Xiaomi the Money: Our Toronto Pwn2Own Exploit & BTS Story
Recounts NCC Group's Pwn2Own Toronto exploit chain compromising the Xiaomi 13 Pro via malicious hyperlinks and app store vulnerabilities.
Summary
Pwn2Own Toronto Mobile Target
At the Pwn2Own Toronto competition, security researchers from NCC Group targeted the Xiaomi 13 Pro flagship smartphone to demonstrate full remote device compromise.
Chaining Web Hyperlinks and App Store Flaws
The successful exploit chain leveraged a malicious HTML hyperlink to trigger internal browser handlers and interact with the pre-installed Xiaomi app store to stage unauthorized application installation.
Regional Execution Variations and Field Testing
Vulnerability research revealed that specific app store logic only executed within certain geographic regions, requiring researchers to travel internationally to validate exploit reliability before competition day.
Defensive Hardening by Manufacturers
Evaluating vendor-specific mitigation barriers highlights the extensive engineering efforts modern device manufacturers deploy to prevent remote exploitation in competitive environments.
Related talks
Black Hat·40 min
Engineers explore architecture and security mechanisms for Rooting EVERY Android: From Extension to Exploitation.
Black Hat·17 min
Engineers explore architecture and security mechanisms for Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android.
Black Hat·56 min
Engineers explore architecture and security mechanisms for EU 2013 - Off Grid communications with Android - Meshing the mobile world.