A journey to pwn and own the Sonos One Speaker

Twice a year, ZDI organizes a computer hacking contest called Pwn2Own. It challenges security experts to exploit widely used hardware and software.

In November 2021, the contest was held in Austin and online. Synacktiv team succeeded its attacks on many devices, and won the competition.

This presentation describes the steps to gain code execution on one of the targeted device: the Sonos One Gen 2 smart speaker.