Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

04:44 PM
Connect Directly

Pwn2Own Adds Industrial Control Systems to Hacking Contest

The Zero Day Initiative will bring its first ICS Pwn2Own competition to the S4x20 conference in January.

Vulnerability research competition Pwn2Own is expanding to include industrial control system (ICS), giving researchers an opportunity to hunt for bugs in popular ICS software and protocols.

This is the first time Trend Micro's Pwn2Own, now in its twelfth year, has added ICS tech to its lineup. The Vancouver-based contest started out challenging ethical hackers to find flaws in Web browsers; since then, it has expanded to include virtualization software and enterprise applications. This past March, PWn2Own participants hacked into a Tesla Model 3's infotainment system.

Its first ICS security competition will take place at the January S4 conference in Miami Beach. The decision to have ICS Pwn2Own at S4 was mutual, says Dale Petersen, founder of S4 Events and Digital Bond. When he approached Trend Micro's Zero-Day Initiative (ZDI) back in the spring to propose bringing ICS Pwn2Own to S4x20, they had already been thinking about it. In 2018, ZDI purchased 224% more zero-day vulnerabilities in ICS software compared with the previous year, demonstrating a growing need to research bugs in industrial control software.

One challenge has been finding the right time to introduce a hacking contest for ICS technology, which as Peterson points out, has long lagged behind in terms of security. "The industry wasn't ready for it," he says. Pwn2Own could have held an offensive security contest, but it would have been relatively easy for researchers to break into systems. Now, systems' protections are stronger, he explains. Today's ICS technology, while not perfect, gives researchers a challenge.

Brian Gorenc, director of Zero-Day Initiative, says S4 is the "perfect location" to launch an ICS-focused Pwn2Own. "Those products control many pieces of critical infrastructure but are often overlooked by researchers," he explains. The goal of Pwn2Own Miami is to build on the security of existing ICS technology by discovering vulnerabilities and providing the research to vendors.

This kind of competition presents a host of logistical challenges, he continues. Are products easily available for organizers and researchers? How are they configured? Can all the necessary equipment be shipped to the conference location?

"With ICS, we obviously can't ship a centrifuge to a hotel, and researchers are unlikely to have pump controllers sitting around for them to test," Gorenc adds. "However, we were able to work with our industry contacts to find readily available, software-based ICS products that make sense to include in the contest."

Organizers reached out to several people and firms in the ICS sector, says Peterson, and technologies were considered with two key factors in mind. First was the footprint, or how widely used the system is. Second was its relevance to researchers and the ICS community. Rockwell Automation, for one, is providing virtual machines with their products for the contest.

ICS Pwn2Own will be broken down into five categories: Control Server, OPC Unified Architecture (OPC UA) Server, DNP3 Gateway, Human Machine Interface (HMI)/Operator Workstation, and Engineering Workstation Software (EWS).

"We chose these categories based on the conversations we had with those in the ICS sector and based on what we could logistically accomplish," he continues. "These five categories provide a broad look at different aspects of ICS and provide a wide set of targets for researchers.

EWS is a hot target for attackers as it directly communicates and can configure primary control equipment like PLCs, Gorenc says. The HMI category is similar: attackers target the HMI as it often has Web server components and can definitely be affected by Web-based exploits. "Highly deployed ICS software is often locked behind a paywall and not easily accessible to researchers," he says. Pwn2Own aims to remove these barriers to let researchers evaluate security.

The Contest

How it works: targets will be announced three months before the competition, giving Pwn2Own contestants a window of time to develop an exploit, Peterson explains. At the show, they have three five-minute attempts to exploit the target. If a denial of service, information disclosure, or remote code execution exploit works, the successful researcher, Pwn2Own team, and ICS vendor (if they choose to participate) will meet to discuss the details. The vendor will verify if it's a true zero-day; if so, it follows ZDI's disclosure policy allowing the vendor 120 days to fix it.

Pwn2Own has allocated more than $250,000 in cash and prizes for eight targets across these five categories, Gorenc writes in a blog post on the news. The contest will usually buy many successful exploits for a target, a tactic meant to encourage participation from more researchers.

Is the ICS community ready for a competition like this? There will be people who don't like it, Peterson says, though he believes it's a positive step forward for the industry. In his view, the organizations that don't update their systems put the industry at greater risk than researchers looking for vulnerabilities in them. Gorenc notes the overall reaction has been positive.

"There is definitely some trepidation, but Pwn2Own has a history of working with vendors to get bugs fixed before they are used in active attacks," he says.

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...