MacBook Wi-Fi Hijack Details Finally Released 82
Wick3d Gam3s writes "Hacker David Maynor attempted to put the strange tale of the Macbook Wifi hack to rest, and offered an apology for mistakes made. All this and a live demo of the takeover exploit was made at a Black Hat DC event yesterday. Maynor promised to release e-mail exchanges, crash/panic logs and exploit code in an effort to clear his tarnished name. Said Maynor: 'I screwed up a bit [at last year's Black Hat in Las Vegas]. I probably shouldn't have used an Apple machine in the video demo and I definitely should not have discussed it a journalist ahead of time ... I made mistakes, I screwed up. You can blame me for a lot of things but don't say we didn't find this and give all the information to Apple.'"
Crash? I thought the original claim was... (Score:3, Insightful)
Proof in the pudding (Score:5, Insightful)
1) In the original demo, he gained command-line access to the target machine (using a third-party wireless card). The claim was made to Brian Krebs in the Washington Post that the built-in wireless was similarly vulnerable (which would be far more relevant, since all MacBooks have built-in wireless). Yesterday's demo showed a crash of the target machine. That's bad, but he still has not demonstrated a takeover of the MacBook using the built-in wireless after all this time.
2) The fact that Apple's patch addresses the flaw that caused the crashing does not prove that Maynor engaged in responsible disclosure. Apple has said that Maynor provided them with no code or other details about the exploit, and that they did their own investigation. The investigation, according to Apple, revealed a flaw, leading to the patch. The issue is NOT whether a flaw existed. All Maynor demonstrated was that Apple's security patch works, which is really not that enlightening.
Re:apple can iFuck off (Score:5, Insightful)
1) he finds a bug, but he can't quite manage to exploit it. He can crash the machine (and that's a bad thing) but it doesn't *necessarily* mean he can exploit it.
2) There's a big conference coming up, and he knows he'll get the headlines if he announces anything bad about Apple. That's just the way of the world. Dammit, he *still* can't find the exploit.
3) The deadline arrives, he can't exploit the machine, but he goes ahead and gives the demo (faking the evidence with a different machine), confident that he'll get there eventually.
4) He hides behind "legal issues" (even now, he won't reveal emails) to prevent himself from being exposed as the liar he appears to be.
This series of events is just about the worst thing a researcher can do. It's like an athlete taking steroids - there will be no forgiveness, no olive-branch will be offered; his reputation is irredeemably tarnished, because he lied for personal gain. We *need* to be able to trust people publishing exploits, and if this means his career is in ruins, I say "Hurrah!" The less people like this around in the business, the better.
I just want to also point out that I don't recall any lawyers being involved at any time in this dispute - neither party claimed lawyers were involved (he said Apple "leaned on" his employers, whatever that means, but lawyers were never mentioned.)
Apple claim he released insufficient technical details to them to help them in their investigation, so they had to go to the trouble of doing a full internal audit of a large source tree (and all the time, he's spreading disinformation and tarnishing their name). They find and fix some bugs, and now he's in an even worse position - his crash "exploit" won't work.
So, now, he releases the "details" - he's given up trying to exploit the original OS, and brushes that small point aside in the "details". He tries to save as much face as possible instead of admitting he was just plain wrong - he's basically covering his ass. Does anyone else think "details" ought to actually show the information he claimed to have (like being able to take control of a Mac in 60 seconds) ?
In science, there are two fundamental maxims
1) Don't falsify the data.
2) Extraordinary claims require extraordinary evidence. (*)
He failed, on both of these, as far as the world can tell.
(*) "Extraordinary" here means in the technical sense - the first exploit of any kind requires unequivocal proof. I don't care if it's OSX, Windows XP, or Linux - show the data. Prove the case. Don't wave your hands around and babble.
Simon.
Re:Proof in the pudding (Score:5, Insightful)
Doesn't it strike you as the least bit shifty that Maynor, eager to clear his name and prove that he was right, suddenly doesn't "feel the need" to demo the hijack he originally claimed? Oh, but don't worry, he could hijack the MacBook if he really wanted to! According to Maynor, Apple has been lying and covering up through this whole ordeal, but now we are supposed to essentially take Apple's word for it that his crash demo = hijack. Please.
Let's apply Occam's Razor here. Did Maynor fail to demo a hijack -- despite the fact that it would restore at least some his credibility -- because he thought it was just as convincing to piece together circumstantial evidence from Apple press releases? Or did he fail to demo a hijack because he can't? Are we supposed to believe that after all this time and humiliation, Maynor really doesn't "feel the need" to back up his inflammatory words? I don't buy it, and I don't see how any rational observer can.
As the GP said, the proof is in the pudding -- all we've got here is a box that says "pudding mix, really!" and a promise from Maynor. Same as before. The guy is a charlatan.
Re:The important point: (Score:4, Insightful)
No, Apple said it could be used to run arbitrary code with system privileges.
Just like I could step outside my door and find $10,000 rolled up in a neat little ball. Doesn't mean it is likely to happen, but it could.
Theory and practice are two completely different things.
Re:The important point: (Score:3, Insightful)
So he just demoed (and thus released) the DoS, not the root exploit - which he DID have the code to perform but didn't want to release (by demoing).
From someone who already threw out their credibility, that really doesn't inspire confidence.
Re:Proof in the pudding (Score:3, Insightful)
This is really the key point. To believe Maynor at this point you need to believe that someone who is concerned about repairing a tarnished reputation is so worried about people figuring out how he could exploit an already patched vulnerability that he decides to only show the crash rather than the take-over exploit. Maynor has a bone to pick with Apple/Apple users and managed to find a bug he couldn't find last year with the help of Apple's patch notes.
If you need a security consultant to analyze your patch notes and find known vulnerabilities he's your man. Otherwise, he's a joke.
Re:apple can iFuck off (Score:5, Insightful)
There is still no public supporting evidence for his clams -- he hasn't even posted his personal correspondence with Apple yet, something he'd been free to do since day one.
Maybe he'll get around to it someday... who knows. But for now it's still just a lot of words with no support.
Re:Proof in the pudding (Score:3, Insightful)
Timing is everything with wireless. An overflow which causes a crash one time may allow for remote code execution the next. It's all very tricky to get right, and there are non-driver issues that can cause problems (things like interference, which you can't control). Maynor or Cache alluded to this at one point, and it was speculated that this might have been the real reason that they did a video demo instead of a live one--a live exploit demo which fails (but crashes the system) 6 times before it succeeds isn't all that impressive.
So there were very similar (nearly identical) bugs in other vendor's drivers. FreeBSD had patched their version of the bug in January 2006. It was a similar exploit in a similar driver for similar hardware. It's far from a stretch to assume that he noticed his Macbook crash when he got it (he claims he was fuzzing other devices at the time here: http://erratasec.blogspot.com/2007/03/apple-infoa
Now it all gets pretty fuzzy around the time that they claim to be using 3rd party hardware. Why do that? Why does the video clearly show the Apple interface with an Apple MAC if they were using a 3rd party card?
If we assume that he's lying, the video shows all of this because it was rigged. If we assume that he's telling the truth, then that is just more evidence to the "Apple coverup".
The point of all of this, though, is that I think there's a certain amount of plausibility to all of this. I don't think that the situation I outlined above is a stretch. I do think that if it even remotely resembles the reality of the situation, then Maynor and Cache were exaggerating their own skills in determining the exploit. There was a pretty big inference by everyone at Blackhat that Maynor and Cache had discovered and engineered the exploit alone, not that it was based upon a pre-existing exploit for another OS. If they didn't intentionally imply that...well, then it sucks to be them, but their credibility takes a bit of a hit for it.
Oh, and the timing issue I mentioned above? Could well be why he only demoed a crash instead of a full exploit this time. He's got Apple's word that remote code execution is possible, and he's shown that he can cause the crash. Who knows how many takes their video took to get right? With a live demo, you really only get one shot.
Re:apple can iFuck off (Score:3, Insightful)
Not at all. Though it does bother me that someone is willing to call something truth when there is still no evidence made public to substantiate it.
And regardless of how reputable The Register is, the article provides no information that support the reporter's conclusions. And until Maynor publishes those emails, there won't be any. He's already posted two updates to the blog since his presentation, including one that pertains to why he can't release his old work emails, but he hasn't yet made the personal ones available (nor has he even claimed that his old company won't allow him to release the old emails, just that they aren't his property and that releasing them without permission could be bad -- has he even asked for permission?).
Cases like this call for as much disclosure as is possible, and he hasn't come close to that yet. It's still a bunch of "oh, I plan to do this" and "oh, I could do that" with no backup. Either provide all of the info that you can, or shut up. That's all that's been asked since day one.
Re:Crash? I thought the original claim was... (Score:4, Insightful)
The fact that he will only demonstrate a crasher just seals the deal that he's full of shit. If he's had a working AirPort exploit for all this time, why not just demo it and put this issue to rest? That's what any sane person would do. But instead he's carefully misrepresenting Apple's release notes to make them seem as if they support his claim, further destroying his credibility.
I think the most likely scenario here is that he originally found exploits for various third-party wireless drivers and saw an opportunity. With a cursory look at the AirPort drivers, he figured, "Yeah, I could write an exploit for them too". So he made a big announcement. He hated the "smug" Mac users, so now he could really stick it to them. But there was a problem. For whatever reason, he couldn't get his code to inject into the AirPort drivers. All he could do was KP the box. Well this wasn't what he initially promised. So when it came time to put-up or shut-up, he used a third-party card with drivers that he had been able to exploit. And of course, he knew that people would ask questions. Questions like, "Who cares? That card doesn't ship with Macs, and Macs have built-in wireless, so why would any Mac user ever need to buy this card?"
Ah, but clever him. He knew that Apple had a reputation for being secretive and releasing the legal hounds. So he could just say, "Apple threatened me with legal action if I demoed the exploit on their drivers" and voila! He's now a victim of The Evil Corporation! The Slashdot crowd would definitely believe him. After all, geeks don't like Apple because they're secretive, and this would be just another validation for them. They'd buy it without question. Even if Apple issued a statement saying that Maynor was lying, that wouldn't matter, because Apple is the one who tried to muzzle Maynor in the first place! See how the logic goes round and round?
Re:Proof in the pudding (Score:5, Insightful)
You are buying into Maynor's fundamental misdirection here. He wants you to assume that the bug he is exploiting is the same as the bug that Apple says could allow remote code execution. But there is no evidence to support this assumption. Apple has fixed multiple AirPort bugs since 10.4.6. There is no way of knowing that Maynor is exploiting an AirPort bug that allowed a hijack rather than a crash.
If it would only take "a few bytes of shell code" and the "easiest 1%" to make this exploit into a hijack, why not do it? His original claim was that he could hijack a MacBook, period. Now, supposedly given the chance to prove it, he just couldn't be bothered to slap together some shell code? Really? It's hard to believe that you don't find Maynor's "I can do that, I just don't feel like it" argument fishy at all.
Re:Yes it does! (Score:4, Insightful)
I refer the honourable gentleman to the reply I gave some moments ago - if he can do it, he ought to do it. Until he does it, I don't believe he can do it.
So, here's your example: the exact "exploit" he's claiming to be able to perform.
No, it's not. Which is why I used "in the technical sense" in the original comment. "Extraordinary" means "out-of-the-ordinary" - the claim is not run-of-the-mill, it's the first remote exploit of an Apple laptop. The proof should also be bulletproof (actually, right now I'd settle for just proof, not incontrovertible evidence!) At the moment, all we have is a load of hot air and bluster.
Simon.
Re:Proof in the pudding (Score:5, Insightful)
As I said above, that is, in fact, the issue. Nobody is disputing that a remote AirPort exploit was possible; that matter has been settled by Apple. You can be as sarcastic and triumphant as you want, but I already agree that there were documented remote-exploit bugs in Apple's code. Everybody does.
The issue here is Maynor's reputation. A responsible security researcher has to be able to back up his claims. Maynor said he could hijack a MacBook. He never provided evidence that he could. Now he says, "Look, they fixed this AirPort bug, so I was telling the truth!" But he still doesn't demo the hijack, even on an unpatched machine.
The debate over whether there were serious AirPort bugs has been settled. But Maynor has never demonstrated that he had the goods. He has left it to insinuation and sleight-of-hand. You have bought into his misdirection, and you still haven't answered the central question: If, as you claim, a remote takeover required only a bit of shell code, why not just do it?
(Boldface added to that last bit purely out of love.)
Mistakes? (Score:3, Insightful)
"Maynor said the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS. Still, the presenters said they ultimately decided to run the demo against a Mac due to what Maynor called the "Mac user base aura of smugness on security."
"We're not picking specifically on Macs here, but if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one of those users in the eye with a lit cigarette or something," Maynor said." -- Hijacking a Macbook in 60 Seconds or Less [washingtonpost.com]
Actually, what I'm really waiting for is for Maynor to stop opening his mouth.