Pwn2Own is one of the world’s largest and most prestigious cybersecurity competitions, where white-hat hackers and security researchers from around the globe compete to identify and exploit zero-day vulnerabilities (previously unknown security flaws) in widely used devices such as smartphones, security cameras, office equipment, and software used by businesses.

At Pwn2Own 2024, Viettel’s cybersecurity team identified and exploited nine zero-day vulnerabilities in products from companies such as HP, Canon, Synology, and QNAP Systems, earning a total of 33 points—almost double that of the second-place team, Team Cluck from the United States, with 17.25 points. Other teams in the ranking included Midnight Blue from Europe, Neodyme from Germany, and DEVCORE from Taiwan (China), all of whom have previously competed and achieved high results in Pwn2Own and other cybersecurity competitions.

The reward for each identified vulnerability ranges from $20,000 to $50,000, with the total prize pool at Pwn2Own approximately $1 million. Viettel’s cybersecurity team received over $200,000 in prizes. The vulnerabilities discovered by VCS also aid manufacturers in improving device security, preventing the leakage of personal and business data.

Pwn2Own 2024 featured eight categories, focusing on AI-integrated devices that required security experts to understand both source code and how AI systems store, process, and operate data within the devices. Viettel’s cybersecurity team successfully exploited vulnerabilities in categories such as surveillance cameras, smart speakers, printers, network-attached storage (NAS), and SOHO routers.

This year’s challenge was elevated by the fact that most AI devices included features like automated user detection and authentication via machine learning, as well as dynamic protection layers capable of updating and adapting to detect unusual behaviors. These features made it harder to locate and exploit vulnerabilities.

The devices involved are developed by major technology companies, undergoing rigorous testing and constant security updates. Therefore, Pwn2Own is not only a competition among cybersecurity research teams but also a “competition” against major tech firms.

On each device, VCS examined the source code and tested possible attack scenarios. The team targeted rare and complex vulnerabilities, aiming for those unlikely to overlap with other groups, to perform live demonstrations and gain access or control over the devices (duplicate vulnerabilities are not considered valid).

The devices in which VCS found and exploited vulnerabilities at Pwn2Own 2024 included the Lorex 2K security camera, Synology TC500 AI camera, Ubiquiti AI Bullet camera, Sonos Era 300 smart speaker, HP Color LaserJet Pro printer, Canon imageCLASS MF656Cdw printer, QNAP TS-464 storage device, and TrueNAS Mini X storage device.

Pwn2Own has been organized by the Zero Day Initiative (ZDI) since 2007. ZDI, a program established by cybersecurity firm Trend Micro in 2005, promotes the discovery and disclosure of zero-day vulnerabilities to protect users. When a vulnerability is reported through ZDI, the program coordinates with the device or software developer to resolve the issue, ensuring network security and user safety.