Tag Archive for: earn

ICS Exploits Earn Hackers $400,000 at Pwn2Own Miami 2022

/in


ICS Pwn2Own 2022

Pwn2Own Miami 2022, a hacking contest focusing on industrial control systems (ICS), has come to an end, with contestants earning a total of $400,000 for their exploits.

The contest, organized by Trend Micro’s Zero Day Initiative (ZDI), saw 11 contestants demonstrating their exploits in the OPC UA Server, Control Server, Human Machine Interface, and Data Gateway categories.

Participants targeted products from Unified Automation, Iconics, Inductive Automation, Prosys, Aveva, Triangle MicroWorks, OPC Foundation, Kepware, and Softing.

A majority of the 32 hacking attempts were successful — two failed and eight involved previously known bugs. These “bug collisions” still earned participants $5,000 for each attempt.

The white hat hackers who attended the event earned either $20,000, typically for remote code execution vulnerabilities, or $5,000, for DoS vulnerabilities. There was only one exception. The Computest Sector 7 team earned $40,000 for successfully bypassing the trusted application check on the OPC UA .NET standard.

This was the maximum amount that Pwn2Own participants could earn for a single exploit, and Computest’s attempt involved what ZDI described as one of the most interesting bugs ever seen at Pwn2Own. In fact, the Computest team earned the most points and a total of $90,000.

In 2020, at the first edition of the ICS-themed Pwn2Own, participants earned a total of $280,000. This event was not held in 2021 due to the COVID-19 pandemic.

Pwn2Own Miami 2022 took place between April 19 and April 21 alongside the S4x22 ICS security conference.

Related: Serious Vulnerability Exploited at Hacking Contest Impacts Over 200 HP Printers

Related: Device Exploits Earn Hackers Over $1 Million at Pwn2Own Austin 2021

Related: $1.9 Million Paid Out for Exploits at China’s Tianfu Cup Hacking Contest

view counter

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by…

Source…

How father-son duo helped techies ‘hack exams’, earn top scores for big payday

/in






© Provided by The Print


New Delhi: The Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police has busted a “module” that has allegedly been taking online IT certification exams on behalf of students and professionals aiming to boost their career prospects in IT companies. So far, the police have arrested three people in connection with the money-for-marks scheme.

According to the police, the masterminds of the high-tech cheating racket are a father-and-son duo, Rajesh Kumar Shah and Deep Shah, who run an IT coaching institute in Ahmedabad, Gujarat. The two allegedly hired a Delhi-based technical expert, Aklakh Alam, to take the exams remotely for clients.

“We received intel that several services are available on the dark web, in which hackers claim they can get the desired score by hacking into the device used by the examinee,” Deputy Commissioner of Police (DCP) K.P.S. Malhotra told ThePrint. Another police source said that the accused charged around Rs 9,000-10,000, and gave exams for about 200 clients.

The trio apparently specialised in cracking various online tech certification exams. Getting a high score in these competitive exams can help IT aspirants get better placements, DCP Malhotra told ThePrint.

“Various international certifications are prerequisites to upgrade technical skills. These certifications are being provided by a number of reputed organisations — there are certifications from Cisco, CompTIA, EC-Council… these play a crucial role in the selection and pay grade of a candidate in the IT sector as well in other industries,” the officer said. He added that high scores in these competitive exams can make a big difference to the career progress of IT aspirants.

“These certifications are taken up worldwide, by huge IT companies like Microsoft, Google etc and higher packages are given to the aspirants,” another police source said.

“They have been running this scam since the Covid-19 outbreak, as all examinations shifted to an online mode. The latest intel we received was [about the] Pearson IT certification,” the source added.

Also Read: Fake websites, UPI hacking — Delhi saw 190% rise in cyber frauds during…

Source…

Meet the hackers who earn millions for saving the web. How bug bounties are changing everything about security

/in


These hackers are finding security bugs–and getting paid for it. That’s changing the dynamics of cybersecurity.

The first time Katie Paxton-Fear found a bug, she thought it was just luck. 

One of her friends had signed her up for an event in London, where hackers aim to find the vulnerabilities in a particular piece of software.

Without any experience of cybersecurity beyond being a programmer and developer, she found one bug, then another. “To be fair, I thought it was a fluke,” she says. But since then she’s found 30 more security bugs.

“It’s kind of like playing Sherlock Holmes,” says Paxton-Fear.

“You feel like a detective, going in rooting around and saying, ‘That looks interesting’, and having a stream of clues,” she says. “And, when you get all the pieces neatly together, and it works and there’s a bug there–it’s the most thrilling experience ever.”

But unlike a hacker looking for vulnerabilities to cause damage or steal data, Paxton-Fear is a bug bounty hunter. The bugs she finds are reported to the companies that write the code.

SEE: Security Awareness and Training policy (TechRepublic Premium)

That allows these organisations to fix the problems before malicious hackers find the same weaknesses. And the bug hunters get paid for each one they find.

As such she’s part of a growing industry that allows security researchers to hack into organisations’ software–with their permission–and then report the weaknesses they discover in return for a financial reward.

It’s a different way of approaching computer security, but one that is proving increasingly popular. One key feature is these security researchers will approach a target from the same perspective as a potential attacker. 

In that sense, bug bounty hunters are both the detective Holmes and also at least in part his nemesis, Moriarty, although Paxton-Fear says she sees herself more as Sherlock because by finding…

Source…