Trend Micro's Zero Day Initiative, which buys vulnerabilities and runs Pwn2Own, publishes advisories, contest results, and details of unpatched bugs.
HN commenters point to it as a legitimate place to sell vulnerabilities, especially commodity server-side bugs, and as the source of Pwn2Own bounty results.
As per the full contest rules (https://www.zerodayinitiative.com/Pwn2Own2019Rules.html):
> If more than one contestant registers for a given category, the order of the contestants will be drawn at random. Based on the contestant order, the first contestant will be given an opportunity to attempt to compromise the selected target. If unsuccessful, the next randomly drawn contestant will be given an opportunity. This will continue until a contestant successfully compromises the target. The first contestant to successfully compromise a selected target will win the prize money for that target in that category. After a target has been compromised, the contest for that category is over and no other contestants will participate in the contest for that category (unless Sponsor has offered an additional winner option, which would be announced at the conference if applicable).
I wonder why people suck things like Cloud, Co-Pilot or Adobe, WhatsApp or Windows?
Let me guess. It seemed once convenient. This is the root of all evil. Don’t use it because it was pre-installed (Windows). Don’t keep using it because it was good before the Cloud (Photoshop). Don’t use it because others force you (WhatsApp). Literally all quick and convenient decisions are something we will regret. If you don’t like Gimp, Blender, Krita or Linux you need help to improve it.
Look at the dumpster fire Azure. Nobodies data shall be stored there: https://www.zerodayinitiative.com/advisories/ZDI-24-581/
If the Chinese government isn’t right now reading your E-Mails somebody else does. Literally everything in Azure or any other Cloud must be considered compromised. And between the security issues the rise the prices.
> Virtual machines still suck a lot of CPU and bandwidth for nothing but emulation. Containers in Linux with cgroups are still full of RCE (remote command execution) and priviledge escalation. New ones are discovered each year. The first report I got on those listed 10 or more RCE + PE (remote root on the machine). Remote root can also escape VMs probably also.
A proper virtual machine is extremely difficult to break out of (but it can still happen [1]). Containers are a lot easier to break out of. I virtual machines were more efficient in either CPU or RAM, I would want to use them more, but it's the worst of both.
[1] https://www.zerodayinitiative.com/advisories/ZDI-23-982/
> Then pwn2own decided not to include Firefox in another year hacks because Firefox made no improvements at all in previous 2 years.
Uh, [citation needed]?
Firefox was a valid target in Pwn2Own 2021: https://www.zerodayinitiative.com/blog/2021/1/25/announcing-pwn2own-vancouver-2021#browser
Nobody attacked Firefox successfully, but that's hardly a point against it. I don't know what "made no improvements at all in previous 2 years is supposed to mean", either, since we had just released a major overhaul of the optimizing compiler a few months before Pwn2Own: https://hacks.mozilla.org/2020/11/warp-improved-js-performance-in-firefox-83/.
Related, the two other $200k entries from Pwn2Own 2021:[1]
- DEVCORE targeting Microsoft Exchange in the Server category (The DEVCORE team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server.)
- The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category (OV combined a pair of bugs to demonstrate code execution on Microsoft Teams.)
It would be kind of funny if Slack had one too...
[1] https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021-schedule-and-live-results
> disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec
It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto".
According to MT, none of their staff attended that event.
https://www.zerodayinitiative.com/advisories/ZDI-23-710/