Safari/MacBook First To Fall At Pwn2Own 2011 492
recoiledsnake writes "A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple's Safari browser to win this year's Pwn2Own hacker challenge. The hijacked machine was running a fully patched version of Mac OS X (64-bit). Bekrar's winning exploit did not even crash the browser after exploitation. Within five seconds of surfing to the rigged site, he successfully launched the calculator app and wrote a file on the disk without crashing the browser. Apple has just released Safari 5.0.4 and iOS 4.3 a few minutes before the Pwn2Own contest in an attempt to save face (a last minute patch for Chrome was also released) but failed."
Never been an issue before (Score:5, Funny)
No one knows. Up until now the French have never had reason to use the word. You can't pwn someone and surrender at the same time.
Re:Hilarious (Score:2, Funny)
Time to move to Lynx on OpenBSD :-).
Re:Simple (Score:5, Funny)
The researcher who was going to go after Chrome never showed up...
So... google has the best assassins?
Re:Simple (Score:5, Funny)
I feel a disturbance (Score:4, Funny)
Re:Simple (Score:4, Funny)
At some point, you're going to have to accept that OS X just isn't that secure. It has a poor, inconsistent implementation of ASLR and DEP, Apple tends to be very slow at patching vulnerabilities, they don't prioritize security or safe coding practices, and it has absolutely nothing that compares to SELinux.
AFAIK only Fedora really uses selinux, everyone else uses AppArmor or nothing. What's sad is that Apple doesn't even have ANY capabilities-based security, not even as good as AppArmor.