China’s top hackers have gathered this weekend in the city of Chengdu to compete in the Tianfu Cup, the country’s top hacking competition.
Over the course of two days — November 16 and 17 — Chinese security researchers will test zero-days against some of the world’s most popular applications.
The goal is to exploit and take over an app using never-before-seen vulnerabilities. If attacks succeed, researchers earn points towards an overall classification, cash prizes, but also the reputation that comes with winning a reputable hacking competition.
The Tianfu Cup’s rules are identical to what we see at Pwn2Own, the world’s largest hacking contest. The two events are more tied than most people know.
Prior to 2018, Chinese security researchers dominated Pwn2Own, with different teams winning the competition years in a row. Now, all that talent is going against one another.
In the spring of 2018, the Chinese government barred security researchers from participating in hacking contests organized abroad, such as Pwn2Own. The TianfuCup was set up a few months later, as a response to the ban, and as a way for local researchers to keep their skills sharp. The first edition was held in the fall of 2018 to great success, with researchers successfully hacking apps like Edge, Chrome, Safari, iOS, Xiaomi, Vivo, VirtualBox, and more.
This is literally just, like, a hundred Chinese security researchers testing their 0days in competition against modern software targets. It is probably the densest collection of 0days per sqm in the world, and I’ve seen only one organic tweet about it.
Infosec Twitter, wtf?!? https://t.co/781cepNPy6
— thaddeus e. grugq (@thegrugq) November 15, 2019
Day 1 victims: Chrome, Edge, Safari, Office 365
The competition’s first day was its busiest, with 32 hacking sessions scheduled on Saturday. Of these, 13 were successful, seven hacking sessions failed, and in 12 sessions security researchers abandoned exploitation attempts, for various reasons.
Of the successful sessions, Tianfu Cup organizers reported successful hacks of:
- (3 successful exploits) Microsoft Edge (the old version based on the EdgeHTML engine, not the new Chromium version) [tweet]
- (2) Chrome hacks [tweet]
- (1) Safari [tweet]
- (1) Office 365 [tweet, tweet]
- (2) Adobe PDF Reader [tweet]
- (3) D-Link DIR-878 router [tweet]
- (1) qemu-kvm + Ubuntu [tweet, tweet]
After the first day, Team 360Vulcan, a former Pwn2Own winner, is in the lead.
I’m not at all surprised to see 360Vulcan has an exploit in every category. They are a large team with a lot of skilled people. Also, they always dominate by quantity in pwn contests, they go after everything. (The router bugs don’t pay out enough, I guess, to attract 360) https://t.co/bvn41vIK16
— thaddeus e. grugq (@thegrugq) November 16, 2019
In the past, many software vendors have begun to attend hacking competitions, where they send representatives to pick up vulnerability reports minutes after a hacking session ends — with some vendors shipping patches within hours.
There were few vendors at Tianfu Cup; however, with many high-profile successful exploits being recorded in the competition’s first two editions, many companies will most likely begin considering sending a representative next year. Google had members of the Chrome security team on site. A Microsoft spokesperson acknowledged our email, but could not reply before this article’s publication.
A competition spokesperson told ZDNet today that organizers plan to report all bugs discovered today to all respective vendors at the competition’s end.
Day 2: $200,000 for a VMWare escape
Of the 16 sessions scheduled for the second day of the competition, only half went through as planned, with researchers giving up on eight. Of the successful half, seven hacking sessions succeeded, with only one failing to hit its mark. The seven successful exploits targeted:
Team 360Vulcan gave up on their attempt to exploit iOS in their highly awaited session, which was also scheduled last, to end the tournament.
Team 360Vulcan, however, won the competition regardless, earning $382,500 for their efforts of hacking Microsoft Edge, Microsoft Office 365, qemu+Ubuntu, Adobe PDF Reader, and VMWare Workstation.
A big role in winning the competition played the VMWare and qemu+Ubuntu exploits, which brought in $200,000 and $80,000, respectively.