Three Teams Remotely Hack Patched Google Pixel 10 at Pwn2Own

Three independent research teams successfully executed remote hacking demonstrations against fully patched Google Pixel 10 devices on October 8, 2024, during the Pwn2Own Ireland hacking contest held in Cork. The Pwn2Own contest mandates that all target devices must be running the latest security patches, meaning the exploits discovered targeted previously unknown vulnerabilities, often referred to as zero-day flaws. Researchers are compensated for demonstrating working exploits, and the discovered vulnerabilities are subsequently disclosed to the affected vendors for remediation.

One of the three successful Pixel 10 exploits was developed by Ikotas Labs, earning them the contest's highest prize of $300,000. This achievement also secured Ikotas Labs the overall victory in the Pwn2Own Ireland competition. The specific nature of the exploit demonstrated by Ikotas Labs, and the other two successful teams, involved gaining unauthorized remote access and control over the device without any physical interaction or user intervention. This type of exploit is particularly concerning as it can be leveraged by malicious actors to compromise devices from a distance.

The Pwn2Own hacking contest, organized by Trend Micro's Zero Day Initiative (ZDI), serves as a critical platform for identifying and addressing security weaknesses in widely used consumer electronics and software. By incentivizing researchers to find and disclose these vulnerabilities, the contest plays a vital role in improving the security posture of products before they can be exploited by cybercriminals. The successful hacks on the Google Pixel 10 underscore the persistent challenge of securing complex mobile devices against sophisticated attack methods, even when manufacturers implement regular security updates.

While the exact technical details of the exploits were not immediately disclosed, as is standard practice to allow vendors time to patch, the successful demonstrations highlight the ongoing cat-and-mouse game between security researchers and exploit developers. The $300,000 prize awarded to Ikotas Labs reflects the high value placed on discovering critical, remotely exploitable vulnerabilities in high-profile devices like Google's flagship Pixel smartphones. The contest's focus on fully patched systems ensures that the vulnerabilities identified are indeed novel and have not been addressed by previous security updates, providing valuable intelligence for Google's security teams.