According to news reports, 15 teams participated in the third edition of China’s Tianfu Cup. Competing teams were given three attempts of five minutes each to hack into a selected target using an original exploit. Tianfu Cup is a prestigious annual hackathon held in China. Each year, youngsters compete to find new and unique ways to hack into popular software and platforms. This year also young hackers discovered exploits in iOS 14, Windows 10, Chrome, Safari, and Adobe PDF Reader, among others.
The 360 ESG Vulnerability Research Institute was named the champion. The team received $750,000 in prize money. The team had won the competition last year as well. AntFinancial Lightyear Security Lab and security researcher Pang bagged the second and third spots, respectively.
China’s Tianfu Cup team successfully hacked into the following systems:
iOS 14 (on iPhone 11 Pro Max), Android (on Samsung Galaxy S20), Chrome, Safari, Firefox, Adobe PDF Reader, Docker-CE, VMware EXSi, Qemu, CentOS 8,Windows 10 2004, TP-Link, ASUS Router
Responding to China’s Tianfu Cup, former Chief Security Officer at Facebook and computer scientist Alex Stamos called for a national strategy to create something equivalent for cybersecurity research.
Alex tweeted, “This and similar contests contain hard lessons about the bug density of critical US software and the effectiveness of the PRC's effort to create a homegrown public-private offensive capability. These lessons need to be deeply considered by the reconstituted Biden NSC cyber team. In pithier terms: Chinese researchers are burning full-patched iOS 0-day for $180k while our Supreme Court is considering whether security research should remain legal in the US.”
