2022 Pwnie Award Nominees
Best Cryptographic Attack
Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86
Best Desktop Bug
Architecturally Leaking Data from the Microarchitecture
Oh Snap! More Lemmings (Local Privilege Escalation in snap-confine)
Best Mobile Bug
1 byte out-of-bounds write in the Google Titan M chip
Best Privilege Escalation Bug
Mystique in the House: The Droid Vulnerability Chain That Owns All Your Userspace
Unprotecting Samsungs TrustZone implementation by smashing the TZASC configuration
Best Remote Code Execution Bug
Microsoft Exchange Server Remote Code Execution Vulnerability
Windows RPC Runtime Remote Code Execution (CVE-2022-26809)
Best Song
Side channels are everywhere – The theme song of the side channel security sitcom
Epic Achievement
Yuki Chen’s Windows Server-Side RCE Bugs
pwnkit: Local Privilege Escalation in polkit’s pkexec (CVE-2021-4034)
Lamest Vendor Response
Critical vulnerabilities in HCL DX (Previously known as IBM WebSphere Portal)
Google’s top security teams unilaterally shut down a counterterrorism operation
Most Epic Fail
HackerOne Employee Caught Stealing Vulnerability Reports for Personal Gains
HiKam – “Hi – I’m (not) your Kam”
Most Innovative Research
Custom Processing Unit: Tracing and Patching Intel Atom Microcode
V-Shuttle: Scalable and Semantics-Aware Hypervisor Virtual Device Fuzzing
Most Under-Hyped Research
Intel BIOS Shared SW Architecture (BSSA) Design for Test (DFT) escalation of privilege