The over-priced Apple iPhone X, the pricey Samsung Galaxy S9 and the flagship Xiaomi Mi 6 smartphones were all been hacked on the first day of the Pwn2Own Tokyo 2018 contest taking place these days alongside the PacSec security conference in Tokyo, Japan.

First, a team made up of Amat Cama and Richard Zhu, calling themselves “fluoroacetate”, hacked the Xiaomi Mi 6 using an NFC exploit.

According to the Zero Day Initiative (ZDI), the organiser of Pwn2Own, they used an out-of-bounds write bug affecting web assembly to achieve code execution via NFC. The researchers earned $30,000 for this hack.

Pwn2Own TokyoA team from UK-based MWR Labs also earned $30,000 for hacking the Xiaomi Mi 6. It took them two goes, but they did manage to successfully demonstrate a code execution exploit via Wi-Fi that resulted in a photo getting exfiltrated from the targeted phone.

ZDI says the exploit involved five different logic bugs, including one that allowed the silent installation of an app via JavaScript.

It took the MWR Labs team two tries to demonstrate an exploit on the Samsung Galaxy S9. The white hats hacked a captive portal with no user interaction and used unsafe redirect and unsafe application loading bugs to execute code on the phone, which earned them another $30,000.

The Fluoroacetate team also demonstrated a code execution exploit against a Samsung Galaxy S9. The exploit involved a heap overflow in the device’s baseband component, and it earned the researchers $50,000.

The same team hacked an iPhone X over Wi-Fi using a Just-In-Time (JIT) bug, and an out-of-bounds write flaw. This attempt earned them $60,000.

Finally, researcher Michael Contreras received $25,000 for hacking the Xiaomi Mi 6 browser. He used a JavaScript type confusion flaw to achieve code execution.

Pwn2Own Tokyo 2018 participants earned a total of $225,000 on the first day of the event.

On the second day, Fluoroacetate and MWR Labs will make several attempts to hack the iPhone X and the Xiaomi Mi 6.