Ben

Android Vulnerability Researcher, Pwn2Own 202{3,5,6}

[Ben @XploitBengineer]

@pamoutaf I nearly pass out, literally every time

[pam @pamoutaf]

As promised, here is the blogpost for code execution on the meta rayban 😎 https://t.co/m1GWZiOCF2

[Ben @XploitBengineer]

My key takeaway from this is that OpenAI is confident that Pwn2Own will still be a thing in 948 years

[OpenAI @OpenAI]

The full run cost $1,213,430 in API credits—about $1,279 per distinct local privilege escalation vulnerability.

For context, applying historical Pwn2Own and TyphoonPWN bounty rates gives a hypothetical value of $18.9M–$66.3M.

This demonstrates the relative efficacy of using AI models for securing software—defenders should proactively analyze software to make cyber attacks cost-prohibitive.

[Ben @XploitBengineer]

@devs_lyfe @C2IRIS "if the stars align" is doing a huge amount of heavy lifting there

[Sean Heelan @seanhn]

haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.

Literally stealing people's private work, as they do it, is cartoonishly evil.

It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.

Yet another reminder of the importance of open models.

[Ben @XploitBengineer]

Man, I'm genuinely starting to wonder whether Kim Jong Il was Satoshi Nakamoto.

Last known Satoshi contact, April 2011, Kim Jong Il dies later that year and North Korea spends the next 15 years using Bitcoin as a replacement for taxes.

[Binance @binance]

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

As an immediate precaution, Binance has:

- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.

https://t.co/ywB2mKFy0p

[Ben @XploitBengineer]

@LinxzSec He makes half of a good point. "Personal" AI is not a good way to utilise resources.

AI on your desk and proprietary AI are not the only two options though, open source models self hosted but on server hardware is the sensible middle ground for most business cases I think

[Ben @XploitBengineer]

@LinxzSec This guy has a level of obsession for busses that rivals Francis Bourgeois's for trains

[Ben @XploitBengineer]

@yarden_shafir Adds a touch of excitement though right, never sure whether your current location will become the final destination of your journey.

[TrendAI Zero Day Initiative @thezdi]

Verified! The 1st full win the the Wellness category has Interrupt Labs (@InterruptLabs) using an OOB Read and an OOB Write to exploit the Garmin Index BPM. They win $20,000 and 2 Master of Pwn points. #Pwn2Own

[pam @pamoutaf]

Managed to get @opa334dev to talk about the TSS bug on chITchat 👀 You can listen on most platforms but here is the link to Spotify. Will upload to youtube as well. https://t.co/7uWdlmJxgj

[TrendAI Zero Day Initiative @thezdi]

It was DOOMsday for the Lexmark CX532adwe printer as Interrupt Labs (@InterruptLabs) claimed victory and earned $5k & 2 Master of Pwn points! #Pwn2Own #DoomHack

[TrendAI Zero Day Initiative @thezdi]

Wow - the setup took a while (and included Starlink!), but Interrupt Labs (@InterruptLabs) successfully exploited the #Samsung Galaxy S26. They're off to the disclosure room to provide the details. #Pwn2Own

[Ben @XploitBengineer]

@andersonc0d3 Yes. And the fact that people don't want their knowledge being invested by LLMs

[Ben @XploitBengineer]

@FuzzySec Did you come across the "if it's too big, it must be an exploit so let's decode it in Java" logic? 🤣🤣

[Leshka.eth ⛩ @leshka_eth]

Anthropic valuation - $2 trillion
Samsung valuation - $1.35 trillion

Anthropic 2025 revenue - $4.6 billion
Samsung 2025 revenue - $236 billion

[𝚊𝚕𝚔𝚊𝚕𝚒 @alkalinesec]

a lot of people dont appreciate the difference in required effort for a 1% reliable mem corruption exploit vs 10% vs 99% . this post https://t.co/NJ8qS1XFX3 by @natashenka expresses this well. the truth is that often a 10% reliability exploit is *no progress to full reliability*

[Ben @XploitBengineer]

@LinxzSec It's a savings account right... Right!?

[Ben @XploitBengineer]

@benhawkes Hopefully you can time it to your approx retirement age

[Ben @XploitBengineer]

$6,500... I guess next time you can just sell the access to the Chinese

[s1r1us @S1r1u5_]

We reported the bug to Discourse and OpenAI. OpenAI fixed the SSO issue roughly 14 hours after our initial submission.

Discourse received our separate report Saturday, replied Sunday, and had a fix Monday.

OpenAI awarded us $6,500.