Pwn2Own Tokyo 2019 hacking contest: Amazon Echo speakers, Samsung and Sony smart TVs, Xiaomi Mi9, others hacked; Facebook Portal and Google Nest not attempted
Amazon Echo, Samsung and Sony smart TVs fall on first day of Pwn2Own Tokyo 2019 hacking contest. Tweets: @campuscodi Tweets: Catalin Cimpanu / @campuscodi : Facebook Portal survives Pwn2Own hacking contest > No researcher tried to hack the Portal in Tokyo yesterday > They won't attempt today > Didn't wanna touch Google Home either > Amazone Echo got pwned, though https://www.zdnet.com/... https://twitter.com/...
Context & Ripple Effects
Pwn2Own's Tokyo edition is repeating its playbook from a year earlier, when hackers breached the iPhone X, Galaxy S9, and Xiaomi Mi6 for $325K in the 2018 Tokyo contest — this time the targets shift from flagship phones to always-on living-room hardware: Echo speakers, Samsung and Sony smart TVs, and Xiaomi's Mi9. The notable non-event is what researchers avoided: nobody touched the Facebook Portal or Google Nest/Home devices across the two days.
The avoidance matters because Pwn2Own payouts only flow where researchers aim, so unattempted devices escape both the bounty and the public disclosure that forces vendor patches. The contest itself keeps widening its aperture — two months later it moved into industrial control software at Pwn2Own Miami 2020, and by Toronto 2023 it was paying out over $1M for 58 consumer-product exploits.
First-order effects
- Amazon, Samsung, Sony, and Xiaomi each take a responsible-disclosure hit on day one: their zero-days are now documented, bountied, and headed for vendor patches rather than underground sale.
- Xiaomi becomes a repeat target — its Mi9 falls in Tokyo a year after the Mi6 fell at the same event, marking the brand as a consistent researcher draw.
Second-order effects
- Smart-speaker and smart-TV makers now compete on demonstrated exploit resistance, since a Pwn2Own fall is a public benchmark that untested rivals can't claim.
- Facebook Portal and Google Nest get an unearned security halo from going unattempted — but with no bounty pressure, their flaws stay undiscovered rather than fixed, a gap only future contests can close.
Third-order effects
- If the pattern holds, Pwn2Own evolves from a phone-and-browser contest into the de facto certification regime for consumer IoT, with vendors effectively outsourcing security validation to bounty-funded researchers — a structure already visible in its expansion to industrial control systems and its seven-figure consumer payouts by 2023.
- China's ban on foreign contests, which pushed top researchers to domestic events like the Tianfu Cup (where Chrome, Edge, and Safari were hacked weeks later), splits the disclosure ecosystem geographically and leaves devices popular in one region audited mainly under the other's rules.
The trend: Pwn2Own is expanding from smartphones into the entire consumer-device surface — speakers, TVs, cameras, and beyond — turning paid hacking contests into the industry's main mechanism for finding and fixing IoT zero-days.