MacBook Wi-Fi Hijack Details Finally Released 82
Wick3d Gam3s writes "Hacker David Maynor attempted to put the strange tale of the Macbook Wifi hack to rest, and offered an apology for mistakes made. All this and a live demo of the takeover exploit was made at a Black Hat DC event yesterday. Maynor promised to release e-mail exchanges, crash/panic logs and exploit code in an effort to clear his tarnished name. Said Maynor: 'I screwed up a bit [at last year's Black Hat in Las Vegas]. I probably shouldn't have used an Apple machine in the video demo and I definitely should not have discussed it a journalist ahead of time ... I made mistakes, I screwed up. You can blame me for a lot of things but don't say we didn't find this and give all the information to Apple.'"
Crash? I thought the original claim was... (Score:3, Insightful)
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
The important point: (Score:1)
So he just demoed (and thus released) the DoS, not the root exploit - which he DID have the code to perform but didn't want to release (by demoing).
Apple admitted the vulnerability WAS a root exploit.
Re:The important point: (Score:4, Insightful)
No, Apple said it could be used to run arbitrary code with system privileges.
Just like I could step outside my door and find $10,000 rolled up in a neat little ball. Doesn't mean it is likely to happen, but it could.
Theory and practice are two completely different things.
Re:The important point: (Score:5, Funny)
not in theory.
Re: (Score:3, Insightful)
It was a WiFi-borne hack and he was at Black Hat. So there were lots of sniffers going and everybody gets a copy of whatever he does.
So he just demoed (and thus released) the DoS, not the root exploit - which he DID have the code to perform but didn't want to release (by demoing).
Except that the patch for this vunerability was released months ago. Yet that didn't stop him from (trying) to do the demo at Black Hat 2006, when there would have been just as many sniffers in the audience.
From someone who already threw out their credibility, that really doesn't inspire confidence.
Re: (Score:3, Informative)
Re: (Score:1)
Re: (Score:3, Informative)
And then used his time machine to go back in time to before the bug was patched and announce the exploit?
The guy informed the world about the bug, then Apple fixed it, but refused to credit him for it.
Re: (Score:1, Troll)
Re:Crash? I thought the original claim was... (Score:4, Interesting)
And then used his time machine to go back in time to before the bug was patched and announce the exploit?
No, his original claim was a farce (hell, look at the video, there was only one wireless device available according to ifconfig). Apple then audited their code, found 3 bugs. He took one of the bugs mentioned, found out how to trigger it, triggered the crash and now claims he was right all along.
The problem is that what's happening now doesn't support his original claims. The original claims were he could hijack a MacBook in under 60 seconds and gain completely control of it. Now all he's getting is a crash with no control.
Re:Crash? I thought the original claim was... (Score:5, Informative)
I thought you said it was a hijack yet you only showed a DoS.
Yup, I showed a crash. I didn't feel the need to do the do the entire hijack for two reasons: Apple already confirmed that this vulnerability leads to remote code execution (they said so in the advisory here). Everybody that was running a sniffer during my talk now has a copy of the DoS code. The demo had two parts. I showed the crash happening on a 10.4.6 machine since it didn't have any of the airport patches. I then rebooted into 10.4.8 and the crash no longer happened. I did this to prove that the Airport patches issued on Sept 21st, 2006 fixed the problem I was demoing. The only real change to airport code was the security fixes that were issued.
You just reversed the patches and found what you then showed on stage.
I find this to be a funny argument. If I have the skills to reverse the patches and do a binary difference analysis of them, why couldn't I use those same skills to find the bugs in the first place (they weren't hard to find). This argument also doesn't take into account the fact that I showed that the first crash of the exploit occurred on Jul 15th, 2006, or emails to Apple helping them build a wifi auditing box (A linux machine with madwifi patched with LORCON) and pointed them to a vulnerability that was fixed in their patches (a problem with overly long SSIDs). The picture below is from the day I bought the Macbook, July 15th 2006. This crash occurred because I was fuzzing other devices and the Macbook crashed before I got to run the initial setup.
Re:Crash? I thought the original claim was... (Score:4, Insightful)
The fact that he will only demonstrate a crasher just seals the deal that he's full of shit. If he's had a working AirPort exploit for all this time, why not just demo it and put this issue to rest? That's what any sane person would do. But instead he's carefully misrepresenting Apple's release notes to make them seem as if they support his claim, further destroying his credibility.
I think the most likely scenario here is that he originally found exploits for various third-party wireless drivers and saw an opportunity. With a cursory look at the AirPort drivers, he figured, "Yeah, I could write an exploit for them too". So he made a big announcement. He hated the "smug" Mac users, so now he could really stick it to them. But there was a problem. For whatever reason, he couldn't get his code to inject into the AirPort drivers. All he could do was KP the box. Well this wasn't what he initially promised. So when it came time to put-up or shut-up, he used a third-party card with drivers that he had been able to exploit. And of course, he knew that people would ask questions. Questions like, "Who cares? That card doesn't ship with Macs, and Macs have built-in wireless, so why would any Mac user ever need to buy this card?"
Ah, but clever him. He knew that Apple had a reputation for being secretive and releasing the legal hounds. So he could just say, "Apple threatened me with legal action if I demoed the exploit on their drivers" and voila! He's now a victim of The Evil Corporation! The Slashdot crowd would definitely believe him. After all, geeks don't like Apple because they're secretive, and this would be just another validation for them. They'd buy it without question. Even if Apple issued a statement saying that Maynor was lying, that wouldn't matter, because Apple is the one who tried to muzzle Maynor in the first place! See how the logic goes round and round?
Re: (Score:2)
Actually it was even more slimy than that. "Johnny Cache" said on a mailing list a while back: "Secureworks absolutely insists on being exceedingly responsible and doesn't want to release any details about anything until Apple issues a patch. Whether or not this pos
Re: (Score:2)
So he made a big announcement.
then...
All he could do was KP the box.
Hey, you left out, "he made a fraudulent demo to gullible reporter, then hung him out to dry." Clearly his biggest sin. Too bad for him that showing a system should be vulnerable, and developing an exploit for it are vastly different things. I half expected that he might come up with something during the
Re: (Score:2)
every critical patch in windows has exactly that wording, even if there has been a major virus already released that affects that vulnerability. I'm not saying whether or not this guy is full of shit, but the wording a company uses when issuing a patch never says anything along the lines of "there is a full and working exploit that has been demonstrated". at least, not one I've ever read...
Re: (Score:1)
It is not possible that he doesn't understand that the only point of contention is whether he had an
Re: (Score:1)
Re: (Score:1)
One - he couldn't - Two - he needed to use the remaining 59 seconds to think of a cover-story for reason number one.
Re:apple can iFuck off (Score:5, Insightful)
1) he finds a bug, but he can't quite manage to exploit it. He can crash the machine (and that's a bad thing) but it doesn't *necessarily* mean he can exploit it.
2) There's a big conference coming up, and he knows he'll get the headlines if he announces anything bad about Apple. That's just the way of the world. Dammit, he *still* can't find the exploit.
3) The deadline arrives, he can't exploit the machine, but he goes ahead and gives the demo (faking the evidence with a different machine), confident that he'll get there eventually.
4) He hides behind "legal issues" (even now, he won't reveal emails) to prevent himself from being exposed as the liar he appears to be.
This series of events is just about the worst thing a researcher can do. It's like an athlete taking steroids - there will be no forgiveness, no olive-branch will be offered; his reputation is irredeemably tarnished, because he lied for personal gain. We *need* to be able to trust people publishing exploits, and if this means his career is in ruins, I say "Hurrah!" The less people like this around in the business, the better.
I just want to also point out that I don't recall any lawyers being involved at any time in this dispute - neither party claimed lawyers were involved (he said Apple "leaned on" his employers, whatever that means, but lawyers were never mentioned.)
Apple claim he released insufficient technical details to them to help them in their investigation, so they had to go to the trouble of doing a full internal audit of a large source tree (and all the time, he's spreading disinformation and tarnishing their name). They find and fix some bugs, and now he's in an even worse position - his crash "exploit" won't work.
So, now, he releases the "details" - he's given up trying to exploit the original OS, and brushes that small point aside in the "details". He tries to save as much face as possible instead of admitting he was just plain wrong - he's basically covering his ass. Does anyone else think "details" ought to actually show the information he claimed to have (like being able to take control of a Mac in 60 seconds) ?
In science, there are two fundamental maxims
1) Don't falsify the data.
2) Extraordinary claims require extraordinary evidence. (*)
He failed, on both of these, as far as the world can tell.
(*) "Extraordinary" here means in the technical sense - the first exploit of any kind requires unequivocal proof. I don't care if it's OSX, Windows XP, or Linux - show the data. Prove the case. Don't wave your hands around and babble.
Simon.
Re:apple can iFuck off (Score:5, Insightful)
There is still no public supporting evidence for his clams -- he hasn't even posted his personal correspondence with Apple yet, something he'd been free to do since day one.
Maybe he'll get around to it someday... who knows. But for now it's still just a lot of words with no support.
Re: (Score:3, Insightful)
Not at all. Though it does bother me that someone is willing to call something truth when there is still no evidence made public to substantiate it.
And regardless of how reputable The Register is, the article provides no information that support the reporter's conclusions. And until Maynor publishes those emails, there won't be any. He's already posted two updates to the blog since his presentation, including one that
somebody now believes him (Score:1)
No, I think the grandparent just found your 'evidence' unconvincing, to say the least, and yes, Maynor does sound like a hoax, because he talks a lot about evidence and then doesn't present any.
The Register is in no sense reliable, it's a great example of sensationalist tabloid journalism, but i
Re:Yes it does! (Score:4, Insightful)
I refer the honourable gentleman to the reply I gave some moments ago - if he can do it, he ought to do it. Until he does it, I don't believe he can do it.
So, here's your example: the exact "exploit" he's claiming to be able to perform.
No, it's not. Which is why I used "in the technical sense" in the original comment. "Extraordinary" means "out-of-the-ordinary" - the claim is not run-of-the-mill, it's the first remote exploit of an Apple laptop. The proof should also be bulletproof (actually, right now I'd settle for just proof, not incontrovertible evidence!) At the moment, all we have is a load of hot air and bluster.
Simon.
Re: (Score:1)
please give a non-contrived example where you can do something like overwrite the EIP with an arbitrary value and still not be able to execute arbitrary code
If writable memory pages aren't executable (W^X, NDX, I don't recall the acronyms), your program can't execute runtime-supplied code, evah. Either setting EIP maliciously or not, you won't be able to "jump off and execute" any code which was not present at the time of compilation.
Were you trying to prove a negative proposition? Pretty basic mistaek, dude.
Re: (Score:1)
Here's a crude analogy: scientists have known about the hole in the ozone layer around the South Pole. They know what caused the problem, the process of how the problem developed, even the chemical mechanism that perpetuates the hole - but they can't do anything to shrink it any faster than just letting it repair itself. Get my point?
Re:Crash? I thought the original claim was... (Score:5, Interesting)
Here is a video I made debunking their proof: http://video.google.com/videoplay?docid=146818771
My guess is that they got a buffer overflow but had not yet found the correct location in memory to write their shellcode. They still have not...
Re: (Score:3, Interesting)
Pretty solid video. I just want to add two things. First, the IEEE page says:
And second, though not sure about Macbooks and OSX, but often you can change your MAC address, though it would be silly to change it to Apple's OUI.
So there is a small possibility that the video
Just an observation..... (Score:2, Interesting)
http://news.com.com/New+Apple+patch+plugs+Wi-Fi+h
The article doesn't mention if the machine he used in the demo had this patch. And if so, that may imply that the patch has holes.
Re:Just an observation..... (Score:4, Informative)
One on 10.4.6 showing that it was vulnerable (crash achieved and remote code execution is possible).
The second demo showed no crash on 10.4.8 showing that the patches Apple released did indeed fix the problem he pointed to.
I do not undestand the fuzz. (Score:1, Interesting)
(1) I would and do release immediately security faults I find. (have found some).
(2) If someone says I did not find it or throws smut at me I'd sue - all the media running such articles which falsify my work or findings.
So simple.
Companies do act and correct bugs faster when security faults are released.
Re: (Score:1, Informative)
And somewhere, (Score:2)
Re: (Score:2)
Proof in the pudding (Score:5, Insightful)
1) In the original demo, he gained command-line access to the target machine (using a third-party wireless card). The claim was made to Brian Krebs in the Washington Post that the built-in wireless was similarly vulnerable (which would be far more relevant, since all MacBooks have built-in wireless). Yesterday's demo showed a crash of the target machine. That's bad, but he still has not demonstrated a takeover of the MacBook using the built-in wireless after all this time.
2) The fact that Apple's patch addresses the flaw that caused the crashing does not prove that Maynor engaged in responsible disclosure. Apple has said that Maynor provided them with no code or other details about the exploit, and that they did their own investigation. The investigation, according to Apple, revealed a flaw, leading to the patch. The issue is NOT whether a flaw existed. All Maynor demonstrated was that Apple's security patch works, which is really not that enlightening.
Re: (Score:2)
Re:Proof in the pudding (Score:5, Insightful)
Doesn't it strike you as the least bit shifty that Maynor, eager to clear his name and prove that he was right, suddenly doesn't "feel the need" to demo the hijack he originally claimed? Oh, but don't worry, he could hijack the MacBook if he really wanted to! According to Maynor, Apple has been lying and covering up through this whole ordeal, but now we are supposed to essentially take Apple's word for it that his crash demo = hijack. Please.
Let's apply Occam's Razor here. Did Maynor fail to demo a hijack -- despite the fact that it would restore at least some his credibility -- because he thought it was just as convincing to piece together circumstantial evidence from Apple press releases? Or did he fail to demo a hijack because he can't? Are we supposed to believe that after all this time and humiliation, Maynor really doesn't "feel the need" to back up his inflammatory words? I don't buy it, and I don't see how any rational observer can.
As the GP said, the proof is in the pudding -- all we've got here is a box that says "pudding mix, really!" and a promise from Maynor. Same as before. The guy is a charlatan.
Re: (Score:3, Insightful)
This
Re: (Score:3, Insightful)
Timing is everything with wireless. An overflow which causes a crash one time may allow for remote code execution the next. It's all very tricky to get right, and there are non-driver issues that can cause problems (things like interference, which you can't control). Maynor or Cache alluded to this at one point, and it was speculated that this might have been the real reason that they did a video demo inste
Re: (Score:3, Interesting)
Even if he had demonstrated the original takeover that still wouldn't prove his story. Yet you claim th
Re: (Score:2)
>hard time believing this is any different.
So almost a year later he comes forward, still doesn't demo what was promised the first time (and I don't even want to hear you whine about, well that's the easy part - because if it really was, he would have shown that), and you still want to think it was just the big bad corporations holding him down...
I guess I'm jus
Re: (Score:2)
Like I said, it doesn't matter what he does now. The patch is released, anyone could reverse engineer it. It doesn't add to his creditability but it doesn't remove from it either. Regardless of how you want to spin it.
Which is the more reasonable culprit? A huge company with known problematic disclosure practices trying to keep its stock up or some guy trying to keep his pride. Both are reasonable. It's just that one has his
Re: (Score:2)
Oh, and I wouldn't call him a "guy trying to keep his pride", I'd call him a security researcher trying to exploit the name of a corporation that is currently popular to inflate his own val
Re: (Score:2)
Apple already did that more than he could ever hope of by making such a big stink over it. It's funny how that always backfires [wikipedia.org] on people. But go ahead and make your ad hominem argument. Maybe in the future he will be wise to only disclose vulnerabilities in software owned by companies that won't pitch a hissy fit and make him famous.
Re: (Score:2)
I hope that if he does learn any lesson from this, instead it is this : Don't publicize a flaw unless you can prove it, which to date he has still failed to do.
Re:Proof in the pudding (Score:5, Insightful)
You are buying into Maynor's fundamental misdirection here. He wants you to assume that the bug he is exploiting is the same as the bug that Apple says could allow remote code execution. But there is no evidence to support this assumption. Apple has fixed multiple AirPort bugs since 10.4.6. There is no way of knowing that Maynor is exploiting an AirPort bug that allowed a hijack rather than a crash.
If it would only take "a few bytes of shell code" and the "easiest 1%" to make this exploit into a hijack, why not do it? His original claim was that he could hijack a MacBook, period. Now, supposedly given the chance to prove it, he just couldn't be bothered to slap together some shell code? Really? It's hard to believe that you don't find Maynor's "I can do that, I just don't feel like it" argument fishy at all.
Re: (Score:3, Funny)
What the hell are you talking about?! Whether or not he can do it is not the issue! Apple has admitted that it is possible.
Here is TFA [apple.com] if you are too lazy to actually read it. Hell, since you like putting things in bold I'll help you out...
Impact: Attackers on the wireless network may cause arbitrary code execution
No no. That's not the bug Maynor was talking about, this is a diffe
Re: (Score:1, Interesting)
Say, I think there might be security problems in Windows. I now deserve credit for every single security patch ever from now on.
Re:Proof in the pudding (Score:5, Insightful)
As I said above, that is, in fact, the issue. Nobody is disputing that a remote AirPort exploit was possible; that matter has been settled by Apple. You can be as sarcastic and triumphant as you want, but I already agree that there were documented remote-exploit bugs in Apple's code. Everybody does.
The issue here is Maynor's reputation. A responsible security researcher has to be able to back up his claims. Maynor said he could hijack a MacBook. He never provided evidence that he could. Now he says, "Look, they fixed this AirPort bug, so I was telling the truth!" But he still doesn't demo the hijack, even on an unpatched machine.
The debate over whether there were serious AirPort bugs has been settled. But Maynor has never demonstrated that he had the goods. He has left it to insinuation and sleight-of-hand. You have bought into his misdirection, and you still haven't answered the central question: If, as you claim, a remote takeover required only a bit of shell code, why not just do it?
(Boldface added to that last bit purely out of love.)
Re: (Score:2)
With timing attacks, not only do you have to get the shell code right, you also have to get the timing right, and that's mostly going to be luck unless you have control over a lot of factors.
With a wifi timing attack, you need even more control over your environment, because stray interference can cause you to lose the opportunity to exploit and simply cause a crash.
Re: (Score:1)
Re: (Score:2)
Not happening. From TFA:
In any case, I can say that Apple throws NDAs on every email they send from their bug reporting service. I don't know if it'd hold up in court, but it does make me nervous about even posting the stupid, annoying little bugs that I've reported to Apple... and it is one of the reasons why my next laptop will not be
Re: (Score:2)
I'd hazard a guess at "No, it wouldn't", though it doubtlessly would be an expensive/time-consuming/stressful experience to have to go through if need be. Non Disclosure AGREEMENT... I haven't agreed to anything, let alone a legally binding commitment, by sole virtue of receiving an email from Apple.
The reason he didn't actually show a takeover... (Score:5, Funny)
Because "a magician never repeats a trick."
Mistakes? (Score:3, Insightful)
"Maynor said the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS. Still, the presenters said they ultimately decided to run the demo against a Mac due to what Maynor called the "Mac user base aura of smugness on security."
"We're not picking specifically on Macs here, but if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one of those users in the eye with a lit cigarette or something," Maynor said." -- Hijacking a Macbook in 60 Seconds or Less [washingtonpost.com]
Actually, what I'm really waiting for is for Maynor to stop opening his mouth.
Re: (Score:2)
And typing with his fingers/toes, possibly with his nose.
I dunno- Apple's legal team will have to get together and see if they can get a court order to recommend his castration.
Third Party Wireless (Score:1)
I don't know the history, but evidently he claims to be able to hack the built-in wireless too? Then why doesn't this video show that? For all I can tell, he setup some code that lets the too machines talk to each other. Whoopdy doo.