iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The 2022 Pwnie Awards recognized notable security research and used other categories to satirize security failures and vendor responses. Among the selected winners: Hertzbleed took Best Cryptographic Attack, Yuki Chen received Epic Achievement recognition, and Google’s Threat Analysis Group (TAG) won Lamest Vendor Response. The ceremony took place in the Black Hat USA setting and marked the Pwnies’ 15th year.
What the Pwnie Awards recognize
The Pwnies are not an objective ranking of all security work from a given year. Their categories bring together technical accomplishments and pointed criticism, giving the ceremony a tone that Dark Reading’s Karen Spiegelman described in a September 16, 2022 recap as a mix of antic humor, snark, and serious critique. The awards have celebrated “the good, the bad, and the wacky in cybersecurity” since 2007, according to Spiegelman.
That contrast is visible in the category names: Best Cryptographic Attack and Most Innovative Research recognize technical work, while Lamest Vendor Response and Most Epic Fail call out responses or incidents the awards characterize as deserving criticism.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSelected winners from 2022
The following is a selection of notable results, not a complete list of every category or nominee. The reproduced category results come from the Pwnie Awards entry in Wikipedia, a tertiary source; heise online’s contemporaneous August 11, 2022 coverage also reports Google TAG’s Lamest Vendor Response award.
#1 Best Overall
| Category | Recipient or work | What the listing says |
|---|---|---|
| Lamest Vendor Response | Google’s Threat Analysis Group | The listing’s rationale was “unilaterally shutting down a counterterrorism operation.” This is the award listing’s characterization, not an independently established finding about the operation. |
| Epic Achievement | Yuki Chen | Windows server-side remote code execution (RCE) bugs. |
| Most Epic Fail | A HackerOne employee | The reported incident involved an employee caught stealing vulnerability reports for personal gain; it should not be taken as a claim about HackerOne’s overall security. |
| Best Desktop Bug | Pietro Borrello, Andreas Kogler, Martin Schwarzl, Moritz Lipp, Daniel Gruss, and Michael Schwarz | “Architecturally Leaking Data from the Microarchitecture.” |
| Most Innovative Research | Pietro Borrello, Martin Schwarzl, Moritz Lipp, Daniel Gruss, and Michael Schwarz | “Custom Processing Unit: Tracing and Patching Intel Atom Microcode.” |
| Best Cryptographic Attack | Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham, Christopher Fletcher, and David Kohlbrenner | “Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86.” |
| Best Remote Code Execution Bug | KunlunLab | Windows RPC Runtime Remote Code Execution. |
| Best Privilege Escalation Bug | Qidan He of Dawnslab | “Mystique in the House: The Droid Vulnerability Chain That Owns All Your Userspace.” |
Why Hertzbleed stood out
Hertzbleed won Best Cryptographic Attack for work whose title describes turning power side-channel attacks into remote timing attacks on x86. The category recognizes the attack research; its title alone should not be treated as a claim about practical exploitability against every x86 system or cryptographic implementation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Hosts and ceremony details
Dark Reading identifies Sophia d’Antoine and Ian Roos as the main hosts, respectively founder and researcher at Margin Research. Ang Cui, founder and CEO of Red Balloon Security, made the statuettes. Supriya Mazumdar was also among the hosts and joked about a Tesla RCE bug.
Dark Reading’s accessible recap is a 12-slide slideshow, but its introduction does not expose all of the slide text. The details above therefore stick to what that account and the cited winner listing report.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
