Overcoming challenges excellently, this year, the Viettel Cyber Security (VCS) team of the Military Industry - Telecommunications Group (Viettel) continued to maintain the championship title at the Pwn2Own 2024 competition held in Ireland.
Held annually since 2007, Pwn2Own is one of the world's largest and most prestigious cybersecurity competitions. Here, teams of white hat hackers and security researchers from around the world compete to find and exploit zero-day vulnerabilities (security vulnerabilities that have never been known before) on popular devices such as smartphones, security cameras, office equipment and software used by many businesses.
At Pwn2Own 2024, Viettel's cybersecurity team discovered and exploited 9 zero-day vulnerabilities on products from HP, Canon, Synology, QNAP Systems... and achieved a total of 33 points, nearly twice as many as the second-placed team, Team Cluck from the US, with 17.25 points. Next in the rankings are Midnight Blue from Europe, Neodyme from Germany, and DEVCORE from Taiwan (China), all of which have participated and achieved high results at Pwn2Own and other security competitions.
The reward for each vulnerability found is from 20,000 to 50,000 USD and the total prize at Pwn2Own is about 1 million USD, of which Viettel's cybersecurity team received more than 200,000 USD. The vulnerabilities discovered by VCS also help manufacturers improve the security of devices, avoiding the disclosure of images and data of individuals and businesses using them.
Pwn2Own 2024 has 8 categories, focusing on devices integrated with artificial intelligence (AI), requiring security experts to not only understand source code but also have knowledge of how AI systems store, process data and operate in devices. Here, Viettel's cybersecurity team successfully exploited the categories of surveillance cameras, smart speakers, printers, network-attached storage (NAS), and office routers (SOHO).
The challenge this year is that most AI devices have machine learning-based user detection and authentication, which automatically updates and adjusts to detect unusual behavior, aka dynamic protection. This makes it harder to find vulnerabilities and take over devices.
These are also devices developed by major technology companies, undergoing rigorous testing and constant security updates. Therefore, Pwn2Own is not only a competition between security research groups but also a "competition" with major technology companies.
On each device, VCS studies the source code and tests possible attack scenarios. The team identifies difficult vulnerabilities that are unlikely to be duplicated by other teams, to demonstrate live and gain access or control of the device. (Duplicate vulnerabilities are not considered valid).
According to Intellectual Property and Innovation
Source: https://doanhnghiepvn.vn/cong-nghe/dai-dien-viet-nam-2-nam-lien-tiep-gianh-ngoi-vo-dich-tai-cuoc-thi-bao-mat-an-ninh-mang-lon-nhat-the-gioi/20241030122450184
Comment (0)