Mac OS X Security Competition Ends in 30 Minutes

ninja_assault_kitten writes "ZDnet is running an article on how a Swedish Mac OS X enthusiast held a competition to prove how good security was on his new fully patched Mac Mini was. Unfortunately, 30 minutes after the competition began, a hacker known as 'gwerdna' had broken in and defaced the website, thus winning the contest. According to gwerdna, 'Mac OS X is easy pickings for bug finders. That said, it doesn't have the market share to really interest most serious bug finders.'." It's also worth noting a piece that says all the security news is much ado about nothing, in practical terms. The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack.

Why keep SSH on?

That's one of the first things you turn off to protect the machine.

Re:Why keep SSH on?

Or at least restrict by host at the firewall. On OS X, remember to turn on ipfw's statefulness. [unimelb.edu.au]

Re:Why keep SSH on?

It's a Mac. You don't _keep_ SSH on. It's disabled by default. You have to turn it on deliberately.

Re:Perhaps with a desktop Mac

I believe that Mac OS X Server has sshd running by default -- if you think of how it's intended to be used, this is not just a feature, but possibly quite necessary. Setting up a rack of headless servers could be quite a PITA if they didn't have ssh running by default -- you'd have to connect to them over the serial port and turn it on for each machine (or create a custom HD image where it was enabled and load it to each machine).

I think there are probably some also remote-administration services running by default on Server, but don't quote me on that. I know for sure that ssh is not running on regular, consumer MacOS, however. (I just set up a new G5 a few days ago and I had to turn it on manually.)

I think it's also worth pointing out that based on my understanding of the article in question here (the second link in the summary doesn't point to what I think it originally did), ssh wasn't just running on the machine, attackers were allowed to log-in as a non-root user. So really what happened wasn't a cracking in the strict sense, but privilege escalation. Still bad -- and I'm rather annoyed that "gwerdna" or whatever his name was didn't tell us what this great "unpublished and unreported vulnerability" was that he used, but I don't think that it means that any box is compromisable simply by virtue of running sshd.

Re:Perhaps with a desktop Mac

Not saying there's anything wrong with this, Solaris, FreeBSD, et al are the same, but while SSH may need enabling on a Mac desktop, it does not appear to on a Mac server.

Of course SSH is on by default on a Mac Server--it is designed to run, and be configured from first boot, headless. That would be pretty difficult to do if you had no services. Other default services are Apple Remote Desktop, for GUI control, and the Server Admin Suite; even the Apple Server Admin Tools can be port forwarded through SSH if you prefer.

The assumption is that servers will be managed by those with a clue, whereas desktops will not usually be. Also, no Mac desktops are expected to be configured and maintained headless from first boot, whereas you have to specify a video card for an Xserver for it to be graphical at all. I don't think those are unreasonable assumptions to make.

Re:Why keep SSH on?

in fact with OS X you have to turn it on... it's a Sharing preference called Remote Login... hello, yes I'd like people to remotely login to my machine.. I'll just start this right up. OTH there should be a little more help info on what SSH is for those who think being able to remotely login is a good idea even though they really don't know how to do it.

Re:Why keep SSH on?

Or in this case, the ability of the system administrator to open up the box...

SSH is off by default, the admin had to turn it on.

Hackers don't generally have shell accounts -the admin had to set them up.

So if you take steps to make the Mac Mini less secure, then advertise you've done so, it gets hacked. Expect all major tech outlets to cover this new and amazing Mac vulnerability (you think I'm joking?).

Re:Why keep SSH on?

It doesn't really matter that SSH was left on. The thing that made this easy was that they were allowed a shell account. Getting shell access is the easiest way to compromise a system. Lets see how long it would take with out a shell.

Re:Why keep SSH on?

The problem wasn't even that he had SSH running. It was that he was giving out accounts [nyud.net]! I don't know what this guy was trying to prove, but his blind faith in Apple got him burned.

Somewhere inside of Apple, engineers are shaking their heads at this guy and the damage he's done to the Mac's reputation.

Re:Why keep SSH on?

true, though a timeshare box on a college campus is somewhere you would easily see such a setup. remember though, this is (supposed to be) a *nix we're talking about. local user accounts should not be able to inflict such damage due to better seperation of priviliedges that exist in this world.

Re:Why keep SSH on?

remember though, this is (supposed to be) a *nix we're talking about. local user accounts should not be able to inflict such damage due to better seperation of priviliedges that exist in this world.

But you need to remember that OS X is not designed for remote, multi-user usage. The features are there, but mostly for adminstrative purposes. The machine is first and foremost a Desktop machine that is intended to keep good guys in and bad guys out.

Also keep in mind that it is incredibly difficult to properly configure a Unix system to be completely secure against users with shell accounts. Such security requires a complete system lockdown, complex partitioning, reassignment of services to non-root accounts, jailing of priviledged services (or equivalent), and several other procedures that I sincerely doubt that this guy performed. (In fact, the article confirmed that he could have locked the system down further, but didn't.)

By handing out shell accounts, he might as well have been handing out the root password to his system.

Re:Why keep SSH on?

But you need to remember that OS X is not designed for remote, multi-user usage

That excuse was bullshit when it was used to defend Windows boxes, and, amazingly, it remains bullshit when applied to fashionable platforms, too.

Re:Why keep SSH on?

Um, you are talking about OSX vs OSX Server. Which *Does* ship with these services enabled by default.

Which was also not what was compromised. Kind of nice for the GP to switch topics like that. :-/

I want to know more details about this incident.

The machine was a Mac Mini "running a default install of OS X Tiger, plus fink and some decent versions of Apache, MySQL and PHP. Software Update recently updated it to Mac OS X 10.4.5 and fixed some security issues." It's colored orange for some odd reason, and sits on a bookshelf sideways. He, "set up an LDAP server and linked it to the Macs naming and authentication services, to let people add their own account to this machine."

This is all available on his webpage [nyud.net].

Basically, the guy is a moron. He thinks he's proving something by making a Desktop configured machine do server-class work, and then expect it not to get rooted.

Was it a local privelage escalation flaw?

Yes. The exact hole has been withheld, but it probably doesn't matter anyway. In a contest of machine vs. hacker where the owner is doing nothing to stop the hacker (and in fact, inviting him by removing barriers!), my money is on the hacker.

Was it a remote flaw in SSH or Apache? Maybe an SSH password attack?

The guy gives out [nyud.net] SSH accounts. There was no need to penetrate this layer of security, because he left the door wide open.

Re:Why keep SSH on?

The guy gives out SSH accounts. There was no need to penetrate this layer of security, because he left the door wide open.

So, to use the most disgusting analogy possible, it was like raping the goatse guy.

Heh heh, I said analogy.

RDF defeats all

I have a feeling that the Reality Distortion Field has already cancelled whatever negative effect this has had

Re:Why keep SSH on?

Are you telling me that they're no better than Windows when it comes to privilege separation and preventing a low-privilege user account from taking control over the system?

Yes and no. If your admin locks the machines down tight, then it's quite possible that the Mac servers are more secure than the Windows servers. Left with default settings, they're both highly vulnerable to anyone who already has access to the machine and is determined to find a hole. (Whether it be a buffer overflow in a priviledged service, or a soft link that gave elevated permissions.)

Systems are extremely hard to secure once untrustworthy individuals have access to them. That's why there's a market for products like Trusted Solaris and Trusted Linux. If you need high security against local users, you can't trust anyone. Not even root.

Re:Why keep SSH on?

I don't know what this guy was trying to prove, but his blind faith in Apple got him burned.

Considering that the picture of the machine posted on the web site (which now seems to be unavailable) showed it sitting on a shelf next to Windows programming books, I'm guessing that his "blind faith" is in something other than Apple, and his motiviation was to generate the misleading buzz that ZDNet and Cnet are facilitating.

Re:Why keep SSH on?

without ssh, how exactly would you propose enabling access to it?

Restrict the ip addresses of the computers that can access the ssh connection. Ah, you'll say, then all the attacker has to do is get access to the computer that is on the allowed ip address list. True, but let's say you are a company with the web server www.verigon.com. That's a nice public target running apache, mysql, php, etc. All the things a good lamp server should run. That's going to be the public target.

If I want to ssh in, I first have to connect to a different box. The thing here is that this ssh box (I'll just call it that to save typing) doesn't have to run anything but the os and ssh, thus lowering the number of software packages that can open a vulnerability. Remember, every daemon you run, every piece of software you install, every service that's enabled is another potential whole. The second part to this is that the ssh box is not a big target. It's dns name may be something like comp-1.it.verigon.com or ideally its name isn't even registered in dns. Either way, the bullseye is going to be on www.verigon.com for the casual cracker. Only someone who is specifically interested in my company is going to try to find a way in. The script kiddies will just see that ssh doesn't respond and go on to the next webserver.

Re:Why keep SSH on?

True, a Mac Mini isn't typically going to be used as a server, but if Apple decides to make some kind of Intel based server, this kind of thing is a HUGE problem.

Not necessarily. The mac mini is a desktop and has a lot of software installed on it that would be deemed a security risk in production environment. Ever hear of using a complier to shell out? That is why compilers are usually left off of servers for security reasons. Your average linux/bsd desktop box with all the goodies installed probably would not have lasted much longer.

Re:Why keep SSH on?

The safest computer that you can get is one that is not connected to the wall. Then again, it will not be very usefull.

Turning off functionality because of security is not acceptable. It the OS offers certain features, they should be secure, otherwise, they are flawed. Stop apologizing for Apple computer and its defects.

Cheers,
Adolfo

gwerdna?

I wonder if the hacker's name is Andrew G. by any chance?

What kind of hacker do you suppose he is? gwerdna is a pretty poor anagram of Andrew G.

If that's not his name, it's fairly random.

He's been using it since the end of 2004 at least. http://p212.ezboard.com/bnendowingsmirai.showUserP ublicProfile?gid=gwerdna [ezboard.com]

Mac OS X Security Challenge

Mac OS X Security Challenge [wisc.edu]

In response to the woefully misleading ZDnet article, Mac OS X hacked under 30 minutes, I have decided to launch a Mac OS X Security Challenge.

The ZDnet article, and almost all of the coverage of it, failed to mention a very critical point: anyone who wished it was given a local account on the machine (which could be accessed via ssh). Yes, there are local privilege escalation vulnerabilities; likely some that are "unpublished". But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction.

Almost all consumer Mac OS X machines will:

- Not give any external entities access
- Not even have any ports open

The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu (128.104.16.150). The machine is a Mac Mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open. Email [e-mail] if you feel you have met the reqiurements.

Re:Mac OS X Security Challenge

So, test.doit.wisc.edu is some guy you're having a war against, and now you want him to have an.. umm... unfortunate accident with his computer, right? With our help, sneaky. ;-) Mabye by the slashdotting alone. Welcome to the wild web.

Re:Mac OS X Security Challenge

New here, huh?

Dave works and is a rather high profile Mac admin at UWisc.

He should post a signature and a key

Then he should put his gpg public key at
http://test.doit.wisc.edu/ [wisc.edu] and sign and publish on slashdot an invitation to hack this machine to prove that he's the owner of this machine.

k2r

Re:Mac OS X Security Challenge

Yes, there are local privilege escalation vulnerabilities; likely some that are "unpublished". But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction.

Whilst I agree that this is not the same as a remote exploit, do not underestimate the seriousness of local privilege escalation.

For instance, an unpatched local privilege escalation, used in conjuction with the vulnerability discussed in this article [slashdot.org] could result in a rooted machine - simply from visiting a hostile website (or even a website you visit regularly, that runs IIS and has been hacked itself)

I don't believe (as some pundits seem to) that Mac OS is a Microsoft style security disaster only awaiting the attention of hackers to happen - but I do believe that Mac owners are going to have to start paying a little more attention to security matters then they currently are.

Re:Mac OS X Security Challenge

On the other hand, it tells you what's possible if a user downloads a trojan and runs it. Despite the common argument that such hacks are, supposedly, impossible because "Only root is able to change critical files" and/or "Only admin users are able to do critical things and Apple does everything they can to encourage users not to set up their default accounts as "admin", explaining what an admin account is and the consequences of using it in their comprehensive, well written and easily readable user manual, shipped with every copy of OS X" (*snort*), it appears that, in actual fact, a trojan can escalate itself to root pretty easily.

I've always thought OS X was more hackable than its supporters tend to say. The very fact that, until recently (like, early 2005), you could set something like this up:

1. Set up page to "redirect" to a .sit or .zip if Safari is the browser.

2. Have trojan in .zip or .sit associate itself with many common types of file, especially uncommon variants of popular files (MPEGs, for instance, seem to randomly pick whether they're Quicktime, VLC, MPlayer, or just not associated with anything, files in OS X)

3. Wait (giggling with insane glee)

Apple fixed the bug exploited in (2) above sometime in early 2005 by having the OS warn you if it was running an application for the first time. For those who are scratching their heads though: Safari, by default, opens "safe" files. This means that step one would have caused the .zip or .sit to be downloaded and extracted on the user's desktop without any user intervention. Once an application is present on a hard drive, it's already installed. In OS X (as with previous versions of Mac OS), applications include associated metadata that tells the OS "I'm an application, and I open files of types JPEG, WDOC, and CARP." If the user hasn't already associated a specific application with a specific file (because, for instance, you just downloaded it from the Internet), then opening a new file will generally cause the OS to search for applications that can open that type, pick one, and open it.

Why am I talking about an old bug? Well, this was present in Mac OS for years, and nobody did anything about it, nobody even considered it a bug until relatively recently. Despite all the crap that's leveled against Microsoft on the same subject, some justified, much not, Apple's attitude towards security is not much better.

If you can get a user to open an application, then you have some access to their machine. If root privileges are gainable from a regular account, then you have root access to their machine.

And all this time I thought you'd have to do the social engineering step of, perhaps, waiting for an application that causes the "Type in an administrator username and password" dialog to come up (perhaps Installer.app, or.. perhaps... Software Update...) and throw a dialog over it that looks identical. It's easier than I thought.

Re:Mac OS X Security Challenge

What I'd be interested in is putting other operating systems on with the same rules as the submitter (fully patched system with free local accounts to any who ask) and see if Linux, Windows Server or any of the BSDs can stand up to the challenge.

Re:Mac OS X Security Challenge

Yes. And I explain that on the site.

But the original article makes it look like any Mac OS X machine out on the internet could just get "hacked", and was "easy pickings". Do you, or do you not, agree that the article should have made *some* reference, at least in passing, that people were allowed to have local accounts on the machine? I.e., a way that the vast, vast, vast majority of consumer Mac OS X machines will never be used (to say nothing that they'll probably never have any ports open, either)?

So there's a local privilege escalation vulnerability that, according to the "hacker", hasn't been reported to Apple. So if it's "unpublished", and therefore hasn't (likely) been reported to Apple, what is Apple to do about it?

The article is not fair because it doesn't tell a critical detail about the situation: that LOCAL ACCESS was allowed. If you don't think that's a *huge* omission in this context, I don't know what else to say. The majority of people who read that article will leave with the specific and distinct impression that a Mac OS X machine can be "hacked" just from being connected to the internet. That is patently untrue. I'm simply showing that.

Re: first thought...

"Let the flood of *I challenge you to hack me* ip posts begin...

You can start with this one: XX.XX.XXX.XXX.

(Man... I just didn't have the heart to post it. :( )

considering

how many local privilege elevation exploits exist, why am I not surprised. They should have mentioned it was NOT a remote exploit

Lord, save us from morons

What was this fool trying to prove? He allowed direct SSH access to the machine! Of course someone is going to hack it! Once you're inside the system, it becomes incredibly easy to find configuration mistakes, and exploit holes in priviledged programs. Remember, this system runs much of the same software as Linux and FreeBSD. Much of that software hasn't been properly audited and locked down. Why? Because this is a desktop machine.

Mac OS X security primarily stems from not doing anything stupid by default. Which means that there are no remote services enabled, the system tries to be intelligent about handling executable files (like most Unixes), and super-user functionality is handled by Sudo. But that's not a bullet-proof vest. There's nothing in the system that makes it automagically secure against all attacks. So if you want security, don't turn on those remote services, and don't give out SSH accounts!

Re:Lord, save us from morons

Like all systems, tradeoffs have to be made. I'm sitting next to a Sun Solaris system with JDS on it right now. To get the system running like I want it, I constantly have to resort to the root account to install the simplest of software. (Replace root access with sudo as you prefer.) I have to do this because it is a locked down machine intended to run software packages approved by management. Under this configuration, it's pretty hard to gain root access even with a local account.

This configuration absolutely sucks for a home user.

A home user can't install new software without providing a root (or sudo) password everytime they want to try a software package, they can't update the system configuration from the GUI, they can't start and stop their personal webserver, they can't look at the drive space remaining without having to decode a complex partitioning scheme, they can't do a lot of things that Mac OS X lets them do without interfereing. If Mac OS X *did* restrict these activities, users would balk at the user-unfriendliness and go back to Windows.

So it comes back to a matter of design. It's easy to say, "that should have been secure!", but the costs of making that secure would have been too high for the average home user. Mac OS X's security has been proven to date to be sufficient for what it was designed to do, and has been shown to be at least as secure (perhaps moreso) than your average FreeBSD or Linux desktop. Show me the beef of the problem (i.e. everyday machines being compromised on a scale similar to Windows) and I'll agree with you that Mac OS X is insecure for its intended purpose. Until then, however, I'm going to go with the fact that this guy wasn't thinking straight.

Plenty of people use them for servers as well

Which is why Apple produces OS X Sever Edition.

and apparently OS X isn't secure by default for them.

You show me a server situation that involves hundreds of anonymous, remote logins to a system without any lockdown of the services to move it from a home server to a full-blown webserver, and I'll agree with you. I, personally, can't think of such a situation. Some webhosts provide SSH access, but they certainly don't run a default Linux or FreeBSD installation unless that distribution has been preconfigured for the security they need.

Local access IS important!

Excuse me, but if your OS can be rooted in 30 minutes from a local account, you have no business calling it secure. UNIX is supposed to have multiple local accounts and still be secure with them all running. If you close down every network port on a machine and say "come get me now", that's really not saying much. I, for one, would really like to know how he managed to get root from a local account, so I can verify I don't have the same problem on my server, which really does have ssh access to more than one person.

Re:Lord, save us from morons

Funny. Sourceforge gives out SSH accounts to anyone and their dog.

Indeed. And every once in a while, Sourceforge gets hacked [sourceforge.net]. And they have a trained staff of admins who attempt to very carefully lock down the systems and separate the user logins from the systems that run web services and code repositories. (Which is why you can't blow away your own code tree. You have to ask SF to do it.)

The only thing that's funny here (which isn't even funny) is that an inexperienced admin made his box 100% public without taking the standard precautions that every admin worth his salt would take. He blindly trusted that his Mac would be configured to do something it wasn't designed for, and he got burned. Well, DUH. I had a friend who's RedHat Linux box was remotely rooted several times without the attacker being given a shell account. Does that mean that Linux sucks at security?

The only way..

To fully protect a Windows/Linux/BSD/OS X box, is to plug out the network-cable
But since that's not worth much, I suppose you can say a total secure box, isn't something from the near future.

Security in small numbers

Don't feel lonely, Mac-geeks, you're in the very good company of Linux users. The benefit of your security: You're uninteresting.

Since "hacking" and all the other activities that end in "-ing" and often start with a "ph" are no longer fun pastimes for geeks but actually became a hunting ground for very money oriented very well organized criminal organisations, security is in small numbers: An attack has to hit as many targets as possible. Maximize your output. And, well, if there are potentially 100 Linux boxes out there with a blatant security hole or 10.000 boxes running Windows with an obscure and hard to exploit hole, the latter will be chosen.

Not (only) because the respective users usually also employ a very different attitude towards security and because they usually have very different levels of understanding concerning the abilities and liabilities of their machines. But simply because you can hit more targets with your attack.

Plain and simple as that.

You can run the most insecure, most open system you want, as long as you're the only one using it you're safe. Unless hacking you alone already warrants the cost associated with it.

Yes, hacking has become a matter of cost/benefit calculation.

Confused About Their Motives

I'm not really sure why this competition happened in the first place. If you were a Mac OS X enthusiast wanting to show the "amazing" security of your OS, why would you leave the first major door wide open?

And who gains from this publicity? It would seem like sponsoring a hacking competition that took MORE than 30 minutes (seemingly the goal of such an event) would be good for Apple, but then why leave the system more vulnerable at the start of the contest? And if it was really sponsored by an anti-Apple group posing as an pro-Apple group, why have the hacker claim that Macs are essentially "small pickin's"?

It just doesn't make sense...

If you want a secure computer...

...consider disconnecting your Internet connection. Duh.

The only trend to security is that there isn't any financial motivation to hack small-potatoes.

local account = assumed root access

This was a while ago, but when you give a user a local account, its almost assumed that if they really wanted to they could get root. You should take care when giving out accounts.

It like giving physical access to a machine. If you give physical access to any linux machine, its not hard to log onto it. (this is why you lock up the machines!)

local SSH is probably more common than we think

much ado about nothing, in practical terms. The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack.

Didn't we just have a discussion over how people leave their wireless AP open for anyone to use? I don't think the SSH agent is on by default, and I think that the firewall blocks it by default, but that doesn't mean this is always the case. Given the reality of modern setups, where cable modems and wireless gives untrusted parties direct acess to the computer, I hardly see this hack as having no practical implications.

Of couse such contents are of no practical use. Either they end with the machine hacked, which is simply to be expected, or they end with the machine not hacked, which proves nothing.

Stock Mac OS has never once had remote exploit!

This "30 min" contest was for people with an actual SSH account given to them for a LOCAL exploit, so its not a remote exploit, it also is not the most secure version of the Mac OS, but for SERVERS, nothing is as secure as MacOS.

Despite many high profile web sites and servers using OS9 for many years, not one database entry in the large BugTraq database documents a remote exploit for standard Mac OS in the history of the internet, even whith a common web server running on it.

Even the US Army used macs exclusively (mostly MacOS 9 until recently) after being rooted rouitinly using unix and MS Windows NT. For many many years www.army.mil has been run on macintoshes exclusively.

The same is true of many colleges that were rooted and defaced too often on Linux. They installed WebStar and OS 9 and never had to worry again.

http://uptime.netcraft.com/up/graph/?host=www.army .mil [netcraft.com]

http://www.google.com/search?q=army+webstar+ [google.com]"os-9"

Check it out yourself. This entire post is full of factual citations and 100% facts.

No mac in the history of the internet hosting a web server has ever been rooted or defaced remotely.

Why?

Because not one version of Mac OS has ever had a single exploitable hole ever discovered. (classic mac os now up to version 9.2.2 on currenlty sold g4 towers). OpenBSD has had no less than 5 holes (not one) in the default install in the last two years. Mac OS has had ZERO in over 8 years, even when paired up with its preferred web server app.

In fact in the entire SecurityFocus (BugTraq) database history there has never been a Mac exploited over the internet remotely. Scan it yourself.

That is why the US Army gave up on MS IIS and got a Mac for a web serve. Currently it is a honeypot for OSX testing, and US Army use regular Mac OS on other internal servers

This post is not talking about FreeBSD derived MacOS X (which already had a more than a 50 exploits and potential exploits in BugTraq database, and in the news yesterday with Symantec claiming in March 2005 of OSX having remote exploits) I am talking about current Mac OS 9.x and earlier which are highly sophisticated abstract-OS models.

Why is is hack proof? These reasons :

1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT. Apple uses an object model for process to process communication that is heavily typed and "pipe-less"

2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stuff where you pass Gary Davidian's birthday into certain registers and make a special call). By always being root there is no false sense of security, and programming is done carefully.

3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not. In case you are not aware of what a "pascal string" is, it usually has no null byte terminator. Additionally certain types of compilers can check range on assignments to prevent out of bounds. Furthermore many good programmers ensure that the bounds are not overwritten.

4> Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not mere file name extension). File types on Macs are not easily settable by users, expecially remotely. Apache as you know has had many problems in earlier years preventing wayward

Don't proof anything

This hacking contest don't proof anything to security, I saw that the user don't applied the recomended guidelines to secure a system. This contest will be more funny if it was with an OpenBSD system installed by default.

RTFM guys...

Before the Mac-o-philes here start getting all bent out of shape, perhaps reading the article in question would be a good start...

Here's a salient quote:

"The rm-my-mac challenge was setup similar to how you would have a Mac acting as a server -- with various remote services running and local access to users... There are various Mac OS X hardening guides out there that could have been used to harden the machine, however, it wouldn't have stopped the vulnerability I used to gain access.

"There are only limited things you can do with unknown and unpublished vulnerabilities. One is to use additional hardening patches -- good examples for Linux are the PaX patch and the grsecurity patches. They provide numerous hardening options on the system, and implement non-executable memory, which prevent memory based corruption exploits," said gwerdna.

Bad anagram for a name or not, the guy sounds like he knows what he is talking about. There is a link to another article as well that talks about Apple's lack of diligence on security issues. Here's a link:
http://zdnet.com.au/news/security/soa/Ancient_flaw s_leave_OS_X_vulnerable_/0,2000061744,39234678,00. htm [zdnet.com.au]

The point is that Security is everybody's business, and no company can afford to slack. Not even the lily-white Apple is immune.

Doors unlocked, windows open

So SSH was on and accessible? Dumb move. Like saying "I dare you to steal my jewelry from my bedroom -- oh, and my house is unlocked with the windows open."

But maybe people WANT something to be stolen. Many years ago, the garbagemen (sanitation workers) in NYC went on strike, and garbage was piling up in the streets. A relative of mine in Brooklyn still managed to get rid of his: he put it in big boxes, wrapped the boxes in gift paper with bows, and left them in his car with the doors unlocked. They always got stolen.

How this applies to the story, I dunno, but I still think it's funny.

Re:Doors unlocked, windows open

So SSH was on and accessible?

My ISP, Panix, will gladly sell you a shell account. You can SSH into it, or telnet, if you don't care. And yet, they're not rooted every 30 minutes. Or, ever.

If giving someone SSH access is 30 minutes away from giving them root, that's not secure.

Re:Doors unlocked, windows open

So SSH was on and accessible? Dumb move. Like saying "I dare you to steal my jewelry from my bedroom -- oh, and my house is unlocked with the windows open."

There have been SELinux security competitions that gave out SSH access as root and the boxes remained quite safe. There do exist standards of security which make your standards look remarkable poor and forgiving. Good security does exist, and pretending that it doesn't does not make you any more secure.

Jediiah.

This one time at band camp

A lot of hoopla and it's over in a very short period of time. Kinda reminds me of the first time I had sex. Note: to most slashdot users, this sex thing I refer to is like compiling a kernel on Gentoo using -O3 and having it be stable.

andrewg = gwerdna

Andrewg does know what he talking about. andrewg has published papers (not on mac security) and is part of some wonderful communities pulltheplug.org [pulltheplug.org] and felinemenace.org [felinemenace.org] . I assure you that this machine would of been hacked... with SSH access or not. I think it shows the importance of having patches that minimize possible exposure (i.e grsec/pax etc) that would of decreased the chances of successful exploitation dramatically.... but then again nothing is bullet proof

Start your biased counters now...

What to have some fun? Count how many post show up that try to make excuses
for the Mac. Man, if this were a windows box, I assure you that 99% of the
the post would be slamming MS w/o a second thought.

Although people want to point out that they shouldn't have allowed people to
have a SSH connection, you need to keep in mind that an SSH connection was
allowed because they thought the config was secure enough to handle it.

I do give them kodos for allowing the hack contest to take place. The best
way to test your software is to allow others to try and break it. Hopefully
they will fix the exploit and run the contest again.

Kodos is not yours to give...

> I do give them kodos for allowing the hack...

Kang [wanadoo.fr] might have something to say about that.

This was of very little worth

The first thing that I'm going to do as a "normal user" is turn on SSH and Personal Web Sharing. Then I'm going give anyone who wants access to my machine an SSH account.

This "test" was silly and unrealistic, at best.

Here's a "real" test:
1) Turn on brand new Mac Mini
2) Update to latest rev of OS
3) Try to hack it from the Internet, without knowing its IP address.

Good frackin' luck!

Why so many apologists?

This is hardly irrelevant.

I'm disturbed by the attitude that anything but a remote exploit against an ideally (not typically or justifiably) configured box is meaningless or misleading.

What good is a door if it's welded shut? Wouldn't a proper lock be more useful?

Security should be about maximizing functionality securely, not limiting it.

Re:Why so many apologists?

What good is a door if it's welded shut? Wouldn't a proper lock be more useful? Security should be about maximizing functionality securely, not limiting it.

Ideally, any user should be restricted to the behaviors intended by the administrator and there should be no local privilege escalations. Realistically, however, this does not really happen except in a few special cases of extremely security oriented OS's. The first line of defense is how many services you have, think of them as gates in a castle. The second is the firewall, how many gates are open for business. The third is the username/password, do the guards know you and will they let you in. These guard against most threats except for someone who can impersonate someone else or insider threats who have access but want more access. In this case the "hackers" was given legitimate access to come in through the open gate. (A gate the admin specifically had to open and using the username and password the admin gave them.)

Once inside there is still security, but it is much, much less. On the average Windows machine at this point there is no security at all and even on a well secured Windows machine there are thousands of unpatched privilege escalation exploits. At this point on either a Mac OS X desktop or the average Linux machine a knowledgeable security person will be able to gain admin access. That is a sad fact, but it is the case for the vast majority of systems. Exceptions might be a locked down OpenBSD box running jails, an SELinux box, or some other specialized ultra-secure OS running virtual machines. Very few people run those machines as desktops and those that due generally don't have the best experience because they sacrifice a lot of usability to gain that level of security.

This "test" was no surprise to anyone with a clue. That is exactly what would be expected to happen. Also, some of the better security guys out there can definitely gain remote access to machines using unpublished vulnerabilities. If they really want in they will get into the average OS X or Linux box. So what are we talking about here? Well obviously this is still much better than Windows, but not impregnable. What it does is make you pretty safe from automated worms and your average script kiddie, which far outnumber the knowledgeable crackers out there.

Ideally, all desktop OS's would be locked down more tightly. They would do more security auditing and they would implement ACLs, VMs, or jails for all remote access and all applications. Some day perhaps they will. But for right now it is not a big concern, simply because market does not call for it. Not many people really have data that needs to be kept secure against experts and those that do have specialized OS's to use. Of course they can't run photoshop or World of Warcraft and the users would not trust their internet connection to talk to WoW servers anyway using all closed source. That is a task better allocated to a regular desktop, not a locked down, ultra-secure server. And that is what this "test" has shown. OS X is a desktop and if you bypass all the primary security on it, it will not stand up to a cracker from the inside like OpenBSD might. Of course anyone who really cares already knew that.

Inaccuracy

The title to this is comepletely inaccurate. If the person that submitted the article would have read it they would have realized that it was hacked after several hours, however the person that did it said it took only 30 minutes for the person to complete his work. Care to reword this please?

No need to turn off ssh.

That's one of the first things you turn off to protect the machine. No, you don't have to turn it off. Just don't give out user accounts to other people. These guys who broke in where gien accounts with passwords. SSH is very secure as long as you closely control what accounts may be accessed via ssh and varify that these accounts use strong passwords. But if you machine has an account with username "bob" and uses "bob" as the password your sytem is wide open, or at least Bob's account is.

not good test

The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack." Thats like giving someone the keys to your house and seeing if they can steal something.

Lessons to Learn Here?

There are two lessons to learn here.

First, if you're running services from your Mini-Mac workstation connected directly to the internet, don't enable ssh without a strong upstream firewall.

Secondly, don't hand out local accounts to someone named 'gwerdna'.

Astroturfing?

The whole article seemed to culminate in the following information: some guy said if Macs were more popular they would have a worse record than "other operating systems." It seems to be comparing OS X to Linux, but it isn't entirely clear what the baseline is for their eval of Mac OS.X and it also doesn't clarify what exactly makes these OSs different. Also, the web site defacement isn't proof that the person with an unprivileged account acquired superuser privileges to do anything other than deface the web page. I don't doubt it could have happened, but maybe it did and maybe it didn't...

"The only thing which has kept Mac OS X relatively safe up until now is the fact that the market share is significantly lower than that of Microsoft Windows or the more common UNIX platforms.... If this situation was to change, in my opinion, things could be a lot worse on Mac OS X than they currently are on other operating systems," said Archibald at the time.

Also, giving people LDAP accounts on the machine is really cheating. Maybe some noobs get a boner when someone fuzzes the hell out of a box from a local account until they get some fuzz escalated **BORING**. If they really wanted to throw down the gauntlet, then we would see Mandatory Access Control [freebsd.org] implemented on OS X . The big difference is that the MAC policies would be enforceable at the Mach [stepwise.com] MK level (on Mach ports, tasks, processes...), and OS X would be the ONLY OS with a security policy interface that could come close to usable for average people.

Please hack MY mac!

Try me

ip: 127.0.0.1

alter the web page and post here when done.

multi-platform hack

what would be much more interesting is if some nice person set up multiple OS platforms, configured them with the same services, and waited to see how long it'd take to hack each of them. maybe lock them down a little more than the mac mini test, just to make it more of a challenge. maybe: windows XP, os x, solaris, and a couple of linux dists ... ?

AND root was enabled.

What a maroon.

I would like

I would like someone to have a real contest,but without doing stupid stuff like granting ssh access to everyone. Let the owner of the mac take all the security steps he has to and run the contest. I am sure they will need more than 30 minutes but it will get hacked in less than 48 hours as long as there is plenty of information about the contest and the reward is good enough

let me just clue you in on something

EVERY SYSTEM IS HACKABLE!

I don't care what platform it is or how good you think you are at securing it, if you set up a box and tell the whole internet to "try and hack me" - guess what, YOU WILL GET HACKED.

30 mins?

30 mins? The Windows XP Security Competition ended in 30 seconds.

Sigh

If I read the findings correctly, there were a number
of questionable things done:

-giving shell access to anyone who asked for it.
-leaving ssh on and running.

But these weren't the most egregious things allowed:

Any machine, any operating system is vulnerable when
PHYSICAL ACCESS TO THE BOX is allowed.

If someone can just walk up to it you might as well
kiss your security goodbye.

Working in a large Fortune 500 company, I often notice
post-it notes with passwords stickied to monitors or the
underside of keyboards - it's not that different in the
real world either.

Again, any operating system can be defeated if you have
an account with the right priveleges and you have physical
access to the box.

But how was it done?

While the implications of this "test" are debateable, what I would really like know is how the hack was done. Is there some flaw in OS X that was exploited? Or did the admin do something else silly like make the root password something simple like "hello" and it was guessed/dictionary attacked. Is this a Mac OS X specific hack? Or did they use a vulnerabilty that is common to other UNIX flavors as well?

How long would this contest lasted on Windows?

I mean, really. You have local root exploits on OS X. I'm not surprised, when you have companies like Adobe shipping apps containing setuid root shell scripts. Suppose you set them up with an Interix or Cygwin ssh login on Windows, how long would it take to deface IIS? Or would you even bother calling that an "exploit"?

If you need to give potentially hostile users shell, you want them in a FreeBSD jail at a minimum.

Fink could have aided the hacker

One of the unusual things about the "hacked" machine was that Fink was installed. This most likely means that the Apple developer tools were installed (although Fink can install precompiled binaries), making it possible for the hacker to bring his own code and compile on the system. Although Apple ships the developer tools on the OS X client install DVD, it is not installed by default, nor is X11.

Fink lists a catalog of 6359 open source projects [finkproject.org] that can be installed, many of which are tools that could help a hacker exploit a machine or that are exploitable in themselves.

The exploit was...

the host's stupidity. I don't know about 'little known exploit'. Stupidity is rampant. Apple can't patch that, so they're SOL as is this fool. Stupidity can't be patched (too bad) and if they try to make an idiot proof OS, well, you know what happens.

Sure the OS X box was hacked in 30 minutes

... but that's about 29 and a half minutes longer than a similarly configured Windows box.

Challenge: Hack into my Windows Box!

> Would be nice to see something like this for all platforms.

Well, huh! Here's a challenge! I've got a Windows box which you can attack at IP 124.235.13... [silence]

PS: What's even funnier is I've actually got a W2K webserver/SSH/SFTP server running here but I dare not give the IP away at slashdot - if OSX has 'an unpublished vulnerability' I wonder how many Windows does... Which is double funny again since supposedly OSX weaknesses haven't been exposed cause of small user base whereas my only defence against horders of hackers here is to keep my website as unpopular as possible! :P

Re:Mac user ignorance

Yep, cuz' we know stupid Mac users are always going around enabling SSH and giving shell accounts to total strangers.

Oh, wait, 99.9% of Mac users are blissfully ignorant of what security defaults to change to make their system more hacker-friendly.

Re:Mac user ignorance

Nobody will probably see this post since the parent got modded into oblivion. But there's no question that an OS claims to be so simple anybody can use it must also be so secure and bug free that nobody could accidentally screw it up. There's a whole herd of Mac users that still believe the the Mac is un-hackable and virus-proof. They'll click on any attachment they get. Those same people will feel free to screw with any setting on their Mac because there's no way they could ever get hacked.

It's those types that will end up with a machine that is completely hackable. Windows and Linux users are never under the false impression that their machines are 100% hacker and virus proof. So, in general, we are extra careful when we are changing settings, opening attachments, or surfing the web in general.