MacBook Air First To Be Compromised In Hacking Contest 493
Multiple readers have written to let us know that the MacBook Air was the first laptop to fall in the CanSecWest hacking contest. The successful hijacking took place only two minutes into the second day of the competition, after the rules had been relaxed to allow the visiting of websites and opening of emails. The TippingPoint blog reveals that the vulnerability was located within Safari, but they won't release specific details until Apple has had a chance to correct the problem. The winner, Charlie Miller, gets to keep the laptop and $10,000. We covered the contest last year, and the results were similar.
0wnership (Score:5, Funny)
Re:Owning Beauty (Score:4, Insightful)
Re: (Score:3, Interesting)
You forgot to factor in the $10,000 cash prize.
And you forgot the prospect for employment. Hack a mac and you put it on your resume, hack a PC and no one cares or worse thinks your are a script kiddie.
More to the point, what you can't measure here is the real world vulnerability. I cringe at keeping my Linux machines up-to-date and protected. I rely on firewalls not themachines. With the machines, which are production machines, it's huge roll of the dice to try to apply a patch and descend into dependency hell and discover over the next week which
Re:Owning Beauty (Score:5, Insightful)
Re: (Score:3, Funny)
How about Firefox + NoScript? Actually I was hoping for an OS vulnerability, something where you can be targeted, but I suppose everyone deserves credit this time around.
Too bad David Maynor wasn't there. He woulda hacked the MacBook Air in 5 minutes!
Re: (Score:3, Insightful)
To be completely fair, though, the Vista and Ubuntu machines are, according to all sources I've found, still up and still unhacked. If you can still win those (which I think you can?) even though there's no longer a cash prize there's at least incentive for someone to hack them. If it were a case of people coming prepared with vulnerabilities on all three machines you'd expect one of the other two would have been brought down by now.
I do agree, though. The bottom line is that no OS is completely secure and
Re:Owning Beauty (Score:4, Insightful)
"apt-get update; apt-get upgrade;" on a Debian Stable works like a charm (because they push ONLY security and major bugfixes). I manage a farm of 30 servers for about 2 years and Debian update ALWAYS worked without any problem.
Re:Owning Beauty (Score:4, Insightful)
Oh sweet jesus... Apple owners... spinning a truly piss-poor performance into a plus.
Re:Owning Beauty (Score:4, Informative)
do you hear that ? (Score:5, Funny)
Re:do you hear that ? (Score:4, Funny)
Re:Get the Facts is a better tag. (Score:5, Funny)
Re:Get the Facts is a better tag. (Score:5, Insightful)
Dell is actually starting to not suck. (Score:5, Informative)
Even more surprising, the m1330 is really well supported in Ubuntu. (Dell actually sells the m1330 with Ubuntu pre-installed, although the discount is rather pathetic.) More things just work in a default install of Ubuntu on the m1330 than in Vista! (The only thing that doesn't work as well in Ubuntu as it does in Vista is the fingerprint reader, but that's just because biometric password support in Linux, and KDE especially, sucks dingo balls at present.) And yes, if I bought a macbook I probably would have tossed the OSX disks and reformated the drive first thing. I've had to develop under OSX and, while I don't mind it, I definitely prefer Ubuntu.
Caveat time. Dell's customization options are still royally borked. You can pick up a lot of accessories, like bluetooth mice, fairly cheap when buying a laptop, but other components are just insanely expensive. Anyone who maxes out the memory on a Dell while ordering it and then complains about the price is an idiot. Upgrading the memory on a Dell won't void the warranty. You want 4GB? Get 1GB from Dell and, toss it, and buy a couple 2GB sticks yourself. You'll save at least a couple hundred dollars. If Dell would smarten up about that kind of thing I'd have no complaints.
Still, one thing is pretty clear. You can no longer mindlessly slag Dell for epitomizing bland and crappy laptop designs. They do still have ultra-cheap crap and bland bricks built like tanks for the corporate types, but they're also gunning for the sexier end of the market now.
Re:Get the Facts is a better tag. (Score:5, Insightful)
Re:Get the Facts is a better tag. (Score:5, Funny)
Get the facts... Up to the point where they support your agenda and then punt.
I say well done. (Score:5, Insightful)
I haven't RTFA but from the surface it sounds like a fair exploit test, and sure it only fell over with user interaction, but it still fell first. So good on them, they'll enjoy their prize of a macbook air and a sweet $10k.
Alternate headline: Mac last hacked IRL (Score:5, Interesting)
I don't care if it's spyware, adware, a virus, a tray icon, or or even just a simple browser toolbar or homepage or search-engine hijacking; or if it's installed manually or via drive-by methods--whether its due to small market share, inherent (UNIX) security, or something else, I will continue to argue that Mac and Linux are the better platforms, IN PRACTICE, for the average user.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
"I have no idea why some of my boxes fall prey to security holes, so I am just going to blindly assume that X operating system is more secure than Y operating system."
There is no such thing as a "secure OS". Security is a process that is ongoing and the principles of securing a system apply to ALL operating systems. If you want a real explanation as to why your Windows machines are attacked more often than your Macs or Linux machines, try the concept of "marketshare" out. Reme
Re:I think the relevant part is: (Score:5, Insightful)
Yes, that sounds logical, if your genitals are hooked up to a car battery.
The winner got to keep the unit AND 10,000. So OBVIOUSLY they should crack the easiest unit, flip it on ebay, and then buy whatever they actually want, while pocketing the remaining 8-9 grand...
So... the moral of this story? Never underestimate the ability of an Apple fan to rationalize how the Mac could be the first to fail, yet still be the finest computer in the competition. d(^_~) [Thumbs up!]
I
Re:I think the relevant part is: (Score:5, Informative)
Re:I think the relevant part is: (Score:4, Funny)
No one is going to be interested in the fact that it required user-assistance and can't be executed remotely (which are by far the most worrisome.)
Re: (Score:3, Funny)
Better headline (Score:5, Funny)
It's funny how they turned a huge hole in the Safari browser into a commercial for the Mac Air.
"Small size, big holes"
Re:Better headline (Score:5, Funny)
Identical articles (Score:3, Insightful)
Re:Identical articles (Score:5, Insightful)
Re:Identical articles (Score:5, Funny)
Re: (Score:3, Funny)
Well, they let them use a Vista laptop because Windows 7 isn't available yet (not sure it means anything, but Microsoft is still an OS generation behind Apple).
You seem to have that arse-about-face. In every way except the display system, even Windows NT 3.51, dating from the early '90s, was a generation ahead of OS X until about 10.4/10.5. Vista leapfrogged ahead with the display system, while 10.4 and 10.5 brought in parity with lower level aspects like fine-grained locking and an ACL-based security s
And, in this case, the attacker deliberately chose (Score:3, Insightful)
But the issue is really not which is more vulnerable, it is that you can't run a secure browser and a convenient browse
Re:And, in this case, the attacker deliberately ch (Score:5, Informative)
Re:linky, pleasey (Score:5, Informative)
Quote from the linkey
In IE7's Protected Mode--which is the default in other than the Trusted security zone--the IE process runs with Low rights, even if the logged-in user is an administrator. Since add-ins to IE such as ActiveX controls and toolbars run within the IE process, those add-ins run Low as well. The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.
In Protected Mode IE writes/reads special Low versions of the cache, TEMP folder, Cookies and History:
Cache: %userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low
Temp: %userprofile%\AppData\Local\Temp\Low
Cookies: %userprofile%\AppData\Roaming\Microsoft\Windows\Cookies\Low
History: %userprofile%\AppData\Local\Microsoft\Windows\History\Low
Re: (Score:3, Informative)
Why does this matter? Well, suppose you have something
Safe Browsing for real (Score:3, Interesting)
Re:browse one site (Score:5, Informative)
Re:And, in this case, the attacker deliberately ch (Score:5, Informative)
Actually "su" stands for "switch user". You can just as easily sudo to _any_ user.
Re: (Score:3, Informative)
While we're on the subject, guess what "dd" stands for? It's not "direct dump" or "disk destroy". It's "character copy".
Comment removed (Score:5, Informative)
Re:Identical articles (Score:5, Informative)
Re:Identical articles (Score:5, Informative)
All laptops will be open only for Remotely exploitable Pre-Auth vulnerabilities which require no user interaction. First one to pwn it, receives the laptop and a $20,000 cash prize.
The pwned machine(s) will be taken out of the contest at that time.
Day 2: March 27th: Default client-side apps
The attack surfaces increases to also include any default installed client-side applications which can be exploited by following a link through email, vendor supplied IM client or visiting a malicious website. First one to pwn it receives the laptop and a $10,000 cash prize.
The pwned machine(s) will be taken out of the contest at that time.
Day 3: March 28th: Third Party apps
Assuming the laptops are still standing, we will finally add some popular 3rd party client applications to the scope. That list will be made available at CanSecWest, and will be also posted here on the blog. First to pwn it receives the laptop and a $5,000 cash prize.
Re: (Score:3, Funny)
The Mac actually won because it was the first one to be exploited.
Re:Identical articles (Score:4, Insightful)
Hold on - are you saying that Mac's have a better reputation for security than linux?
Congratulations sir. Apple fanboy's capacity for self-delusion never ceases to amaze me.
Re: (Score:3, Interesting)
Congratulations sir. Apple hating Slashdotters' capacity for misquoting for libelous use and getting modded "insightful" for it never ceases to amaze me.
Re:Identical articles (Score:5, Informative)
http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture [tippingpoint.com]
Re:Identical articles (Score:4, Funny)
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
Ouch, that didn't take long. (Score:3, Insightful)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Users == the problem (Score:4, Insightful)
Good to see that social engineering is still all it requires to compromise something.
Re:Users == the problem (Score:5, Insightful)
Re: (Score:3, Insightful)
I doubt it'll take much longer for all three to get taken over. There'll be some office bug, or a local service vulnerability that hasn't been patched yet, and it'll be game over, sooner rather than later.
There's a lot to be said for being exposed, it does gi
Re:Users == the problem (Score:4, Insightful)
That said, ubuntu (and linux in general) are heading that way too, just not quite with the same fevered pitch.
It's the same basic premise that windows was based on: The user is in control. OSX and linux both have fairly strong boundaries between admin and user, but things are slowly wearing down, in the name of convenience. The difference being that things started out far more secure, and there's a bit more separation at the display itself, whereas win9x was not designed with this security in mind, and while NT was, it also inherited parts from win9x's shell and there were compromises at the display, etc.
Microsoft gets this now though. SQL Server's a great example of that. Hundreds of thousands of man-hours have gone into making that thing far more secure than the slammer days, just compare critical vulnerability counts from SQL-server to Oracle. Microsoft's biggest curse is legacy code now, plus a fair amount of ongoing training, and they will only shrink with time. This is mainly shifting market pressure, of course, it costs money to have negative press regarding security nowadays. It didn't in the past, and it will only increasingly have negative press for the next couple of decades at least. It's surprising that Oracle is now doing what Microsoft used to do: treat security as a marketing buzz word (Unbreakable on linux took how long to break?)
But who knows how many holes were in the old X11R6. But you didn't run that on servers, for a good reason. Guess what, there are probably lots of applications that don't handle the Windows messaging system securely and buffer-over/underrun free either.
These days, things like IE operate in Limited user mode. This goes even further than ordinary users (far more than a "power" user, and lightyears away from Administrator or SYSTEM). It's restricted to \users\%USER%\AppData\LocalLow\ and one or two other locations, and that's it (Favorites spring to mind. It gets to be a pain if those accidentally wind up back with normal ACLs, as I mentioned here [mycronite.net].)
So you need to work harder to break out of internet explorer, and IIRC, it takes permission from a privileged application to do it. Outlook's probably a juicier target, but it's been subject to the fabled crucible for a long long time, so again, it's harder.
OSX hasn't been subject to it for long at all. Safari's new. *Really* new, and you know what, it wasn't even webkit that broke, but the url bar (if memory of the bugtraq post serves.) Where did webkit come from? Oooh. that's right. KDE.
We're all in for it if apple really do gain significant market share (we being administrators, not we being "the general populace"). It may or may not be as big a problem as windows has been, but I'm willing to bet that the effects will be as dire, and apple doesn't really have a fantastic track record here, as other articles have pointed out. The momentum of not having security as a primary goal is one that takes a *long* time to turn around.
Keep the laptop (Score:4, Funny)
You mean like when your airplane flight is cancelled and the airline offers you a free ticket. Or when the food at a restaurant is crappy and they give you a coupon to eat there again.
Re:Keep the laptop (Score:5, Insightful)
Maybe it's major, or maybe no big deal (Score:5, Insightful)
So if the Mac was tagged by just loading a page that delivered the hack, that's bad. Quite bad. If he had to click and download something (and perhaps defeat the auto-quarantine they use), that's not so much a big deal, though still a hole that needs patching.
One of the things about vulnerabilities on all platforms is that a significant part of the magnitude depends on how difficult it is to exploit. Remote connections to a system that avoid/defeat a firewall are really dangerous. Attacks that require the user to do something stupid are inevitable, but far less dangerous.
Thus far most of the Mac vulnerabilities have been the second type. Luckily.
Re: (Score:3, Funny)
If it were in my neighborhood, I might go by and pick one or the other up (if no one beat me to it). I want a lightweight portable to take on the train.
Yeah, I'm sure you could just drop by and win one of the laptops. You dolt, these people have been preparing for this contest for the better part of a year, and the Vista and Linux laptops still weren't hacked by the end of day two. I can tell by your posts that you're not that smart, so I have no idea how you think you'd win either of the laptops.
Day 2 results (Score:5, Informative)
http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture [tippingpoint.com]
Safari holed, so Apple pushes it to Windows ;) (Score:3, Funny)
Or am I being a conspiracy nut?
Good. (Score:5, Insightful)
I would rather have Apple "shamed" into providing me (and other OS X users) a more secure web browser/operating system than gain some pathetic "my system is more secure than yours" bragging rights.
Can't wait to find out what and how (Score:5, Insightful)
There is no way any system can be perfectly secure, but this is a significant hole. While they probably won't get me to click that stupid link, they might get my mom or any number of the other avg everyday users.
At least now we can get beyond the macs can't be hacked BS and move on to securing my favorite OS and keeping it that way.
Now lets see how long it takes for apple to post a patch, that is really where the rubber meets the road.
I don't get it (Score:5, Insightful)
Can't we admit that, for whatever reason, the Air/Safari was easier hacked than Vista/IE7? I know this is an unpopular bandwagon to be on, especially on Slashdot, but it seems there's no two ways about it. I refuse to believe that it was a conspiracy and that every hacker was actually just trying to hack the Air and make Ubuntu and Vista pass, that's stupid. If I were a hacker, I'd totally hack the EASIEST one simply to get the $10k and the laptop. And if there were known or open vulnerabilities, it should have fallen in what, 30 seconds?
Seriously, it's not a huge deal. If we, like good open source cronies, admit that there was a problem with *gasp* part of the Apple software/laptop combo (whether it was Safari or the OS or whatever), then maybe it will be fixed. Isn't that the main idea here? I thought the point of these things were to discover vulnerabilities so that they could be fixed, not to place bets on Microsoft falling and go up in arms if it doesn't.
Unless, of course, we really aren't interested in open source software or good software at all, but are more about claiming a company name as our own.
Tags? (Score:3, Interesting)
Just sayin...
A real hero (Score:5, Interesting)
In other words this guy most likely found a security bug in Safari, but instead of reporting it directly, made an exploit and waited for a hacking contest to get a monetary benefit out of it. A real hero. Or maybe he was just quick. Which seems more plausible?
Re: (Score:3, Insightful)
So what if he did? As somebody who uses a Mac (and Linux, and Windows XP), I'm much happier with him having taken this route to gaining from the exploit than the one so many Windows hackers use of putting it up for auction to the highest bidder, or the Month Of Apple Bugs tactic of making exploits public before giving
Re: (Score:3, Insightful)
(Giving up my spent mod points to reply to this)
I agree, in principle.
From a practical POV though, who's to say this guy would even bother finding obscure (one hopes) security holes anyway, without the financial and other incentives offered by this contest?
Black hats are often funded by criminals. May as well offer a carrot to the White/gray hats so they don't get tempted by the dark side.
Re: (Score:3, Insightful)
The government should have no part in regulating software. The government is utterly incompetent when it comes to tech issues, and they can't even fund their patent system with sufficiently technical people to reject frivolous patents. A specific software audit
Maybe Apple will get serious about security now (Score:4, Insightful)
Just as long as they don't implement some Vista like "Allow or Deny?" crap... God that would drive me *nuts*!
Reality will disappoint morons. (Score:3, Insightful)
CanSecWest and Swiss Federal Institute of Tech Deliver Attacks on the Reality of Mac Security [roughlydrafted.com]
Ho-hum (Score:3, Insightful)
The perceived general level of security in a system can be directly correlated to the most recent compromise of that system. The fact that the Linux and Windows systems involved in this contest have not yet been compromised does not indicate that they are more or less secure in a general sense than the Mac. It does indicate that no one has found the vulnerability that inevitably lurks within the kernal or a piece of installed software on those system. But rest assured, the exploits are there.
"FireFox is more secure than IE", you say on Monday. Then Slashdot posts "HUGE FRIGGING HOLE FOUND IN FIREFOX: DOOM!!!" on Tuesday. And suddenly the absolute statement you've made sounds silly.
If you don't believe this is true, try this: get hold of a system exactly like the ones currently considered "unhackable" in the contest and disable any automatic updates (and don't install any manually). Wait three months and then compare that system against one with the most recent updates. You're sure to find that your unhackable system is now full of known exploits and security holes.
The systems we rely on today are very complex and in a very real sense cannot be completely understood. There are techniques that can make them generally more secure and all of the OS developers are working to bring these features online every day. Some are better than this than others (or so it seems), but they all do it. Even Microsoft. But the thing about security is this: the bad guys only need one hole and the good guys have to cover all the bases.
The only real security in a system comes from user practices, not software. If you don't install updates on your system, it will be vulnerable. If you don't consider HOW and where you use your system, it will be vulnerable. In other words, the core component in a secure system is YOU.
It's probably true that there is a "most" secure OS and a "least" secure OS right at this moment. Take a guess which is which and you might even be correct. But there's no absolute answer that will be true tomorrow. We need to stop with the absolutes and "MY FLAVA ROCKS YER FLAVA" hyperbole and start to think more like real security experts do. The next big hack for your favorite OS is just around the corner. And there's no doubt about that.
Re:I think this section is relevant (Score:5, Insightful)
Re: (Score:3, Insightful)
But as a mac user
Re:I think this section is relevant (Score:5, Insightful)
Wow, at +4 already for just quoting the summary and tossing in a vague and meaningless sentence.
So anyway, what exactly is it saying? The only thing I see there is that a completely passive attack (that is, absolutely no user interaction, like many well-known worms worked) failed. Once this part of the test was passed they allowed interactive attacks (where the user must assist the attacker in some way). Since this is how nearly all malware and malicious software spreads these days, I don't see anything wrong with this. Aside from just attaching hardware to the network, a web browser and email client are the two applications with the most Internet "surface area". As all major operating systems come bundled with a primary browser (IE, Safari, Firefox) a flaw in the browser essentially amounts to a flaw in the OS. It seems natural and obvious to put them to the test.
Re: (Score:3, Funny)
Yeah. A Laptop is safe, even connected to a network, provided you make no contact with the network as the user.
Like my car - very very safe as long as you don't back it out of the garage.
Re: (Score:2)
Re:well, tFriendlyA does mention (Score:5, Informative)
Re: (Score:2)
Re:I wouldn't be surprised.. (Score:5, Insightful)
Re:right (Score:5, Insightful)
Re:right (Score:4, Insightful)
Re:right (Score:4, Informative)
It's not a guarantee that the first to fail is the weakest, there's definite elements of chance and some complex interactions. But it was done with Safari, which is part of the default distribution of a Mac and it's not exactly easy to not use Safari for at least long enough to download Firefox.
Re: (Score:2)
considering who is doing the attacking I'd bet that physical access would make these comps 100% breakable. all that needs to be done is reset the bios and pop in a live cd and it's game over.
I know... it shocked me that installing software often didn't require any sort of authentication what so ever...
Re: (Score:3, Insightful)
considering who is doing the attacking I'd bet that physical access would make these comps 100% breakable. all that needs to be done is reset the bios and pop in a live cd and it's game over.
So why was a unpatched security vulnerability in Safari needed if it were so simple? There was no physical access provided. Give some credit to the organizers, they're not dumbasses to give $10k in cash and a expensive laptop to the first contestant that jogs into the competition.
I know... it shocked me that installing software often didn't require any sort of authentication what so ever...
Because the code ran under Safari's privileges, i.e not root but user.
you could look at it this way: cracking anything Windows is pretty much nothing special, it's being done on a massive scale botnets and zombies considered- what is perhaps a ncier target is a 2,000 dolalr macbook that claims to have a lot higher security than windows. motivation being the biggest security danger of them all.
The Sony VAIO TZ37CN Ubuntu laptop costs $2300+ You mean no one wanted that and 10k in cash when "all that needs to be done is reset the bios and pop in a liv
Re: (Score:3)
which is because
try doing that when you don't have physical access to the machine in question. It seems that Safari is Mac's equivalent of Internet explorer in that it can be a major security problem. it's something Apple really needs to get under control lest they actually become as fubared as
Re: (Score:3, Insightful)
It seems that Safari is Mac's equivalent of Internet explorer in that it can be a major security problem.
Except for the fact that IE7 on Vista has proven that it's not a security problem. Safari is the equivalent of IE5.5, meaning Apple is 8 years behind as far as browser security goes. Microsoft spent those 8 years learning some very tough lessons, while Apple just sat around laughing at Microsoft. Then when Apple decided to make their own browser, they made all of the same mistakes Microsoft did years ago.
Re: (Score:3, Informative)
Re:And in other news..... (Score:5, Informative)
Re:And in other news..... (Score:5, Funny)
Re: (Score:2)
Re:And in other news..... (Score:4, Insightful)
Re:And in other news..... (Score:4, Insightful)
Re:Contest rules... (Score:5, Informative)
Re: (Score:3, Insightful)
Re:It Might Have Been Harder if... (Score:5, Funny)
Re:Inquiring minds... (Score:5, Funny)
Re: (Score:3)
However, there's also a $10,000 prize for today.
And despite that, neither the vista box nor the ubuntu box were hacked at all on day 2.
Day 2 allowed user interaction (like browsing to a website) but only allowed targeting software that ships with the product.
That being said
So part of this wa
Re: (Score:3)
because OS X has a reputation for being virus and malware free
Ahh... a slight correction: Till now no known malware exists for OS X because none was developed.
After all why spend so much money to develop walware or virus for a system that is being used by one half of the 5% of population who happen to surf to a website.
Costs include Apple Developer's Program, buying a Mac to develop and Test (and everyone knows its not as easy as Visual C++), and assorted tools.
Too much effort for a reasonable payoff.
And secondly Mac users tend to be richer, well-studied and well-off
Because the prize was 10k (Score:3, Informative)