Welcome to Pwn2Own 2018: The Schedule
March 14, 2018 | Dustin ChildsWelcome to Pwn2Own 2018, where for the first time in the contest’s history, we’re joined by our partner Microsoft and sponsored by VMware. Their contributions enable us to offer up to $2,000,000 USD in cash and prizes in the categories of virtualization, web browsers, enterprise applications, servers, and a special Windows Insider Preview Challenge category.
As we do every year, the competition order was decided by random drawing in the contest room on the first day of the competition. This year's event features five entrants targeting products across two of the categories - seven different attempts in total. Each contestant has three attempts within their allotted 20-minute timeslot to demonstrate their exploit. We did have additional contestants register, but unfortunately, they were forced to withdraw from the competition for various reasons – some of which involve yesterday’s bevy of patches.
The full schedule for the contest is below (all times PDT). We will update this schedule with results as they become available.
Day One - March 14, 2018
1000 – Richard Zhu (fluorescence) targeting Apple Safari with a sandbox escape
Failure: The contestant could not get his exploit working within the time allotted.
1200 – Richard Zhu (fluorescence) targeting Microsoft Edge with a Windows kernel EoP
Success: Richard used two UAFs in the browser and an integer overflow in the kernel to earn $70,000 USD and 7 points towards Master of Pwn.
1400 – Niklas Baumstark (_niklasb) from the phoenhex team targeting Oracle VirtualBox
Partial Success Niklas used an Out-of-bounds (OOB) read and a Time of Check-Time of Use (toctou) bug to earn $27,000 and 3 Master of Pwn points.
1600 – Samuel Groß (5aelo) of phoenhex targeting Apple Safari with a macOS kernel EoP
Success: Samuel used a three bug chain to successfully exploit Apple Safari, earning himself $65,000 and 6 points toward Master of Pwn.
Day Two – March 15, 2018
1000 – Richard Zhu (fluorescence) targeting Mozilla Firefox with a Windows kernel EoP
1200 – Markus Gaasedelen, Nick Burnett, Patrick Biernat of Ret2 Systems, Inc. targeting Apple Safari with a macOS kernel EoP
1400 – MWR Labs - Alex Plaskett (AlaxJPlaskett), Georgi Geshev (munmap), Fabi Beterke (pwnfl4k3s) targeting Apple Safari with a sandbox escape
As always, we’ll update this blog with results throughout the day and recap each day’s events in a separate blog. You can also find the latest results by following our Twitter feed. Best of luck to all of our contestants!