A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds
summary
Three-year Pwn2Own campaign on Sonos documents concrete exploits, tools, and outcomes: initial black‑box probing via wget upgrade flow and firmware reverse, year two DA with a USB3 A0 Eval and mini‑PCIe adapter to dump memory, discovery of an ID3 integer underflow in MP3 metadata that yields a stack overwrite, and a year‑three stack clash in MP4 box parsing turned into R/W primitives using a delayed DNS trick; Sonos patches twice, rearchitects components (including lip X P callback use), and the team nets about $16,000 in bounties.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:09Choosing Sonos as target
- 2:11First year: Black-box attempts
- 8:43First year recap
- 9:29Second year: Hardware attacks
- 13:49Second year recap
- 20:37Attack surface challenges
- 22:05Third year: Persistence struggles
- 28:15Exploit development race
- 35:00Vendor response changes
- 36:46Final month: Bug revisits
- 39:59Key lessons
- 40:22Persistence and path
- 42:30Closing & Q&A
related talks
50mPwnie Awards 2016
43mPWNIE Awards at Black Hat USA 2014
47mFrom WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
55mHow hacking works
59mThe Internet of Pwned Things
32mCommSec D1 - Attacking IoT Speakers
29mFrom pocket to Pwn: How we hacked a multinational Corp for $200 with... (Tim Shipp)
01h 06mHow hacking works