Forgot your password?
typodupeerror
Security Businesses Apple

MacBook Wi-Fi Hijack Details Finally Released 82

Posted by Zonk
from the strange-tale-of-patch-10.4.8 dept.
Wick3d Gam3s writes "Hacker David Maynor attempted to put the strange tale of the Macbook Wifi hack to rest, and offered an apology for mistakes made. All this and a live demo of the takeover exploit was made at a Black Hat DC event yesterday. Maynor promised to release e-mail exchanges, crash/panic logs and exploit code in an effort to clear his tarnished name. Said Maynor: 'I screwed up a bit [at last year's Black Hat in Las Vegas]. I probably shouldn't have used an Apple machine in the video demo and I definitely should not have discussed it a journalist ahead of time ... I made mistakes, I screwed up. You can blame me for a lot of things but don't say we didn't find this and give all the information to Apple.'"
This discussion has been archived. No new comments can be posted.

MacBook Wi-Fi Hijack Details Finally Released

Comments Filter:
  • by bluemonq (812827) * on Friday March 02, 2007 @11:51AM (#18207252)
    ...that he could gain complete access over the machine? Frankly, I wouldn't even be surprised if he did some old-fashioned reverse-engineering of the patch to create the exploit for the older boxes.
    • by donicer (256075) *
      Maybe, but that doesn't explain the emails that were shown between him and Apple engineers pointing to problems in Mac products in early August of last year.
      • by bluemonq (812827) *
        From the way you phrased it, pointing out problems and being able to exploit them are two different things. And again, why the sudden change in the scope of the vulnerability? Didn't he say that he already had the exploit ready to go, and that he was simply bullied into not presenting it? I just find that suspicious.
          • It was a WiFi-borne hack and he was at Black Hat. So there were lots of sniffers going and everybody gets a copy of whatever he does.

            So he just demoed (and thus released) the DoS, not the root exploit - which he DID have the code to perform but didn't want to release (by demoing).

            Apple admitted the vulnerability WAS a root exploit.
            • by Rosyna (80334) on Friday March 02, 2007 @01:48PM (#18208686) Homepage
              Apple admitted the vulnerability WAS a root exploit.

              No, Apple said it could be used to run arbitrary code with system privileges.

              Just like I could step outside my door and find $10,000 rolled up in a neat little ball. Doesn't mean it is likely to happen, but it could.

              Theory and practice are two completely different things.
            • Re: (Score:3, Insightful)

              by MasterVidBoi (267096)

              It was a WiFi-borne hack and he was at Black Hat. So there were lots of sniffers going and everybody gets a copy of whatever he does.

              So he just demoed (and thus released) the DoS, not the root exploit - which he DID have the code to perform but didn't want to release (by demoing).

              Except that the patch for this vunerability was released months ago. Yet that didn't stop him from (trying) to do the demo at Black Hat 2006, when there would have been just as many sniffers in the audience.

              From someone who already threw out their credibility, that really doesn't inspire confidence.

              • Re: (Score:3, Informative)

                by Sancho (17056) *
                I was at that Black Hat talk in Vegas. They didn't do the demo--they showed a video of it. They did it this way PRECISELY because there were sniffers in the audience.
                • by Wabin (600045)
                  Or so they claim. If they had an exploit, this would be true. If they didn't, it will cover that minor detail. A kind of nice little benefit of wireless exploit claims
    • Re: (Score:3, Informative)

      by DJCacophony (832334)
      Frankly, I wouldn't even be surprised if he did some old-fashioned reverse-engineering of the patch to create the exploit for the older boxes.

      And then used his time machine to go back in time to before the bug was patched and announce the exploit?
      The guy informed the world about the bug, then Apple fixed it, but refused to credit him for it.
      • Re: (Score:1, Troll)

        He informed the world about the bug in the same way as SCO informed the world about copyright and patent infringement by the Linux kernel.
      • by Rosyna (80334) on Friday March 02, 2007 @12:12PM (#18207540) Homepage
        Frankly, I wouldn't even be surprised if he did some old-fashioned reverse-engineering of the patch to create the exploit for the older boxes.

        And then used his time machine to go back in time to before the bug was patched and announce the exploit?


        No, his original claim was a farce (hell, look at the video, there was only one wireless device available according to ifconfig). Apple then audited their code, found 3 bugs. He took one of the bugs mentioned, found out how to trigger it, triggered the crash and now claims he was right all along.

        The problem is that what's happening now doesn't support his original claims. The original claims were he could hijack a MacBook in under 60 seconds and gain completely control of it. Now all he's getting is a crash with no control.
        • by CaymanIslandCarpedie (868408) on Friday March 02, 2007 @12:43PM (#18207914) Journal
          Not taking any sides here, but here is what he has said about this (and other issues) from his blog [blogspot.com]

          I thought you said it was a hijack yet you only showed a DoS.
          Yup, I showed a crash. I didn't feel the need to do the do the entire hijack for two reasons: Apple already confirmed that this vulnerability leads to remote code execution (they said so in the advisory here). Everybody that was running a sniffer during my talk now has a copy of the DoS code. The demo had two parts. I showed the crash happening on a 10.4.6 machine since it didn't have any of the airport patches. I then rebooted into 10.4.8 and the crash no longer happened. I did this to prove that the Airport patches issued on Sept 21st, 2006 fixed the problem I was demoing. The only real change to airport code was the security fixes that were issued.


          You just reversed the patches and found what you then showed on stage.
          I find this to be a funny argument. If I have the skills to reverse the patches and do a binary difference analysis of them, why couldn't I use those same skills to find the bugs in the first place (they weren't hard to find). This argument also doesn't take into account the fact that I showed that the first crash of the exploit occurred on Jul 15th, 2006, or emails to Apple helping them build a wifi auditing box (A linux machine with madwifi patched with LORCON) and pointed them to a vulnerability that was fixed in their patches (a problem with overly long SSIDs). The picture below is from the day I bought the Macbook, July 15th 2006. This crash occurred because I was fuzzing other devices and the Macbook crashed before I got to run the initial setup.
          • by Durandal64 (658649) on Friday March 02, 2007 @03:06PM (#18209934)
            This guy just doesn't quit. He claims that Apple confirmed that the vulnerability leads to remote code execution, which is bullshit. The description says "may be able to..." There's a world of difference there. Not every buffer overflow can be exploited to inject malicious code. It takes a lot of time and effort to actually find out whether it's practical to write an exploit, a lot more time and effort than simply patching the problem and being done with it. So why bother finding out for sure when you can just patch it and be sure that it won't get exploited?

            The fact that he will only demonstrate a crasher just seals the deal that he's full of shit. If he's had a working AirPort exploit for all this time, why not just demo it and put this issue to rest? That's what any sane person would do. But instead he's carefully misrepresenting Apple's release notes to make them seem as if they support his claim, further destroying his credibility.

            I think the most likely scenario here is that he originally found exploits for various third-party wireless drivers and saw an opportunity. With a cursory look at the AirPort drivers, he figured, "Yeah, I could write an exploit for them too". So he made a big announcement. He hated the "smug" Mac users, so now he could really stick it to them. But there was a problem. For whatever reason, he couldn't get his code to inject into the AirPort drivers. All he could do was KP the box. Well this wasn't what he initially promised. So when it came time to put-up or shut-up, he used a third-party card with drivers that he had been able to exploit. And of course, he knew that people would ask questions. Questions like, "Who cares? That card doesn't ship with Macs, and Macs have built-in wireless, so why would any Mac user ever need to buy this card?"

            Ah, but clever him. He knew that Apple had a reputation for being secretive and releasing the legal hounds. So he could just say, "Apple threatened me with legal action if I demoed the exploit on their drivers" and voila! He's now a victim of The Evil Corporation! The Slashdot crowd would definitely believe him. After all, geeks don't like Apple because they're secretive, and this would be just another validation for them. They'd buy it without question. Even if Apple issued a statement saying that Maynor was lying, that wouldn't matter, because Apple is the one who tried to muzzle Maynor in the first place! See how the logic goes round and round?
            • by Apotsy (84148)
              He knew that Apple had a reputation for being secretive and releasing the legal hounds. So he could just say, "Apple threatened me with legal action if I demoed the exploit on their drivers" and voila! He's now a victim of The Evil Corporation!

              Actually it was even more slimy than that. "Johnny Cache" said on a mailing list a while back: "Secureworks absolutely insists on being exceedingly responsible and doesn't want to release any details about anything until Apple issues a patch. Whether or not this pos

            • ...he originally found exploits for various third-party wireless drivers...
              ...he figured, "Yeah, I could write an exploit for them too".
              So he made a big announcement.
              then...
              All he could do was KP the box.

              Hey, you left out, "he made a fraudulent demo to gullible reporter, then hung him out to dry." Clearly his biggest sin. Too bad for him that showing a system should be vulnerable, and developing an exploit for it are vastly different things. I half expected that he might come up with something during the
            • by gordo3000 (785698)
              just to point out,
              every critical patch in windows has exactly that wording, even if there has been a major virus already released that affects that vulnerability. I'm not saying whether or not this guy is full of shit, but the wording a company uses when issuing a patch never says anything along the lines of "there is a full and working exploit that has been demonstrated". at least, not one I've ever read...
          • by Bretai (2646)
            The Apple patches were simply additional frame validation measures. The claim that this confirms an exploit was possible is ridiculous, especially from a security researcher who damn well knows the difference. Furthermore, DOS attacks are not that exciting in the first place, but when it's wireless, which is inherently vulnerable to DOS, it's really a waste of time to use this as the subject of presentation.

            It is not possible that he doesn't understand that the only point of contention is whether he had an
            • by Bretai (2646)
              Since "Hijack" details were clearly *not* revealed, by David Maynor's own account, the editor (Zonk) would do well to update his summary.
          • re:"Yup, I showed a crash. I didn't feel the need to do the do the entire hijack for two reasons:"

            One - he couldn't - Two - he needed to use the remaining 59 seconds to think of a cover-story for reason number one.
      • by bluemonq (812827) *
        Pointing out a flaw != knowing how to exploit it.

        Here's a crude analogy: scientists have known about the hole in the ozone layer around the South Pole. They know what caused the problem, the process of how the problem developed, even the chemical mechanism that perpetuates the hole - but they can't do anything to shrink it any faster than just letting it repair itself. Get my point?
    • by AchiIIe (974900) on Friday March 02, 2007 @12:30PM (#18207758)
      That is correct, the original video was faked... They prob were close but did not want to wait.
      Here is a video I made debunking their proof: http://video.google.com/videoplay?docid=1468187717 11399295&hl=en [google.com]
      My guess is that they got a buffer overflow but had not yet found the correct location in memory to write their shellcode. They still have not...
      • Re: (Score:3, Interesting)

        by raynet (51803)

        Pretty solid video. I just want to add two things. First, the IEEE page says:

        Your attention is called to the fact that the firms and numbers listed may not always be obvious in product implementation. Some manufacturers subcontract component manufacture and others include registered firms' OUIs in their products.

        And second, though not sure about Macbooks and OSX, but often you can change your MAC address, though it would be silly to change it to Apple's OUI.

        So there is a small possibility that the video

  • by 8127972 (73495)
    Apple came out with a patch that addresses this issue:

    http://news.com.com/New+Apple+patch+plugs+Wi-Fi+hi jack+flaws/2100-1002_3-6118245.html [com.com]

    The article doesn't mention if the machine he used in the demo had this patch. And if so, that may imply that the patch has holes.
  • by Anonymous Coward
    What's the point?

    (1) I would and do release immediately security faults I find. (have found some).

    (2) If someone says I did not find it or throws smut at me I'd sue - all the media running such articles which falsify my work or findings.

    So simple.

    Companies do act and correct bugs faster when security faults are released.
    • Re: (Score:1, Informative)

      by Anonymous Coward
      If I recall the facts of this particular event clearly, there was a lot of legal threat mumbo jumbo that Apple held over his head for a while.
  • by Thrudheim (910314) on Friday March 02, 2007 @12:36PM (#18207818)
    I await the promised publishing of the email exchanges with Apple on his blog. If he shows that he actually did provide Apple with details on the exploit, then he might restore some credibility. As it stands, however, his demo yesterday sounds like more of the same obfuscation that has characterized this whole incident.

    1) In the original demo, he gained command-line access to the target machine (using a third-party wireless card). The claim was made to Brian Krebs in the Washington Post that the built-in wireless was similarly vulnerable (which would be far more relevant, since all MacBooks have built-in wireless). Yesterday's demo showed a crash of the target machine. That's bad, but he still has not demonstrated a takeover of the MacBook using the built-in wireless after all this time.

    2) The fact that Apple's patch addresses the flaw that caused the crashing does not prove that Maynor engaged in responsible disclosure. Apple has said that Maynor provided them with no code or other details about the exploit, and that they did their own investigation. The investigation, according to Apple, revealed a flaw, leading to the patch. The issue is NOT whether a flaw existed. All Maynor demonstrated was that Apple's security patch works, which is really not that enlightening.
    • by Afecks (899057)
      He doesn't need to "takeover" the MacBook. Apple has already verified that the bug leads to remote code execution. Do you need a signed affidavit from Apple? Obviously if he can trigger it to crash, he can get it to do what Apple has already admitted that it can do!
      • by TPIRman (142895) on Friday March 02, 2007 @01:37PM (#18208542)
        This is the same bullshit please-connect-the-dots-for-me reasoning that Maynor has come up with all along. The question at issue is not whether there was a bug that allowed remote code execution. Yes, Apple has said as much. The question is whether Maynor had actually discovered such a bug. So far he has done nothing to dissuade objective observers that he's anything but an attention-grabbing fraud.

        Doesn't it strike you as the least bit shifty that Maynor, eager to clear his name and prove that he was right, suddenly doesn't "feel the need" to demo the hijack he originally claimed? Oh, but don't worry, he could hijack the MacBook if he really wanted to! According to Maynor, Apple has been lying and covering up through this whole ordeal, but now we are supposed to essentially take Apple's word for it that his crash demo = hijack. Please.

        Let's apply Occam's Razor here. Did Maynor fail to demo a hijack -- despite the fact that it would restore at least some his credibility -- because he thought it was just as convincing to piece together circumstantial evidence from Apple press releases? Or did he fail to demo a hijack because he can't? Are we supposed to believe that after all this time and humiliation, Maynor really doesn't "feel the need" to back up his inflammatory words? I don't buy it, and I don't see how any rational observer can.

        As the GP said, the proof is in the pudding -- all we've got here is a box that says "pudding mix, really!" and a promise from Maynor. Same as before. The guy is a charlatan.
        • Re: (Score:3, Insightful)

          by mjeffers (61490)

          Let's apply Occam's Razor here. Did Maynor fail to demo a hijack -- despite the fact that it would restore at least some his credibility -- because he thought it was just as convincing to piece together circumstantial evidence from Apple press releases? Or did he fail to demo a hijack because he can't? Are we supposed to believe that after all this time and humiliation, Maynor really doesn't "feel the need" to back up his inflammatory words? I don't buy it, and I don't see how any rational observer can.

          This

        • Re: (Score:3, Insightful)

          by Sancho (17056) *
          You really have to piece together a lot of this puzzle to understand some of the underlying issues.

          Timing is everything with wireless. An overflow which causes a crash one time may allow for remote code execution the next. It's all very tricky to get right, and there are non-driver issues that can cause problems (things like interference, which you can't control). Maynor or Cache alluded to this at one point, and it was speculated that this might have been the real reason that they did a video demo inste
        • Re: (Score:3, Interesting)

          by Afecks (899057)
          You obviously know very little about exploits. If the bug allows remote code execution, which Apple plainly states is possible, the difference in a crash and a hijack is only a matter of a few bytes of shell code. So in essence he has done the hardest part already. Then you come along and claim that since he didn't take it all the way and give you the final easiest 1%, now he's a complete fraud and a liar.

          Even if he had demonstrated the original takeover that still wouldn't prove his story. Yet you claim th
          • >Many major vendors have a known history for screwing over vulnerability researchers such as Cisco, Apple, Microsoft and others. I just have a
            >hard time believing this is any different.

            So almost a year later he comes forward, still doesn't demo what was promised the first time (and I don't even want to hear you whine about, well that's the easy part - because if it really was, he would have shown that), and you still want to think it was just the big bad corporations holding him down...

            I guess I'm jus
            • by Afecks (899057)
              So did you have anything to add or were you just going to rehash and repeat the GGP?

              Like I said, it doesn't matter what he does now. The patch is released, anyone could reverse engineer it. It doesn't add to his creditability but it doesn't remove from it either. Regardless of how you want to spin it.

              Which is the more reasonable culprit? A huge company with known problematic disclosure practices trying to keep its stock up or some guy trying to keep his pride. Both are reasonable. It's just that one has his
              • Oh, so you missed my point. Fair enough. What I was adding to the conversation was that the "reasonable culprit" side of this argument was and is nothing more than paranoid "the man keeping us down" delusion. I'm not saying that it isn't a possibility, just that jumping to it with no further information is ridiculous.
                Oh, and I wouldn't call him a "guy trying to keep his pride", I'd call him a security researcher trying to exploit the name of a corporation that is currently popular to inflate his own val
                • by Afecks (899057)
                  I'd call him a security researcher trying to exploit the name of a corporation that is currently popular to inflate his own value.

                  Apple already did that more than he could ever hope of by making such a big stink over it. It's funny how that always backfires [wikipedia.org] on people. But go ahead and make your ad hominem argument. Maybe in the future he will be wise to only disclose vulnerabilities in software owned by companies that won't pitch a hissy fit and make him famous.
                  • Obviously we disagree with how things were handled. Honestly, I think in this particular situation, Apple did well. I just don't necessarily think that all big corporations are evil by default. Maybe I just haven't been as abused by them.
                    I hope that if he does learn any lesson from this, instead it is this : Don't publicize a flaw unless you can prove it, which to date he has still failed to do.
          • by TPIRman (142895) on Friday March 02, 2007 @03:38PM (#18210364)
            If the bug allows remote code execution, which Apple plainly states is possible, the difference in a crash and a hijack is only a matter of a few bytes of shell code.

            You are buying into Maynor's fundamental misdirection here. He wants you to assume that the bug he is exploiting is the same as the bug that Apple says could allow remote code execution. But there is no evidence to support this assumption. Apple has fixed multiple AirPort bugs since 10.4.6. There is no way of knowing that Maynor is exploiting an AirPort bug that allowed a hijack rather than a crash.

            If it would only take "a few bytes of shell code" and the "easiest 1%" to make this exploit into a hijack, why not do it? His original claim was that he could hijack a MacBook, period. Now, supposedly given the chance to prove it, he just couldn't be bothered to slap together some shell code? Really? It's hard to believe that you don't find Maynor's "I can do that, I just don't feel like it" argument fishy at all.
            • Re: (Score:3, Funny)

              by Afecks (899057)
              It's hard to believe that you don't find Maynor's "I can do that, I just don't feel like it" argument fishy at all.

              What the hell are you talking about?! Whether or not he can do it is not the issue! Apple has admitted that it is possible.

              Here is TFA [apple.com] if you are too lazy to actually read it. Hell, since you like putting things in bold I'll help you out...

              Impact: Attackers on the wireless network may cause arbitrary code execution

              No no. That's not the bug Maynor was talking about, this is a diffe
              • Re: (Score:1, Interesting)

                by Anonymous Coward
                So because he says there might be a remote exploit issue, he deserves credit for any and all exploit issues found from now on, no matter what, even though he never provided proof of anything? Oh, ok.

                Say, I think there might be security problems in Windows. I now deserve credit for every single security patch ever from now on.

              • by TPIRman (142895) on Friday March 02, 2007 @05:03PM (#18211548)
                Whether or not he can do it is not the issue!

                As I said above, that is, in fact, the issue. Nobody is disputing that a remote AirPort exploit was possible; that matter has been settled by Apple. You can be as sarcastic and triumphant as you want, but I already agree that there were documented remote-exploit bugs in Apple's code. Everybody does.

                The issue here is Maynor's reputation. A responsible security researcher has to be able to back up his claims. Maynor said he could hijack a MacBook. He never provided evidence that he could. Now he says, "Look, they fixed this AirPort bug, so I was telling the truth!" But he still doesn't demo the hijack, even on an unpatched machine.

                The debate over whether there were serious AirPort bugs has been settled. But Maynor has never demonstrated that he had the goods. He has left it to insinuation and sleight-of-hand. You have bought into his misdirection, and you still haven't answered the central question: If, as you claim, a remote takeover required only a bit of shell code, why not just do it?

                (Boldface added to that last bit purely out of love.)
            • by Sancho (17056) *
              I touched on "why not just do it" in another reply.

              With timing attacks, not only do you have to get the shell code right, you also have to get the timing right, and that's mostly going to be luck unless you have control over a lot of factors.

              With a wifi timing attack, you need even more control over your environment, because stray interference can cause you to lose the opportunity to exploit and simply cause a crash.
        • by _pi-away (308135)
          Let's apply Occam's Razor here.

          Yes, let's do apply it. He announced a vulnerability in apple's (and a number of other vendors) wifi layer 2 frame handling and then demonstrated it (without releasing code). Apple, intel, and a number of other affected vendors then release patches for exactly that area of code.

          You truly feel the simplest explanation is that he was just bs'ing and then those vendors just happened to find that exact issue? Seems unlikely to me.

          Not to mention, in many cases, a crash is just a
    • I await the promised publishing of the email exchanges with Apple on his blog.

      Not happening. From TFA:

      For legal reasons, Maynor said he could not share e-mails sent from his SecureWorks address.

      In any case, I can say that Apple throws NDAs on every email they send from their bug reporting service. I don't know if it'd hold up in court, but it does make me nervous about even posting the stupid, annoying little bugs that I've reported to Apple... and it is one of the reasons why my next laptop will not be

      • I can say that Apple throws NDAs on every email they send from their bug reporting service. I don't know if it'd hold up in court

        I'd hazard a guess at "No, it wouldn't", though it doubtlessly would be an expensive/time-consuming/stressful experience to have to go through if need be. Non Disclosure AGREEMENT... I haven't agreed to anything, let alone a legally binding commitment, by sole virtue of receiving an email from Apple.

  • by dpbsmith (263124) on Friday March 02, 2007 @01:30PM (#18208460) Homepage
    Why didn't he simply show a repeat of the same thing he demonstrated before--a takeover of the machine?

    Because "a magician never repeats a trick."

  • Mistakes? (Score:3, Insightful)

    by dr.badass (25287) on Friday March 02, 2007 @09:49PM (#18214358) Homepage
    I'm still waiting for a demo of this phantom exploit on a Windows machine:

    "Maynor said the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS. Still, the presenters said they ultimately decided to run the demo against a Mac due to what Maynor called the "Mac user base aura of smugness on security."

    "We're not picking specifically on Macs here, but if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one of those users in the eye with a lit cigarette or something," Maynor said." -- Hijacking a Macbook in 60 Seconds or Less [washingtonpost.com]

    Actually, what I'm really waiting for is for Maynor to stop opening his mouth.
    • by mkiwi (585287)
      Actually, what I'm really waiting for is for Maynor to stop opening his mouth.

      And typing with his fingers/toes, possibly with his nose.

      I dunno- Apple's legal team will have to get together and see if they can get a court order to recommend his castration.

  • Good thing all MacBooks have wireless built in and there is no need to install whatever third party wireless adapter he was using.

    I don't know the history, but evidently he claims to be able to hack the built-in wireless too? Then why doesn't this video show that? For all I can tell, he setup some code that lets the too machines talk to each other. Whoopdy doo.

There's a whole WORLD in a mud puddle! -- Doug Clifford

Working...