AI
Choosing Targets and Recon
Daan Keuper explained how his team selects Pwn2Own targets. They check prior research, expected competition, hackability, firmware accessibility, and shipping logistics. For the IoT edition they skipped Synology because it had been targeted for years. They passed on Ubiquiti and Google Nest as better secured. They ordered a MikroTik and a QNAP. The TrueNAS was chosen because its software, TrueNAS CORE, is open source and runs in a VM. A colleague found a vulnerability within 10 minutes of downloading it.
The TrueNAS: A 10-Minute Path Traversal
The team noticed an outgoing HTTP request to a FreeBSD package site. The user agent was Python requests, not standard FreeBSD. This led to IOCage, a Python jail management project. The code used extractall() on a tar archive without sanitizing path traversal. This allowed overwriting arbitrary files as root. They replaced the web interface’s user database with known credentials, logged in, and used the built-in shell button for code execution. The entire attack required man-in-the-middle capabilities, which the SOHO category provides by first hacking the router.
QNAP Router: Encrypted Firmware and Debug Port
The QNAP firmware was encrypted but the password was “QHora”. A Python script decrypted it. The device had a labeled UART debug port giving a shell with web credentials. The team set up a debug environment and listed outgoing connections and listening services. Cloud agent used TLS that validated certificates. A UDP service called Q1WMD accepted JSON but only returned debug info. Another benchmarking service on a tunnel interface ignored input. No promising attack surface appeared.
Outgoing Connections and the Localhost DNS Trick
They spotted a DNS query for the AAAA record of localhost. Responding with their own IPv6 address triggered two incoming connections: HTTP and gRPC. The HTTP handler expected a JSON list of connected devices. A string copy in the handler had no length check, allowing a heap overflow. But the MAC address field was validated and heap shaping to overwrite it proved unreliable. QNAP pushed several firmware patches before the competition, altering heap state.
Heap Shaping Failure and the gRPC Shortcut
The heap shaping attempt required a free block before allocation and more zero bytes than string copies could write. It was too fragile. They switched to the gRPC service, which expected a siteinfo JSON. By reverse engineering a compiled Python script, they found that including shell commands in the “address6” field triggered command execution. This gave code execution on the router. The team then pivoted to the TrueNAS over the LAN.
Competition Day: Seventh Draw and a Working Chain
The TrueNAS was out of stock everywhere, so the team never tested the exploit on real hardware. They flew to Ireland hoping it would work. At the competition their team was drawn seventh and last for the QNAP. Despite other teams’ successes, all of their vulnerabilities were still unknown. The demo ran in under 10 minutes: spoof DNS, trigger gRPC, inject a command, pivot to the NAS, overwrite the user database, log in, get a shell.
Notable Quotes
within 10 minutes he found a vulnerability Daan Keuper · ▶ Watch (7:34)
I’ve no idea why you go through the trouble of encrypting the firmware if your password is so simple Daan Keuper · ▶ Watch (16:06)
it will happily run that in a shell for you Daan Keuper · ▶ Watch (42:34)
the first time we actually saw the device was during the competition and it was way larger than we anticipated Daan Keuper · ▶ Watch (43:45)
Key Takeaways
- Use DNS spoofing to redirect internal requests and expose hidden attack surface.
- Heap shaping is fragile; switching to a simpler attack path saved the exploit chain.
- Open-source firmware enables rapid vulnerability discovery without owning the hardware.
About the Speaker(s)
Daan Keuper is the head of security research at Defion Security. This division is responsible for advanced security research on commonly used systems and environments. Daan participated four times in the internationally known Pwn2Own competition by demonstrating zero-day attacks against the iPhone, Zoom and multiple ICS applications. In addition Daan did research on internet connected cars, in which several vulnerabilities were found in cars from the Volkswagen Group.