The winners of the annual Pwnie Awards 2021 have been announced. This is a prominent event where participants reveal the most significant vulnerabilities and absurd flaws in the field of computer security.
The Pwnie Awards recognize both excellence and incompetence in the field of information security. Winners are selected by a committee of security industry professionals from nominations collected from the information security community.
Winners list
Best Privilege Escalation Vulnerability : This award was given to Qualys for identifying the CVE-2021-3156 vulnerability in the `sudo` utility , which allows users to gain root privileges. The vulnerability had been present in the code for about 10 years and is notable because its detection required a thorough analysis of the utility's logic.
Best Server Vulnerability: This award was given for identifying and exploiting the most technically complex and interesting vulnerability in a network service. The win was awarded for identifying a new attack vector against Microsoft Exchange . Information on all vulnerabilities of this type has not been published, but information has already been disclosed about CVE-2021-26855 (ProxyLogon), which allows you to retrieve data from an arbitrary user without authentication, and CVE-2021-27065, which allows you to execute your code on a server with administrator privileges.
Best Cryptographic Attack: Awarded for identifying the most significant flaws in real-world encryption systems, protocols, and algorithms. The award was given to Microsoft for the vulnerability (CVE-2020-0601) in the implementation of elliptic curve digital signatures that allows the generation of private keys based on public keys. This flaw enabled the creation of forged TLS certificates for HTTPS and fake digital signatures, which Windows verified as trustworthy.
Most innovative research: The award was given to the researchers who proposed the BlindSide method for circumventing Address Randomization Safety (ASLR) using side-channel leaks resulting from the processor's speculative instruction execution.
The Epic FAIL award was given to Microsoft for a multiple-release patch that failed to fix the PrintNightmare vulnerability (CVE-2021-34527) in the Windows print output system, which allowed code execution. Microsoft initially flagged the issue as local, but it later emerged that the attack could be carried out remotely. Microsoft then released updates four times, but each time the fix only addressed a specific instance, and researchers discovered a new way to perform the attack.
Best bug in client software : This award was given to a researcher who discovered the CVE-2020-28341 vulnerability in Samsung's secure cryptography and received the CC EAL 5+ security certification. The vulnerability made it possible to completely bypass the protection and gain access to the code running on the chip and the data stored in the enclave, bypass the screen saver lock, and also make changes to the firmware to create a hidden backdoor.
The most underestimated vulnerability : The award was given to Qualys for identifying a number of 21Nails vulnerabilities in the Exim mail server, 10 of which can be exploited remotely. Exim developers were skeptical about exploiting the issues and spent more than six months developing fixes.
The weakest manufacturer response: This is a nomination for the most inadequate response to a vulnerability report in their own product . The winner was Cellebrite, a forensic and data mining application for law enforcement. Cellebrite failed to adequately respond to the vulnerability report published by Moxie Marlinspike, the author of the Signal protocol. Moxie became interested in Cellebrite after publishing a media report about the creation of technology to break encrypted Signal messages, which later turned out to be false, due to a misinterpretation of the information in the article on Cellebrite's website, which was subsequently removed (the "attack" required physical access to the phone and the ability to unlock the screen; that is, it boiled down to viewing messages in the messenger, but not manually, rather using a special application that simulates user actions).
Moxie examined Cellebrite applications and found critical vulnerabilities that allowed arbitrary code to be executed when attempting to scan specially crafted data. The Cellebrite app also revealed using an outdated ffmpeg library that has not been updated for 9 years and contains a large number of unpatched vulnerabilities. Rather than acknowledge the issues and fix them, Cellebrite issued a statement that it cares about the integrity of user data, keeps the security of its products at the proper level.
Finally, the greatest achievement: it was awarded to Ilfak Gilfanov, author of the IDA disassembler and Hex-Rays decompiler , for his contribution to the development of tools for security researchers and his ability to keep the product updated for 30 years.
Source: https://pwnies.com