At just after 1 AM on October 27th, in the brightly lit room of Viettel Cyber Security Company (VCS), the 14 members of the VCS team erupted in joy: The team had won the championship of the world's largest and most prestigious cyberattack competition, Pwn2Own 2023.
This is not just the expected result of three months of continuous, day-and-night work by the entire team, but also of tenaciously competing against the strongest opponents from around the world !
This is not only the first sweet reward for the youngest member of the team, Do Anh Dung, born in 2003, who is currently a third-year student at the University of Technology (VNU Hanoi)!
It's not just the desire to reach the top of the competition for members like Ngo Anh Huy, Nguyen Xuan Hoang, Nguyen Hong Quang… who have been trying their luck at this tournament for several years in a row!
It was also a glorious achievement to bring home the top position for the country in one of the most prestigious global competitions, affirming the capabilities of Vietnamese people in the field of information security and safety.
And most importantly, it is the "sweet fruit" harvested from the seeds that Viettel has steadfastly sown for many years. Today, with VCS and its team of information security experts, Viettel can proudly claim to be one of the world's leading companies in information security and safety capabilities.
All 14 members of the VCS team that won the Pwn2Own 2023 championship are very young. The majority of the members are from the 90s generation, with the youngest member born in 2003.
But most of the team members have years of experience and a wealth of achievements in the field of information security. Even the youngest member of the team, Do Anh Dung, has proven himself: Dung was the one who achieved a miracle in this competition, winning in one category and contributing to the team's overall result.
Concluding the final competition category on the evening of October 27th, the team from Viettel Cyber Security (VCS) officially secured the top victory with 30 Master of Pwn points, leaving the second-place team far behind by 12.75 points.
With this convincing score, VCS secured the championship title ahead of many international opponents, who were considered strong contenders for the tournament's championship such as Sea Security (Singapore), Vupen, Synacktiv (France) and Devcore (Taiwan - last year's champion)...
Sharing about the challenges during the preparation for the competition, VCS team member Ha Anh Hoang said: "Three months before the competition, the organizers only announced the equipment that had to be mastered. Therefore, we only had three months to prepare because that's when the team was able to purchase the equipment to study. Many pieces of equipment had to be imported from abroad and took months to arrive in Vietnam."
According to another team member, Nguyen Xuan Hoang, "The competition has competitors who have been participating for a long time. They have a lot of experience, and there are also very strong competitors both economically and professionally. Team VCS is determined to enter the competition with the most thorough preparation, unity, and a suitable strategy to achieve the highest possible success in this year's competition."
Hoang further shared that last year, the VCS team won second place in this competition with a score very close to the champion, losing by only 2.5 points. Therefore, the team is determined to aim for the championship this year.
But the path to the championship is not simple: The attack targets in this competition are all popular devices and software worldwide, from leading manufacturers such as Microsoft, Apple, Google, Samsung… - Nguyen Xuan Hoang shared.
To meet the competition requirements, the device had to be ordered from the US, but a moment of carelessness caused it to malfunction because it used a 110V power supply suitable for the US market, while Vietnam uses 220V electricity.
According to Ngo Anh Huy, a member who has participated in this competition four times, the team's biggest fear is duplicate vulnerabilities or that the manufacturer will quickly patch the security flaws that the team has registered. Last year, the Viettel team only won second place because they were penalized for having a duplicate vulnerability.
Furthermore, challenges arose at the last minute, as visa procedures were delayed, preventing the entire team from traveling to Toronto (Canada) in time for the in-person competition. Instead, the 14 members of the VCS team had to compete online, constantly worrying about potential problems that might not be resolved in time during the match…
But the final result speaks for itself… Not only did the VCS team win the championship, but they also achieved a spectacular victory.
"When we won in the final top 10 category, the whole team erupted in joy and happiness because we had proven that this championship was a convincing victory, leaving no room for doubt," Nguyen Xuan Hoang proudly recalled that moment.
After participating in Pwn2Own for four consecutive years, the VCS team finally lifted the Pwn2Own championship trophy for the first time. This is a software and consumer electronics hacking competition held twice a year by the cybersecurity organization Zero Day Initiative, and is considered one of the most challenging cybersecurity competitions in the world today.
Mr. Nguyen Son Hai, director of VCS, said that in 2020, Viettel achieved its first victory in this "competition" in the Smart TV category. In 2021, Viettel made it to the Top 5. In 2022, it secured second place. And this year, it rose to claim the championship title with an overwhelming score.
Competition at Pwn2Own involves not only renowned cybersecurity teams worldwide but also major global manufacturers and technology corporations. Each competition will present challenges related to popular software or hardware devices such as the Windows operating system, Apple, Xiaomi, and Samsung phones, or Canon and HP printers, etc.
Teams must compete to find previously unknown security vulnerabilities in software and devices and then demonstrate how to exploit those vulnerabilities live within 30 minutes.
"Why can we say that the competitors are not only other security expert groups, but also device manufacturers like Apple, Xiaomi, Canon, TP-Link… because they hate being accused of having vulnerabilities in their devices, which would erode customer trust. These device suppliers always have a security team and are willing to spend large sums of money to patch bugs in their products before the competition takes place so that their products are not disgraced in the eyes of the public," shared Nguyen Hong Quang, a member of the VCS team, with Tuoi Tre newspaper .
Therefore, the competition will be intense from the moment the questions are released until the very last minute. It's entirely possible that teams might discover flaws, but the developers will unexpectedly patch them right before the competition day, causing one team to lose all their hard work and achievements.
Therefore, "as the performance time approached, we had to split into day and night shifts to 'monitor' whether the vulnerabilities we discovered still existed, and closely follow the producers to see if they patched the bugs we had found," said Ngo Anh Huy, a seasoned Pwn2Own player from the VCS team.
The 2023 Pwn2Own Toronto competition focuses on hardware, including categories such as mobile phones, smart speakers, surveillance systems, networked storage systems, and office electronics. Each category offers prizes ranging from $30,000 to $100,000 and scores from 2 to 10 points depending on the difficulty of hacking the device and the level of completion of the hacking demonstration.
The most valuable prize, both in terms of reward and points, is the final category, a mash-up, which requires teams to execute exploit code on one of the network routers provided in the competition and thereby attack a device in the aforementioned categories, with a prize of $100,000 and 10 points.
After completing the individual tasks and successfully attacking Xiaomi 13 Pro phones, QNAP TS 464 storage systems, Canon imageClass MF753Cdw printers, and Sonos Era 100 speakers, the VCS team achieved 20 points, almost securing the championship as their opponent, Sea Security, only reached 17.25 points after completing both the individual and combined tasks.
While the intense competitive pressure has subsided, the final category continues to haunt the VCS engineers because a lack of points in the mash-up challenge was the reason they missed out on the championship last year. "This time, entering the smash-up category, we were at a disadvantage again when we were drawn to compete later. If we made the same mistake as the previous team, we would lose points," Ngo Anh Huy shared. This overlapping mistake resulted in VCS being 2.5 points behind the winning team in last year's Pwn2Own tournament.
"This year, we not only sought to exploit new vulnerabilities, but also deliberately chose vulnerabilities that were very difficult to find and unlikely to be duplicated by other teams, or that might be easy to find but difficult to exploit, and also had many backup options. This is the result of three months of focused research by the entire team," Huy said.
As a result, the VCS team achieved a perfect 10/10 score in the combined category and won the overall championship with a total of 30 points, far surpassing the runner-up by 12.5 points, securing a spectacular and complete victory.
"We chose Pwn2Own to test our skills because it's a competition on the most popular devices in the world, from leading manufacturers with rigorous testing procedures," said Mr. Nguyen Son Hai, director of VCS. "Investing in a specialized research team and testing our skills on the international stage is part of VCS's efforts to develop human resources."
The VCS team's journey to the Pwn2Own 2023 championship is the culmination of a long, culminating endeavor, a vivid testament to the long-held vision of Viettel Group's leadership in the field of information security.
More than a decade ago, when VCS Director Nguyen Son Hai was the same age as the members of the Pwn2Own 2023 championship team are now, the Viettel Group leadership was determined to invest in the field of information security.
The first seeds for a nascent field were sown early on by Viettel, and they received systematic and strategic investment and care.
VCS's in-depth research journey began in its early years, with just six people initially working on information security. Since 2011, the VCS team has conducted simulated attacks with units within the Viettel Group to identify security vulnerabilities.
"Because we operate critical infrastructure, Viettel's vision is to research cybersecurity as a cornerstone," said Mr. Son Hai. "In cybersecurity, people are the most important factor. Even when using the world's best products, if used only as an end user, the risk of attack remains very high, while critical infrastructure such as Viettel's mobile and internet services are targets of attacks from the largest groups in the world."
To build a team of experts to protect critical infrastructure, VCS aims to train cybersecurity personnel with capabilities equivalent to world standards. From 2015 to the present, Viettel and VCS have trained 450 students, of which 5% of the most suitable candidates have been recruited to continue working, Mr. Hai said.
"After building a team of experts and investing systematically in in-depth research, we continue to seek ways to invest in enhancing the offensive skills of the VCS expert team. Participating in world-class competitions is also aimed at this goal," said Mr. Nguyen Son Hai.
In 2013, VCS began researching zero-day vulnerabilities – unknown and unpatched vulnerabilities, and therefore the most expensive to exploit. Anh Huy and Hong Quang were among the first specialists to do so. By 2015, the VCS team had found its first vulnerabilities, and to date, the number of vulnerabilities discovered by VCS has reached 400.
"No Vietnamese company has reached such a figure, and there aren't many in the world either," Mr. Hai stated.
The opportunity for training through in-depth research participation is the reason why VCS is an attractive workplace for cybersecurity experts who just won first prize at Pwn2Own. When asked why he chose Viettel, Anh Huy said: "From my experience, not many companies are willing to invest long-term in cybersecurity research and research teams."
"Especially in the field of cybersecurity, the human element is the most important factor. Therefore, VCS is always conscious of training and upgrading its team and building successive generations of highly qualified staff, always ready to tackle international-level challenges," emphasized VCS Director Nguyen Son Hai.
At the awards ceremony, congratulating the team members on their participation in the competition, Chairman and CEO of Viettel Group, Tao Duc Thang, expressed his pride in Viettel's "white-hat hackers." He affirmed: "Viettel is proud that the VCS team won a prestigious award in the field of global cybersecurity, 'competing' with leading global equipment manufacturers with large R&D units."
The head of Viettel Group assessed that "Pwn2Own is a prestigious competition with a very high level of difficulty for any hacker. The competition is likened to a 'battle' against manufacturers with top-tier information security teams in the world, ready to retaliate against hackers until the very last minute. It's a game with no age limit, and can even involve multinational collaborations…". Therefore, Mr. Tao Duc Thang stated: "Winning the Pwn2Own 2023 championship has brought glory to Viettel and Vietnam on the international stage," the group's chairman proudly said.
Chairman Cao Duc Thang also acknowledged that the field of cybersecurity is vast, a long journey for Viettel's experts, and that there are many challenges ahead.
"Maintaining the top position is not easy, so we need to keep striving and have big dreams, constantly striving to turn those dreams into reality to bring Vietnam to the world," Mr. Tao Duc Thang emphasized.
The Chairman of Viettel Group also shared that in the future, the Group will have specific policies to train high-quality human resources, so that they can continue to dedicate themselves to their work with peace of mind.
Assigning tasks to VCS, Mr. Tao Duc Thang emphasized that VCS needs to continue training more security experts, focusing on training the next generation with the best foundation to serve not only the corporation but also the country, protecting the nation in cyberspace.
Comment (0)