards and stipulations are defined by a ruleset agreed upon by sponsors like HP Inc., Intel Corporation, Facebook, Inc., and Amazon.com, Inc.; successful exploit submissions are often subject to coordinated disclosure with vendors such as Oracle Corporation and Adobe Systems. Pwn2Own interacts with research communities including Project Zero, Metasploit Project, Zero Day Initiative researchers, and independent groups that have emerged from academic labs at institutions like Massachusetts Institute of Technology, University of Cambridge, and University of California, Berkeley.

History and Evolution

The contest began in 2007 at CanSecWest as an incentive program to motivate vulnerability research and to pressure vendors such as Microsoft Corporation and Apple Inc. to fix critical flaws. Early years featured exploits against web browsers like Internet Explorer, Firefox, and Safari; over time the scope expanded to include mobile devices such as the iPhone, enterprise platforms like VMware, Inc.'s hypervisors, and automotive systems from manufacturers including Tesla, Inc. and Nissan Motor Company. Notable shifts occurred after partnerships with organizations like HP Inc. and Trend Micro formalized cash prizes and acquisition policies. The rise of commercial exploit vendors such as VUPEN Security and disclosure programs like Microsoft Security Response Center influenced both tactics and the ethics discourse surrounding zero-day markets. By the 2010s the contest incorporated categories for industrial control systems related to firms like Siemens AG and automotive suppliers such as Bosch GmbH.

Competition Format and Rules

Competitors register as individuals or teams often representing groups such as Google Project Zero, Team iDefense, or independent researchers like Chaouki Bekrar. Targets are provided with specific build versions from vendors including Apple Inc., Google LLC, Microsoft Corporation, and Samsung Electronics. Rules mandate that exploits must be demonstrated within a limited time window and that successful entries result in payloads proving code execution or privilege escalation, as adjudicated by judges from organizations like Trend Micro and HP Inc.. Monetary awards are paid by sponsors including Mozilla Foundation, Intel Corporation, and Facebook, Inc.; in many years bounty payments were supplemented by device prizes donated by manufacturers such as Huawei Technologies and Sony Corporation. Vendors are notified under coordinated disclosure frameworks like those from CERT Coordination Center and FIRST to allow patching before public disclosure by teams such as Project Zero and academic labs.

Notable Exploits and Winners

Pwn2Own has produced landmark demonstrations with winners including independent researchers and commercial teams. Examples include browser compromises affecting Google Chrome, Mozilla Firefox, and Apple Safari that influenced mitigation adoption by Chromium Project and WebKit maintainers; kernel exploits against Microsoft Windows and macOS that prompted updates from Microsoft Corporation and Apple Inc.; and mobile chain attacks against devices from Apple Inc. and Samsung Electronics that were publicized by teams like VUPEN Security and Project Zero. Significant victors include individuals such as Chaouki Bekrar and groups linked to academic institutions at École Polytechnique Fédérale de Lausanne and Technical University of Munich, as well as corporate labs like Google Project Zero. Exploits have influenced products from Oracle Corporation's Java and Adobe Systems's Adobe Flash through responsible disclosure after contest demonstrations.

Impact on Security Industry

Pwn2Own influenced vulnerability markets, disclosure norms, and defensive engineering across companies including Microsoft Corporation, Apple Inc., Google LLC, and Intel Corporation. The contest accelerated adoption of mitigations such as Address Space Layout Randomization and Control-Flow Integrity by projects like Linux kernel maintainers and Chromium Project developers. It helped legitimize coordinated disclosure workflows utilized by entities including CERT Coordination Center, FIRST, and vendor-specific teams such as Microsoft Security Response Center and Apple Security Response teams. Security vendors and asset owners—including Trend Micro, McAfee, LLC, and Symantec Corporation—adjusted product roadmaps in response to demonstrated exploit techniques, and academic programs at institutions like Stanford University and Carnegie Mellon University integrated Pwn2Own case studies into curricula.

Controversies and Criticism

Pwn2Own has prompted debate involving actors such as VUPEN Security and policy bodies like Electronic Frontier Foundation over the ethics of cash-for-zero-day models versus open disclosure. Critics from organizations like EFF and researchers at University of California, Berkeley argued that high bounties may feed commercial exploit markets tied to firms like Hacking Team and influence geopolitical actors including state-level capability builders. Defenders point to improved patching timelines by vendors including Microsoft Corporation and Apple Inc. and collaboration with disclosure coordinators such as CERT Coordination Center and FIRST. Additional disputes concerned participation rules, sponsor influence from companies like HP Inc. and Intel Corporation, and the role of commercial exploit brokers compared to public-security researchers from institutions including University of Cambridge and MIT.

Category:Computer security competitions