U of Wisconsin's Mac OS X Security Challenge 401
digitalsurgeon writes "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet
Prove it! (Score:5, Funny)
So guys, what do you say? Should we all mabye prove ZDNet wrong by not breaking into that computer?
Re:Prove it! (Score:5, Funny)
Re:Prove it! (Score:5, Funny)
So to anyone wanting to compete in this challenge: sorry.
Re:Prove it! (Score:3, Informative)
The new RTFA: Before complaining of a site being slashdotted, check to see if it's actually... you know... slashdotted.
'cause it's not. It's chugging away nicely.
Go OS X, Apache, and hogging your university's network resources!
Re:This whole thing is bogus. (Score:3, Informative)
You must work for that Eweek rag, you appear to follow the same brand of FUD-spreading methodology, involving outright lies...
Easy, To Do (Score:5, Funny)
Re:Easy, To Do (Score:5, Funny)
Re:Prove it! (Score:5, Funny)
Why don't we just do what Slashdot does best, and DDoS the thing instead? The way I see it, that's the best way to protect it from being hacked in the first place.
A Different Test (Score:5, Informative)
This test is of the web server, and of remote cracking without local access. Also, the explanation page says that the original article did not mention that local access was given. Well, perhaps they've updated the article, but it certainly says so now:
As I said, I appreciate this test, but I am also concerned about the apparent ability of an ordinary local user to gain admin status.Re:A Different Test (Score:3, Insightful)
Re:A Different Test (Score:5, Informative)
Re:A Different Test (Score:3)
Still no comparison (Score:5, Insightful)
True, but this test still does not compare to what hosting companies are doing. Web hosting companies are (hopefully) run by professionals who secure the boxes. Web hosting companies run operating systems like RHEL that were designed for server use--Mac OS X on a Mac Mini was designed for home use.
Most importantly though, hosting companies are not giving ssh to any anonymous joe off the street, which is exactly what happened in this contest. At a minimum, web hosting companies have your credit card number before they offer you ssh. Some will demand additional information, such as a faxed copy of a driver's license. Of course a crook can get a drivers' license and a stolen credit card, but these are additional hoops to jump through that make the process of cracking the machine that much more trouble. Plus, if someone does crack the machine despite his lack of anonymity, the hosting company might be able to track him down.
This contest as reported on ZDNet was a joke. The guy gave ssh accounts to anyone who asked for them, without demanding any proof of identification. He ran it on an OS that was not designed to be run with untrusted users logged in. Furthermore, the crack was done by an anonymous person using an "undocumented" security hole, which to me calls the credibility of the whole episode into question. In what real-world situtation does anyone allow ssh login to any random, anonymous Joe?
Re:Still no comparison (Score:4, Informative)
The fact is *all* security gaps are important. If there's a network hack that can only get you a non-priviledged account, but you can then jack that up to root access using this local hole, then that hole was mighty significant. This whole "Mac has no security faults" meme is dangerously delusional. It's significantly more secure than Win32, but at least own up to faults (small as they may be) and get them fixed, don't bury your heads in the sand.
Re:Still no comparison (Score:3, Insightful)
Have you read the page at http://test.doit.wisc.edu/ [wisc.edu] ?
He does
Re:A Different Test (Score:5, Insightful)
The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.
But how often do you allow someone into your machine? For A desktop, not often, perhaps never.
The biggest risk to most computers is a network based attack; this is the real meat and potatoes and a better test of the security of a machine.
Re:A Different Test (Score:5, Insightful)
I don't think that analogy is quite apt. It's more like locking someone in your basement and they figure out how to gain access to your whole house.
When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.
Right now we have only this one supposed demonstration of it. What I'd really appreciate seeing is that *original* test repeated. If we can look at this as if it were an experiment, then when someone publishes a result others try to repeat it under the same conditions. They don't conduct a different test with different conditions in order to disprove the original.
Re:A Different Test (Score:5, Funny)
Science never enters the picture here, this is a religious debate.
Much better analogy! (Score:5, Interesting)
Okay- I like that analogy better. I've got deep deadbolts on my outside doors; the door between my basement and house has a cheap handle lock that can be popped with a long, thin screw driver.
Not to get lost in the analogy details, but I think you'll find most security skews the same way.
When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.
I think this ability to elevate privs should be analyzed on a case by case basis for all programs; as such if you are concerned about what applications a user can and can't run, remove the ability to run those applications from the machine.
However with most desktop machines your biggest worry isn't normally* an attack from within; its usually from without.
*)people on slashdot aren't normal and typically have needs that extended beyond normal users. Feel free to contribute some examples that counter this assertion.
try it for Windows or Linux...Re:A Different Test (Score:3, Insightful)
What I'd like to see is that same test repeated for Windows, and maybe even Linux and Solaris... and OpenBSD. Now *that* would be interesting.
Re:try it for Windows or Linux...Re:A Different Te (Score:3, Interesting)
Paradise Pete: How could you infer that from what I wrote? I never once mentioned any other OS.
Precisely, you never mentioned any other OS with regards to privilege escalation attacks... and you'll notice I was really just _asking_ if you were trying to imply something about another OS, so actually, I didn't infer it as much as I wondered if you meant to infer it.
I have little do
Re:A Different Test (Score:3, Interesting)
But for a server, all the time. If you're considering a timesharing system, there may be thousands of users. The central ITS computers at every university I've been to (the ones you SSH to, and run Pine to check your email) have thousands of user accounts. Everyone at the school has one. (An older book, but still a good read about the important of priviledge escalation bugs - look for "The Cukoo's Egg")
Now y
Re:A Different Test (Score:3, Interesting)
Ok, let's look analogy given :
And as a reminder, the test allowed users into the box, and they then had to escalate their priviledges in order to alter the contents of the web site.
Specific problems with the analogy?
Re:A Different Test (Score:5, Informative)
And the whole point isn't that the test "isn't the same". This is how most Mac OS X machines will appear to outside entities on the internet. The original article - and definitely before it was updated - left people with the impression that a Mac OS X machine could be owned in 30 minutes just by being connected to the internet, without the user "doing" anything, and the subsequent coverage of this in most press proves it. None speak to the fact that a local account was given, or even explore the implications. What could have been a useful article was useless, vague sensationalism. I updated the bottom of the page this morning:
Update
The ZDnet article has been updated to include the sentence, "Participants were given local client access to the target computer and invited to try their luck." But might it not have been interesting to explore:
- What are the implications of local account access, and under what conditions might a computer be used in that way?
- How can such access normally be obtained? Do home users behind firewalls and with no ports open need to worry?
How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue?
- What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in products, like the "hacker" they interviewed, and actively choosing to NOT give the vendor an opportunity to fix the problem(s)?
- How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?
- A discussion about how since much of OS X is closed, this might make it more difficult for the community to discover - and report and fix - potential vulnerabilities in the closed pieces
...and things of that nature, instead of leaving people with the impression that any Mac OS X machine connected to the Internet can be taken over in 30 minutes?
Re:A Different Test (Score:5, Insightful)
Re:A Different Test (Score:3, Interesting)
Not to be an ass, but there are 100s of open accounts all of the internet with TS enabled and client and guest logins allowed for companies to showcase their software.
This is one of the things people actually do with TS is use it for software demonstration purposes, and people are 'encouraged' and 'allowed' to sign into Windows 2003 servers to test software or
Re:A Different Test (Score:3, Interesting)
This test was spun in such a way to make it appear that someone could merely put their machine on the Net and
Re:A Different Test (Score:3, Interesting)
How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue?
The answer to the first question is pretty easy. Local access can be gained by the cleaning crew in most buildings, by students in others, and don't forget your friendly neighborhood coworkders. The answer to the second question is just as easy. Spouse, kids, kids friends.
I don't hav
Re:A Different Test (Score:3, Interesting)
Whilst I agree with you that the original article was a typical zdnet troll attempting to stir the angry mac masses into page views, your statement: left people with the impression that a Mac OS X machine could be owned in 30 minutes just by being connected to the internet, without the user "doing" anything, is not really true if you read the whole article.
For instance, the original article contained the line:
Re:A Different Test (Score:5, Interesting)
Mac OS X is not invulnerable. It, like any other operating system, has security deficiencies in various aspects of the software. Some are technical in nature, and others lend themselves to social engineering trickery. However, the general architecture and design philosophy of Mac OS X, in addition to usage of open source components for most network-accessible services that receive intense peer scrutiny from the community, make Mac OS X a very secure operating system. There have been serious vulnerabilities in Mac OS X that could be taken advantage of; however, most Mac OS X "vulnerabilities" to date have relied on typical trojan social engineering tactics, not genuine vulnerabilities. The recent Safari vulnerability was promptly addressed by Apple, as are any exploits reported to Apple. Apple does a fairly good job with regard to security, and has greatly improved its reporting processes after pressure from institutional Mac OS X users: Apple is responsive to security concerns with Mac OS X, which is one of the most important pieces of the security picture.
The "Mac OS X hacked under 30 minutes" story doesn't mention that local access was granted to the system. While local privilege escalation exploits can certainly be dangerous - and used in conjunction with things like the above Safari exploit - this isn't very informative with regard to the general security of a Mac OS X machine sitting on the Internet.
Of course, I'd have no problem with this if the original article had actually talked about it meaningfully in the context of a local privilege escalation and explored the implications; instead, they just made it sound like you could throw a patched OS X box onto the internet and it'd get owned. The average reader would leave with that *distinct* impression, and most of the subsequent coverage of it talked about it exactly in that fashion.
Mac OS X has had several local privilege escalation vulnerabilities, just as other OSes have had. Apple fixes them when they become known. (Also, and this is another discussion, but what can Apple do if the "hacker's" claims are correct, i.e., that the vulnerability is unknown to Apple? It doesn't prove that Mac OS X is "insecure"; all it "proves" is that open scrutiny is difficult with closed source pieces, and that some people intentionally and knowingly refuse to give vendors a chance to fix problems.)
Re:A Different Test (Score:3, Insightful)
Let me just say, thank you. All these trolls seem to think it's perfectly natural that you'd let hundreds of anonymous users into your system, who's only purpose in life is to compromise one of the hundreds of software packages installed in an attempt to gain higher priviledges. That's just ridiculous. Mac OS X is a desktop system. It is configured as such, and is bound to have problems that could be exploited by a sharp hum
Original Test Was More Interesting (Score:5, Interesting)
If the original hacker Gwerdna (Andrew G?) was right that there are many undisclosed priviledge escalation bugs, that is a case for concern, not something to be dismissed as a mere "local" vulnerability. BSD, Linux and even Windows already have patches for NX [wikipedia.org] to contain buffer offerflows, where is Apple on this?
I think that, especially if you're an Apple user, it is very important to test the claim that the OS is rifle with local priviledge escalation issues. And that's why I think the first test was much better than this one. I don't expect this U of W box to be hacked anytime soon. But this proves very little. You can even setup a Windows SP2 ISS+Remote Desktop box like this, and I don't think it will be hacked anytime soon either. But if you redo something like the original box (give normal user ssh accounts to anyone) and get hacked very quickly again, it proofs a lot. Namely that the local security measures of OS X that many have come to thrust amount to very little.
Re:Original Test Was More Interesting (Score:3, Informative)
According to what I've been able to glean from Apple's developer resources (available at developer.apple.com), and from various articles about the new Intel-based Macs, the Macs with x86 processors all have chips that support the NX bit, and the NX bit is turned on by default. There is supposedly a work-around to allow you to compile a specific application without the NX bit set, so that the app can
Re:A Different Test (Score:5, Interesting)
The point is even with proper design of user separation, local security is hard to get right. Every OS has this problem, to various degrees. And if you want a sample of what this type of problems mean, here is one: malware will not be required to ask you for a password to elevate privileges - see? all those 'this is not a virus, it asks for your password and that should set your alarm bells going' argument goes puff! in smoke. This is the same type of issue that plagued non-administrator users in Windows for a long time now. So let me put it this way:
So, to come back - your test is utterly irrelevant for the type of people that would be interested in the original one. What you are trying to test is the security of the OpenSSH and Apache installs + your setup (yeah, and password strength - expect to be hit by automated dictionary attacks from scripts that couldn't care less about your test). If I had an XServe machine with several users having ssh access I would really want to know whether any of those users really can get root on the machine or not (if they can, XServe has no place in such enviroment). And I would be really worried. As it stands, I still have worries, but at least I know that I have a certain amount of protections in place against such problems (this not being OSX though - no OS names since I'm not interested in 'my OS is more secure than your OS' flames) But this is a real security concern and yet you turn around and say 'but these other things are secure.' Yeah, the article could have sounded misleading for anyone not willing to check the site and see the conditions (but few people would do that anyway) but how are you any better? All this is countering journalistic sensationalism with more of the same, since your box is neither set up as a home user's nor your setting is pertinent to the original multiuser problem.
To toss in my 2c of an analogy - the original test was to check whether a bank's employees (with access to the bank building) can empty the main safe to which they do not have the combination[*] while yours is to check whether a customer can; all this on a Sunday when the bank is closed.
And now mods feel free to mod me down - although a more rational answer would be welcome.
[*] to all those saying 'by dfault root is not even enabled in OSX': bah! 'enabled' pertains to login and privilege escalation couldn't care less about login restrictions; the account is still there. And in fact, the thing that 'get root' means is 'get uid=0 access'
Re:A Different Test (Score:3, Informative)
The point of the original test was not to hack the machine from outside, but from inside.
True and it confirmed what most everyone already knew, a mediocre cracker can find a local escalation. There is no problem with the original test. There is a problem with the way the media misleadingly depicted the original test. This second test is designed to help debunk some of the FUD generated by the poor media coverage, by replicating the situation they misleading led readers to believe were the conditions of
Why Dave Schroeder is wrong (and MSFT is right!) (Score:3, Insightful)
It's certainly true that the original ZDNet article was sensationalist and overly alarmist about the implications for Mac security. But by implying that the original contest is irrelevent for a typical Mac user and that his test will prove that Macs are secure, Dave Schroeder is being equally, if not more, misleading.
The original test showed that Macs are vulnernable to local privlege escalation. It is true that most Mac desktops users are not offering accounts to external users. But a great many of the a
Re:A Different Test (Score:5, Insightful)
The problem is that the media presents the original test as though Mac OSX is insecure out of the box. It's very misleading.
An acquaintance of mine runs a small web hosting company. His original service plan offered SSH accounts to every hosting account. Despite his best efforts to secure the box, it was still rooted by a script kiddie.
His customer's PC was compromised and the ssh password for his account on the linux server was found by the script kiddie. The shell account had access to GCC. The script kiddie logged in as the non privileged user and used gcc to compile a rootkit. The rest was a walk in the park.
The OS was Slackware linux. All of the accounts were jailed, and all of the "best practice" measures were taken to harden the box (I can't comment on every detail as I am not a linux system admin).
My point is that when a malicious user gains shell access to any *nix system, you're in deep trouble.
My friend has since stopped offering SSH access to his customers.No, you're still wrong about the REAL problem (Score:5, Informative)
In fact, Bruce Schneier [schneier.com] (a respected cryptographer, responsible for Blowfish) addressed the topic thoroughly almost 8 years ago in his column Crypto-Gram. Here's a relevant snippet:
You see them all the time: "Company X offers $1,000,000 to anyone who can break through their firewall/crack their algorithm/make a fraudulent transaction using their protocol/do whatever." These are cracking contests, and they're supposed to show how strong and secure the target of the contests are. The logic goes something like this: We offered a prize to break the target, and no one did. This means that the target is secure.
It doesn't.
Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic reasons why this is so.
You can read the original here [schneier.com].
Re:No, you're still wrong about the REAL problem (Score:3, Interesting)
1) Confirm that your hack/exploit really works, but DON'T CHANGE ANYTHING
2) Wait until the contest ends and the system is declared "uhackable"
3) Wait a bit longer until the "unhackable" sytem is adopted by a bunch of big businesses
4) Make a lot more than the original prize fee by pillaging the "unhackable" systems.
oh.... I suppose it should have read
4) Profit!
And yet companies do it (Score:3, Interesting)
Re:A Different Test (Score:3, Insightful)
Well no, obviously he missed something. It was a walk in the park because he left some well-known vulnerability on his system, possibly in the kernel. I don't think Slackware blows off local vulnerabilities and doesn't bother releasing fixes.
Re:A Different Test (Score:5, Interesting)
No, they weren't. If all the filesystems that customers have write access to are mounted "noexec", then self-compiled binaries don't present a lot of exposure.
I'm not saying that it's not a good idea to remove GCC, just that its presence isn't an automatic compromise.
Re:A Different Test (Score:3, Funny)
Re:A Different Test (Score:3, Interesting)
Re:A Different Test (Score:3, Insightful)
It is entirely possible that one of the pieces of software installed by fink had a root exploit, perhaps using SETUID.
Fink should not be installed on production systems.
Hackorama Windows (Score:3, Insightful)
Re:Hackorama Windows (Score:2, Funny)
A competition to crack a win 2k3pro server isn't a competition, that's a free-for-all.
Re:Hackorama Windows (Score:3, Informative)
Re:Hackorama Windows (Score:3, Informative)
1) Windows XP Home
2) Windows XP Professional
3) Windows Server 2003
Re:Hackorama Windows (Score:3, Interesting)
win2k was a completely different story. i did this test with that and people were in by the end of the day.
Logs (Score:5, Insightful)
Re:Logs (Score:2)
A hybrid solution would be a summary of the logs and perhaps a popularity percentage and other "smart" metrics.
Re:Logs (Score:3, Interesting)
Or perhaps just published after the challenge.
Kinda funny (Score:2)
* yawn * (Score:5, Insightful)
It proves neither: every operating system on the face of this earth has been hacked, cracked, and 0wned. Numerous times. Get over it.
Instead of inane, immature competitions such as this one, I'd rather have a nice manual (RTNM -- Read The Nice Manual) on how to improve/lock down an OS X machine. Even better, make that two manuals: one for the average joe, with nice color screenshots for every step that has to be taken, and another for people like me, who manage systems for a living. THAT would be a valuable contribution to the field of computer security, instead of this stupid challenge.
Re:* yawn * (Score:5, Informative)
Re:* yawn * (Score:2)
1. There is no step 1.
SSH and everything else is off by default and the average user won't enable them, probably won't even know how to enable them.
Re:* yawn * (Score:2)
"Instead of inane, immature competitions such as this one, I'd rather have a nice manual (RTNM -- Read The Nice Manual) on how to improve/lock down an OS X machine."
You can start by not giving out shell accounts to users who are trying to root the box ;)
Your wish has been granted: (Score:5, Informative)
NSA - Mac OS X Security Configuration Guide (not yet updated for Mac OS X 10.4) [nsa.gov]
Apple - Common Criteria configuration guide [apple.com]
And for the "average joe"?
- Keep your machine patched
- Don't randomly open ports for services you don't use
- Have a personal firewall/router
- Don't run software you don't trust
And this doesn't "prove" anything, except that the initial ZDnet article was totally vague and sensationalistic, making it seem to an average person reading that article that a Mac OS X box could just be "hacked" by being on the internet. That is wrong, and I'm showing that. Simple. It's all explained on http://test.doit.wisc.edu/ [wisc.edu]
Re:Your wish has been granted: (Score:4, Insightful)
Re:Your wish has been granted: (Score:3, Informative)
2) Everything is closed by default
3) Not as important with (2) true
4) This is the big one you'll never get around. People are stupid
Re:Our tax dollars at work (Score:5, Interesting)
Also, I can't say I've *ever* gotten a "freebie" anything from Apple in 22 years other than a couple of T-shirts. Oh, and a nice pen once. I've also never heard of anyone in enterprise or education getting free flat panels and iPods from Apple (except for the free iPod promotions they've had when people buy certain laptops).
Also, since Mac OS X is used *heavily* in education, particularly at large research universities, and diversity of computing platforms is important to avail faculty, staff, and students of the best resources to do their jobs, I'm sure many are interested in the general security of a typical Mac OS X machine with a couple of typical services running on the internet, especially in the wake of such misleading press coverage of the same. The only interests I represent are those of the University of Wisconsin - Madison.
And yes, this challenge is sanctioned. I'm glad that the University of Wisconsin supports the genuine interests of its faculty, staff, and students, and encourages individual thought, research, discovery, and exploration. That's why it's a great place to be!
Re:* yawn * (Score:2)
http://www.corsaire.com/white-papers/050819-secur
Possible Danger (Score:5, Insightful)
With virus/spyware becoming a multimillion dollar business, do you really think that the real hackers (sorry for the use of the term) will stay away from this, due to the this very condition. Do you think that the dangerous exploits and cracks that are, for the moment, unknown by Apple, and are hence, very valuable. They will not be willingly sent to Apple for some minor publicity and no material, no, they will be auctioned off in some sleazy IRC channel in Russia.
the original post (Score:3, Insightful)
Re:the original post (Score:5, Informative)
There is an identical clone of that Mac mini waiting to go on the new network, and our DNS TTL is currently set to 5 minutes, so when the cutover happens, it should be pretty transparent.
Does /. win... (Score:3, Funny)
Generic smear campaign (Score:5, Interesting)
So far each article has been based on unique situations that lack credibility to begin with, give little detail, and take focus away from the fact that it's basically a machine running a collective of industry proven software (such as apache and openssh.)
Also of note is that Mac OSX currently has an a user base of over 10 million machines. So the argument that it's too small a target is ridiculous. In fact it's a bigger target as it's untouched territory with a bonus of headline making news.
CNet (Score:3, Insightful)
I'm still subscribed to some of their newsletters, where they email me about what this or that person has "blogged" on their site recently. I guess if you call it blogging then you don't have to do any journalism, but they'll have two people playing off both sid
Hacked Pixel #F0F8FF (Score:4, Funny)
In fact, nobody even noticed.
I'm not sure what the value of this is..... (Score:2)
Re:I'm not sure what the value of this is..... (Score:2)
Re:I'm not sure what the value of this is..... (Score:5, Insightful)
The ZDnet article simply was not reported correctly, and gave the wrong implications. Even with the added sentence, the article tries to make it sound like its vulnerable to remote exploits and you have to be worried about having your machine on the internet.
over 15 posts! (Score:2, Funny)
http://apple.slashdot.org/article.pl?sid=06/03/06
That.. must be a record.
incidentally the original post seems to reflect a more updated view
The IP (Score:4, Informative)
128.104.16.150
Re:The IP (Score:3, Funny)
Hack away...
Hint (Score:5, Informative)
So run that against a dictionary and see if you can get in....
Server Version - What would be my favorite vector (Score:4, Interesting)
*) SECURITY: core: If a request contains both Transfer-Encoding and
Content-Length headers, remove the Content-Length, mitigating some
HTTP Request Splitting/Spoofing attacks. This has no impact on
mod_proxy_http, yet affects any module which supports chunked
encoding yet fails to prefer T-E: chunked over the Content-Length
purported value. [Paul Querna, Joe Orton]
Doubtful... (Score:4, Funny)
So... Anyone up for breaking into the U of Wisc password database?
Re:Doubtful... (Score:4, Informative)
(And for those wondering, the NetID/username is the non-private part of our NetID credential.)
Also, I'd hope that one would also understand that going after other machines in that way is bad form, and doesn't speak to Mac OS X's security (or insecurity), but rather to the practice of having strong/different passwords across multiple secure systems.
Re:Doubtful... (Score:4, Funny)
Why try brute force when you can pull a social engineering attempt:
Daer DAvid Schroeoedir,
I am A NIGERIAN PRINCE WHO HACE RECENTLY MOVED TO WISCONCIIN And AM Vary INTERISTED IN OBtaining AN ACCOUINT ON TEST.DOIT.WISC.EDU...i CUULD WIRE YUO 1 MILLION DOLLARS...
Re:Hint (Score:3, Funny)
Long live Vindows!
Re:Hint (Score:4, Funny)
Here's MY CHALLENGE! (Score:2)
Come on, I dare you, come on I say and try to hack my G4 desktop running OS X 10.4.5 with Security Update 2006-001. It has FTP, SSH, Finger, Apache, PHP, VB running under WINE, and the extremely vulnerable Robots game running.
Oh! Had enough, eh? Come back and take what's coming to you, you yellow bastards! Come back here and take what's coming to you! I'll bite your le
Do over! (Score:2)
Contest? Pffft..... (Score:2, Redundant)
Contest closes March 10? (Score:3, Interesting)
If this was a legit challenge, then don't close the challenge. Leave it open, so that when you least suspect it, someone has hacked your site.
But is this challenge stating the security of OSX? Defacing a website is the same as having a Trojan virus installed that wipes out your applications or formats your system? Why not offer a challenge to find out if someone can write a virus that will adversely affect OSX. The delivery is unimportant, as long as there are people happily downloading apps from P2P, opening email attachments, and downloading security updates from email warnings. No OS is truly secure from human ignorance.
I guarantee that some hacker will deface the website, but I question the legitimacy of imposing a time limit on the challenge. Certainly hackers don't have a time limit when they corrupt Linux or Windows based website servers, so why impose one for Mac. I think someone is closely monitoring the challenge website, ready to counter any possibility of it being hacked in order to solidify the OSX security myth.
How unfair! (Score:4, Funny)
Fink could have contributed to the original "hack" (Score:5, Insightful)
One of the unusual things about the "hacked" machine was that Fink was installed. This most likely means that the Apple developer tools were installed (although Fink can install precompiled binaries), making it possible for the hacker to bring his own code and compile on the system. Although Apple ships the developer tools on the OS X client install DVD, it is not installed by default, nor is X11.
Fink lists a catalog of 6359 open source projects [finkproject.org]that can be installed, many of which are tools that could help a hacker exploit a machine or that are exploitable in themselves. Fink is a Debian style package manager for Mac OS X.
A more "real-world" test? (Score:3, Interesting)
I would prefer to see test break-in attempts set up like this:
an unprivileged "test account" is created on OS X and set up with email, web browser, and other common desktop programs
the "test account" is set up with several common methods of communicating with the outside world: email, IM, commonly-browsed web sites, webmail, banking sites, etc
the test account's email address and IM account are made public to the would-be attackers
someone regularly checks the test account's email and acts like a "gullible user" would, eg click on spam and phishing links, go to hostile web sites, follow dubious instructions received via IM from supposed friends
the challenge: attacker must be able to do something "bad": control box resources (think spyware), steal critical system information (think remote root), get bank account information (think phishing), whatever
A few years ago, this was trivial on Windows. I hear they've cleaned up their act to some extent. How well would OS X hold up? How about a standard desktop version of Linux?
Data General used to Boast (Score:4, Interesting)
Then IBM bought Data General and that was the last we heard of DG/UX B2 Secure. Pity really. They should have ditched AIX instead. But I digress...
OSX is pretty damn secure right out of the box, but Apple could do more to make it tighter by default. They've already managed the security versus usability balance far better than Microsoft has managed so far. I think Apple could push a little more over to the security side of the thing without noticably affecting usability. I also think that Apple users would accept slightly less user friendly systems in order to continue to walk around with that air of I-can't-get-spyware-or-virusses smugness that no Windows user will ever understand until they've seriously used an Apple machine for a few days. Apple's selling more than a machine. They're selling the ability to not have to live in fear every time you connect that machine to the Internet. They're selling the ability to not have to run so many third party security applications that the shiny new machine runs like a shiny new machine from 5 years ago. I think that is worth any percieved price premium.
Mac Mini Survives Slashdotting (Score:3, Informative)
http://test.doit.wisc.edu/ [wisc.edu]
Chris
Rereading the original ZDNet Article... (Score:3, Informative)
"On February 22, a Sweden-based Mac enthusiast set his Mac Mini as a server and invited hackers to break through the computer's security and gain root control, which would allow the attacker to take charge of the computer and delete files and folders or install applications.
"Participants were given local client access to the target computer and invited to try their luck."
Other related blog entries have noted the update.
Even so, the article fails to mention that this vulnerability relies on extra work on the part of the system administrator to create the accounts and open ssh.
MiniSlashdotting (Score:3, Interesting)
- Former Badger, glad I ordered one of those new MacBooks
Test Now Closed (Score:3, Interesting)
Contest Over! Winner Announced (Score:3, Informative)
The CIO of UW-Madison has managed to get test.doit.wisc.edu website defaced.
UPDATE on the contest (Score:3, Informative)
38 hours and not one successful crack.
Mr "Mac OS X is so insecure" didn't even manage to get in.
http://www.technewsworld.com/story/49296.html [technewsworld.com]
Re:Sad. (Score:3, Insightful)
Why is it that the world only considers remote vulnerabilities to be of consequence? Somehow local vuls are now irrelavent[sic].
You're missing the point. This test is not trying to imply that local vulnerabilities are inconsequential, it is trying to undo some of the misinformation that has been spread by the press. The previous test was fine, but the representation of it in the press was that a regular OS X machine put on the internet can be hacked in 30 minutes. This is wrong in many, many ways. Thus,
Yes, Sponsored by University of Wisconsin (Score:3, Insightful)
by daveschroeder (516195) on Tuesday March 07, @10:44AM (#14866581)
No +1 Informative for you.
Re:Don't play this down (Score:3, Informative)