Security Researchers Win Second Tesla At Pwn2Own

On Mar 21, 2024

A team of French security researchers have won a Tesla Model 3 and $200,000 after finding a zero-day vulnerability in a vehicle’s electronic control unit (ECU).

The Synacktiv team were at the top of the leaderboard after one day of Pwn2Own Vancouver 2024, the latest hacking contest held by Trend Micro’s Zero Day Initiative (ZDI).

Little is known about the vulnerability, as all bugs discovered during the course of the competition are responsibly disclosed to the relevant vendor for patching. However, what we do know is that Synacktiv used a single integer overflow flaw to exploit a Tesla ECU with Vehicle (VEH) CAN BUS Control. This is the second car they’ve won in Pwn2Own competitions.

Read more on Pwn2Own: Pwn2Own Contest Unearths Dozens of Zero-Day Vulnerabilities

Day one of the contest saw the ZDI hand out $732,500 for 19 unique zero-day vulnerabilities, which will ultimately help the vendors participating in the competition make their products more secure.

Other highlights included Manfred Paul, who was awarded a total of $102,500 on the day after achieving remote code execution (RCE) on Apple Safari with an integer underflow bug and demonstrating a PAC bypass using a weakness in the same browser.

In round two of the contest, he executed a double-tap exploit on both Chrome and Edge browsers with a rare CWE-1284 “improper validation of specified quantity in input” vulnerability.

Just behind Paul on the Pwn2Own leaderboard is South Korean Team Theori, which earned $130,000 after combining an uninitialized variable bug, a use-after-free (UAF) vulnerability and a heap-based buffer overflow to escape a VMware Workstation and then execute code as system on the host Windows OS.

Competitors in Vancouver yesterday also received prize money for finding zero-days in Adobe Reader, Windows 11, Ubuntu Linux and Oracle VirtualBox.

A total of $1.3m is up for grabs in cash and prizes across the three-day event.