MacBook Wi-Fi Hijack Details Finally Released

Wick3d Gam3s writes "Hacker David Maynor attempted to put the strange tale of the Macbook Wifi hack to rest, and offered an apology for mistakes made. All this and a live demo of the takeover exploit was made at a Black Hat DC event yesterday. Maynor promised to release e-mail exchanges, crash/panic logs and exploit code in an effort to clear his tarnished name. Said Maynor: 'I screwed up a bit [at last year's Black Hat in Las Vegas]. I probably shouldn't have used an Apple machine in the video demo and I definitely should not have discussed it a journalist ahead of time ... I made mistakes, I screwed up. You can blame me for a lot of things but don't say we didn't find this and give all the information to Apple.'"

Re:Just an observation.....

[donicer]

There were two demos:
One on 10.4.6 showing that it was vulnerable (crash achieved and remote code execution is possible).
The second demo showed no crash on 10.4.8 showing that the patches Apple released did indeed fix the problem he pointed to.

Re:Crash? I thought the original claim was...

[DJCacophony]

Frankly, I wouldn't even be surprised if he did some old-fashioned reverse-engineering of the patch to create the exploit for the older boxes.

And then used his time machine to go back in time to before the bug was patched and announce the exploit?
The guy informed the world about the bug, then Apple fixed it, but refused to credit him for it.

Re:I do not undestand the fuzz.

[Anonymous Coward]

If I recall the facts of this particular event clearly, there was a lot of legal threat mumbo jumbo that Apple held over his head for a while.

Re:Crash? I thought the original claim was...

[CaymanIslandCarpedie]

Not taking any sides here, but here is what he has said about this (and other issues) from his blog [blogspot.com]

I thought you said it was a hijack yet you only showed a DoS.
Yup, I showed a crash. I didn't feel the need to do the do the entire hijack for two reasons: Apple already confirmed that this vulnerability leads to remote code execution (they said so in the advisory here). Everybody that was running a sniffer during my talk now has a copy of the DoS code. The demo had two parts. I showed the crash happening on a 10.4.6 machine since it didn't have any of the airport patches. I then rebooted into 10.4.8 and the crash no longer happened. I did this to prove that the Airport patches issued on Sept 21st, 2006 fixed the problem I was demoing. The only real change to airport code was the security fixes that were issued.

You just reversed the patches and found what you then showed on stage.
I find this to be a funny argument. If I have the skills to reverse the patches and do a binary difference analysis of them, why couldn't I use those same skills to find the bugs in the first place (they weren't hard to find). This argument also doesn't take into account the fact that I showed that the first crash of the exploit occurred on Jul 15th, 2006, or emails to Apple helping them build a wifi auditing box (A linux machine with madwifi patched with LORCON) and pointed them to a vulnerability that was fixed in their patches (a problem with overly long SSIDs). The picture below is from the day I bought the Macbook, July 15th 2006. This crash occurred because I was fuzzing other devices and the Macbook crashed before I got to run the initial setup.

Re:apple can iFuck off

[Anonymous Coward]

Nice story you made up there, not the truth but nice story you made up.

Below is a link to the truth.

http://www.channelregister.co.uk/2007/03/02/maynor _apple_flaw/ [channelregister.co.uk]

Re:The important point:

[Sancho]

I was at that Black Hat talk in Vegas. They didn't do the demo--they showed a video of it. They did it this way PRECISELY because there were sniffers in the audience.