TyphoonPWN 2023 FAQ

Registration

Registration is available to all, not limited to conference attendees*.

To participate in TyphoonPwn send the following information to contact@ssd-disclosure.com:

Name/Alias for public use
Contact name (will not be made public – optional)
Contact Information (will not be made public)
Category

*Registration is queue based. Registrants for a certain category prior to the event will be prioritized over participants registering after the competition has started.

Pre-Registration deadline

Pre-Registration ends on June 15th 2023, at 9 AM KST. For late registration after the deadline, please contact the organizers at info@typhooncon.com.

If you win the competition, we will ask you for the following information (it will not be made public):

Contact name
Address
Contact phone number
Contact Email
Payment information (write transfer info, paypal or address for mailing a check)

TyphoonPWN will begin June 15rd 2023, at 8 AM KST and will end June 16 2023, at 5 PM KST

Prizes

SSD is offering cash and prizes during the competition for vulnerabilities and exploitation techniques against the listed targets in said categories.
The order of contestants attempting to compromise the target will be on a first come, first served basis.
If unsuccessful, the next contestant in line will be given an opportunity to attempt an exploit and so on. This will continue until a contestant successfully compromises the target (If not done on the first round, contestants may be called for another round of attempts later that day or the day after).
The first contestant to successfully compromise a selected target will win the prize money for that target in that category.
After a target has been compromised, the contest for that category will be over. SSD may decide to continue the contest and offer an additional prize for that target, in which case this would be announced at the conference.
All prizes are in USD.
If winners did not register prior to the event, the first winners will be determined by the time of the solution email sent.

Integrity Level

For RCE vulnerabilities, executed code should run at the integrity level of the renderer process (‘Tab’) or higher.

Device Settings

The targets will be running on the latest, fully patched version of the operating system available on the selected target.
All targets will be installed in their default configurations.
The vulnerabilities utilized in the attack must be unknown, unpublished, and not previously reported to the vendor.
A given vulnerability may only be used once across all categories.

Remote Code Execution without Sandbox Escape

To provide a testing environment for this vulnerability, Chrome will be launched without the Sandbox feature chrome.exe –no-sandbox.
The URL of the researcher will be accessed – this URL needs to be reachable to the phone by having your laptop or USB key contain a payload that will be served by a web server (yours or provided by us).
Code will be executed due to the access of this URL.
This will be the only interaction allowed with Chrome (the URL placement and opening of it), any additional popup or question presented to the user will not be considered as RCE and will be considered a social engineering vulnerability and will not qualify as an RCE.

Remote Code Execution

Code execution would be considered as one when its arbitrary shell code execution.
The shell code should in assembly (either native or compiled code stored as assembly instructions).
The shell code should be running without any character, opcode, length or other restrictions. If any such restrictions exist, this should be noted during the demonstration of the code execution.
The preferred shell code execution outcome would be popping of calc triggered by launching the executable.

Linux Specifications

1. Target Operating system can be any of the following:

CentOS (7), Debian (10/11), Ubuntu (22.04).

2. In all cases it will be the latest available version of the operating system with the latest available for that distribution Kernel and Patches.

3. The exploit will be launched from a regular user without any special additional privileges.

Winner selection

Upon successful demonstration of the exploit, the contestant will provide a fully functioning exploit plus a whitepaper explaining the vulnerabilities and exploitation techniques used in the attack. SSD will then determine whether the exploit meets the above rules. SSD may choose to accept the entry(ies) but offer a prize at a value less than the initial prize offering for a given category if it decides that part of the exploit chain fails to meet the above rules.

A short white paper including details about all of the vulnerabilities (memory corruption, infoleaks, escalations, etc.) leveraged and the sequence in which they are used must be provided to receive the prizes.

Vulnerabilities and exploit techniques revealed by contest winners will be disclosed to the affected vendors and the exploits and whitepapers will be the property of SSD. The original finder of the vulnerability will receive credit (or remain anonymous if he wishes to) for the vulnerabilities, the whitepaper and the disclosure.

NOTE: SSD reserves the right to solely determine what constitutes a successful attack.

Who Can Apply

TyphoonPwn is open for registration to anyone who is 18 years of age or older at the time of registration – excluding anyone working for one of the vendors whose equipment is used in the contest or is involved in development of the devices used in the contest. Also excluded are SSD employees and any of its affiliates.

Applicants may apply individually or as a team. All applications must contain valid, true, complete and accurate information.

Remote participation is optional. Remote participants are required to to meet all of the items above.

SSD reserves the right to disqualify any applicant and/or application, at its sole discretion, if untruthful information is submitted.

SSD reserves the right to request further information from the Participant, as may be required in order to evaluate their ability to perform the required tasks at the Competition (this request may include the evidencing of formal identity documents)

Submission

You may provide the item for further inspection after being announced a winner in a category by using the following public PGP key with this address: contact@ssd-disclosure.com.