They also received $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system. They succeeded on the second attempt by using an integer underflow and a race condition to escalate privileges and execute arbitrary code. The same researchers also earned $35,000 for hacking Oracle VirtualBox.

Interestingly, the white hat hackers used a brute-force technique to escape the sandbox. The exploit chain included an integer overflow in the browser and a heap overflow that allowed them to escape its sandbox. On the first day of the event, Amat Cama and Richard Zhu of team Fluoroacetate earned $55,000 for an exploit targeting Safari. In addition, for the first time in the competition’s history, participants have been invited to hack a Tesla Model 3, which can earn them up to $300,000 and a car. The prize pool for this year’s event exceeds $1 million. Pwn2Own 2019, which takes place these days in Vancouver, Canada, alongside the CanSecWest conference, is organized by Trend Micro’s Zero Day Initiative (ZDI). Apple’s Safari web browser and the Oracle VirtualBox and VMware Workstation virtualization products were hacked on the first day of the Pwn2Own 2019 hacking competition, earning researchers a total of $240,000 in cash.

Oracle vm ware