As you surely know by now, the CanSecWest conference was the stage for a contest, PWN to OWN. Three laptops were set up; laptops running Windows Vista, Ubuntu Linux, and Mac OS X. The goal was to hack the computer and read the contents of a file located on each of the machines, using a 0day code execution vulnerability. During the first day, you can only attack the machine over the network, without physical access. On the second day, user interaction comes into play (visiting a website, opening an email). On the third and final day, third-party applications are added to the mix. Each machine had the same cash prize on its head. As you all know, the Mac was hacked first, on day two. The user only had to visit a website, and the Mac was hacked. Vista got hacked on the third day using a security hole in Adobe's Flash, and the Ubuntu machine did not get hacked at all. Update: Roughly Drafted responds.
Post a Comment
Member since:
2005-06-29
It's all just a load of hot air after all. So yeah, some vulnerability has been found. They find them every day, in Linux, in Windows, in OSX. Just read any change log. Let's talk when there's some actual harm being done to Mac users. If we ever get to that point of course. He's right in saying that Windows has been a plague for the whole computing world and he's also right in saying the media really wants you to believe that somehow down is the new up.
Surely you can have a sterile environment that compares Vista to Mac OSX, but in reality there are way too many users who still use unpatched Windows XP/2000/98 installations and that still counts. While on the other hand Mac users tend to migrate to newer versions of the OS quite faster. It's what happens in the real world that matters. The fact that somebody has found a vulnerability won't change anything.
Member since:2005-10-22
Had "in hand" implies that the hacker had something already tested and waiting. It's saying he cheated.
Has in mind means he had some idea where to look and what to look for, as they all should've, being hackers.
*Edit* I was trying to reply to the maim article. Drat !
Edited 2008-03-30 22:36 UTC
RE: had "in hand" vs had "in mind"
Member since:
2006-02-12
O.K. First things first. I was not supposed to use a computer this weekend, But I got an call that required an email. And while I was here...
The most effective and pure *simple* technique to secure OS X, is to not be logged in as an admin, or even any member of the 'admin group'. I own my Mac, I use the BSD Style 'ladmin' account and then a complex password. And then I avoid using that account for just about anything.
The Behavior is EXACTLY the same as when I need 'admin' access I type up both my admin name and password.
It is not common practice on a Mac, but I sincerely hope that we in the Mac community start to act right. It is hard to imagine a day when we are as bad off on OS X as we are 'generally' in Win XP but that doen not mean that I need to be logged in for admin purposes
Member since:2006-08-09
Member since:2005-11-11
I tend to keep sudo, but use a limited account with no sudo rights. Getting root access involves sudo adminUser (adminuser password), sudo -i (addminuser password). I get the benefits of having no root password as given by sudo, while running as what I'd actually consider a limited user.
Edited 2008-03-30 21:53 UTC
Member since:2006-02-12
Back on the Topic securing it is easy, falling for this hack would be hard
Yup that confounded me a little at first too. As the first time I tried to sudo from a non-admin account I was given a terse security warning. Then I thought it through and had to nest one sudo inside of another. Well in the end I find few reasons (outside of work -- where I am the Mac systems admin for all north American Macs for a publishing co.) Outside of banging on some naughty or inefficient code that I wrote I find very little practical reason to drop to the CLI
And also aside from reputable installers from respectable vendors I am very rarely asked to enter my admin name and password.
So If I am at a web page and it asks me to enter my local admin name AND then my password. AND then I enter it was I really hacked?
Member since:2005-07-06
Member since:2005-09-03
I think its worth pointing out that on Ubuntu only the first user account created is, by default, a sudoer and this privillage can easily be removed and added to another account.
System->Administration->Users and Groups, Select user and click properties, Click the user privilages tab and add/remove "Administer the system". You can of course just edit the sudoers file as well.
Member since:
2005-11-10
Member since:2007-07-10
Member since:2005-07-08
Nonsense. I would much rather have a Vaio than the a Macbook Air. Despite design undoubtly being a major selling point of Macbook Air, I'm not even sure if it looks better than Vaio? Besides, MacBook Air lacks many features that I would like my laptop to have.
Edited 2008-03-30 21:54 UTC
Member since:2006-02-15
Nonsense. I would much rather have a Vaio than the a Macbook Air. Despite design undoubtly being a major selling point of Macbook Air, I'm not even sure if it looks better than Vaio? Besides, MacBook Air lacks many features that I would like my laptop to have.
Me too, really. MacBook Air looks good but the Vaio just suits me a whole lot better 
Had I had the skills to hack my way into the Vaio machine it would already be mine 
RE[3]: Stuck with Windows
Member since:2005-07-06
A MacBook Air can run pretty much any Intel-compatible OS.
That's assuming Mac OS X would be a big deciding factor for the individual. One can want a Viao laptop and not feel even in the slightest a loss of freedom by not being able to run OS X. Contra to the hype out there, not everyone is tripping over themselves to get a machine running OS X.
Member since:2006-02-05
What about 10,000$? (the other part of the prize)
Edited 2008-03-30 22:42 UTC
Member since:2008-03-30
Member since:2006-01-08
The facts that each of the 3 machines was accompanied by its own cash prize, that the contest continued after the Mac was cracked but neither of the other 2 machines was compromised on the second day, and that $10,000 buys you 5 MacBook Airs, pretty much invalidates any argument that the Mac was only cracked so fast because the laptop was such an aluring target.
Member since:
2005-11-06
I know Artie MacStrawman considers Roughly Drafted as a reputable source but I don't know anyone else who does ;-)
Member since:2006-06-21
At least he's not a troll. Well, most of the time. Whereas I have a hard time remembering an article by Thom which wasn't biased to the gills. Why do you think he feels the need to constantly remind us "I'm not being payed by anybody to say this stuff!"
Oh the hell with it. I had just come back to OSNews after a month, read the news for a few days, then suddenly I'm being reminded why I stopped coming here and deleted it from the newsreader. I guess I was asking for it.
But since I'm here now, I'd like to point out how Thom ebarasses himself.
1. simply because the Apple user base is still too small to be of significant use to malware creators
That's not what Daniel said (and Thom uses this argument not once, but twice). He never mentioned the size of the user base as a factor. He said "Once discovered, Mac exploits are patched within a few weeks". That's why such an exploit is only of theoretical value, not because of the size of anybody's dick.
2. If you look at the original announcement of the winner, you will see that no such claim is being made
Yeah, 'cause that's what people around the world will be reading, an obscure blog entry. Want me to remind you what links were given right here on OSNews and what most people read? Techworld, IDG, Computerworld. And it's no secret Microsoft has been publishing FUD in its pet rags to discredit any real competition. Excuse Daniel to saying that it looks as if CanSecWest was doing the same.
3. the contest's rules page clearly states the brand and types of laptops used
Again, the magazine articles do not.
4. Of course he had it in mind!
"In hand". Not mind, hand. "In mind" means something he'd have to try and see if it worked. "In hand" means he knew exactly what he was doing and how it was gonna go. This wasn't a random thing an off-the-street hacker might try. It was a security expert going for the kill.
5. Roughly Drafted goes on and says the Vista laptop "only reflects the state of Vista for users who have elected to install SP1", and not of users throughout 2007. So, where is the cut-off point?
The real cut-off point is out there, in the wild. And out there, SP1 didn't make it very far as of yet. That's where exploits like the one that didn't work for that guy WILL work. And given the large user base you so fondly mention so often, it will have a much larger practical impact than a bug in a Safari lib which was already patched by now AND will be deployed to most users very soon.
You're so bent on proving your points (like a good troll that you are) that you ignore the bigger points Daniel makes, and that damages OSNews. He goes on to mention that the security model and ecosystem of Windows are deeply flawed, unlike Linux or OS X. But do you care about the bigger picture? No, you want petty victories over obsessive little points.
6. If Apple fails here, it is Apple's fault.
Yes, granted. But they fix their mistakes (within days). And they have a deployment model that actually takes those fixes to the users. No software is perfect. It will have bugs. It's in how the maker handles the bugs where you get to see how good they are.
7. they grossly misquote the original IDG article
No, he quoted it perfectly, word for word. The interpretation, however, is his. Can you tell the difference between a quote and a comment?
8. This is a very valid remark, but also an utterly irrelevant one in this specific context. Windows Vista does not ship with WebKit.
He was talking about Flash. Pay attention. Very often a vulnerability in a cross-platform application is used by trolls (such as yourself) in order to use against Linux or OS X. They use anything they can find. Doesn't matter if they're web applications, web servers or multi-platform browser plugins that could just as well be used on any platform (hence the "cross-platform" term), right?
9. Linux developers make FOSS look bad all the time.
No, they make it look GOOD. Reporting bugs and fixing them is GOOD. Hiding bugs and selling them to an underworld market which is flourishing because Windows security stinks is BAD.
Furthermore, for a person who contributes to FOSS, joining a contest such as this for money is beneath them. When you do things that you like with other likeminded people and you fix bugs routinely because you want the software you like to be better and because that's what good security is, well, becoming a sensationalist whore kinda starts to lose its appeal, you know?
10. The reason researchers like Miller can use open source software as an attack vector is not because of the inclusion of open source software in and of itself, but because Apple lags behind when it comes to integrating patches from open source software projects back into Mac OS X.
Woosh. The point went right over your head. It being that since it's open source, one can look right at the code and find bugs. Again, no software is perfect.
Apple may lag when integrating patches from outside projects (duh, they have to check it thoroughly otherwise someone will bitch how bad their products are), but that's not what the point was. You completely turned it around on its head (good troll! have a cookie.) It's not about how often or quick Apple fixes the code. It's about the code being exposed. My offer to draw a picture still stands.
That's it. The hell with this. I must've been cracked in the head to come back voluntarily to Thom's trolling when there's 50 decent news sites out there I can read.
Member since:2008-03-30
Member since:2005-07-06
Where are these news sites that cover multiple OSes?
I have found many that are worse than OSNews, with poor reporting, lack of facts and lots of mis-quotes.
I have found a few that are as interesting to read as OSNews, usually however they only cover one type of OS (Linux, Mac, Haiku).
I have never seen seen any that have better reporting than OSNews without them also trying to blog me down with Ads, Ads, Ads.
And again outside the single OS news sites, I never learn as much from the comments as I learn here.
Please tell who these so-called better sites are, because I can't seem to find them.
Member since:2005-07-06
Member since:2005-07-06
You have to be kidding!
Slow, I am still waiting for the home page as I type this.
Ads, not too bad as they are on the side like OSNews.
But articles are spread in short sections across multiple pages which are far smaller than found on OSNews.
And I see no lack of fan-boys in the forums either.
How is it better?
Member since:2006-10-15
I didn't want to go quite as far, but this comment reflects a lot of what I was thinking.
First of all, why is OSNews, read by tons of people, "lowering" itself to the level of some Apple fanboy site? This article shouldn't be more than a comment on the crappy site it's reporting on (and if they don't allow comments, it's not worth responding to anyway).
Second, it is true that the contest has arbitrary enough rules that it's not a real demonstration of system security, it's simply an interesting and almost useless data point (this coming from a HUGE Linux geek, whose favorite OS "won" the contest).
Third, it takes a very special kind of site for the comments to be more even handed and intelligent than the "articles" themselves, esp. in a world with YouTube and MySpace . Congratulations OSNews! At least there are occasional links to useful content (and it's rarely annoying enough to make me want to actually respond like today).
- Andrew (who uses a Mac, but only really loves Linux. who will also be leaving OSNews in his RSS reader for some time)
Member since:2005-08-12
"You're so bent on proving your points (like a good troll that you are) that you ignore the bigger points Daniel makes, and that damages OSNews. He goes on to mention that the security model and ecosystem of Windows are deeply flawed, unlike Linux or OS X. But do you care about the bigger picture? No, you want petty victories over obsessive little points."
Agree. Often when Thom writes these kinds of pieces, he will claim that some argument is wrong, and then attack some obscure, non-critical phrase or point made in the argument, completely butchering the larger idea. Even in cases like this where I have no strong opinion on the subject matter, it's still really really frustrating to see.
http://en.wikipedia.org/wiki/Argument_from_fallacy
Edited 2008-03-31 03:34 UTC
Member since:2005-07-12
I'm usually not a fan of these type of anti-Thom comments, (if they aren't trolling they're not far off) but I have to say, well put.
I'm a fan of Linux as much as I'm a fan of OS X, but honestly, "hacking the Mac" is headline news whereas "exploit for some piece of software on Linux which will be patched in under 30 minutes" isn't, and that's the driving force behind this whole kind of security event.
Member since:2005-07-06
Member since:2005-07-06
Member since:2005-07-06
While I use to read OSNews very often, I'm replying to this post only because Apple fanboys get very nervous when their faith gets skratched. While someone can obiouvsly be a fanboy of whatever he/she wants, keeping an objective point of view helps in life...
2. If you look at the original announcement of the winner, you will see that no such claim is being made Yeah, 'cause that's what people around the world will be reading, an obscure blog entry. Want me to remind you what links were given right here on OSNews and what most people read? Techworld, IDG,[...]
Should that be a valid argument? Thom wrote that CanSecWest didn't claim what RD reported and I'm glad that you agree about this. Then people write what they wish and headlines gets written to capture readers' attention. But anyway, how's that different from what really happened? If rules are fair, they got accepted and they're valid for all systems, you can say MacOS was the weakest of three systems. The "whys" and "wheres" matter for Apple fanboys to tell to each other how much the World hates them...
3. the contest's rules page clearly states the brand and types of laptops used Again, the magazine articles do not.
That's a laughable reply to a solid argument. Again, World hates Macs because they're... uh? Please...
4. Of course he had it in mind! "In hand". Not mind, hand. "In mind" means something he'd have to try and see if it worked. "In hand" means he knew exactly what he was doing and how it was gonna go. This wasn't a random thing an off-the-street hacker might try. It was a security expert going for the kill.
LOL! Poor Macs getting exploited by people determined to hack them! Only unexperienced guys should try to hack a Mac... if you're an expert, hell, focus on Windows!
Laughable! EVERYBODY who signed up to that contest had something in their hands to think they could hack those systems! "Hey, I never hacked a computer, I don't know anything about hacking but hey, I will sign up to that HACKING contest and then maybe... uh... I don't know... if I think hard... maybe..."... c'me on! Every guy there had WORKING exploits which they tried. You don't discover anything in 3 days... you just tweak your code to check if you can break into those systems too...
5. Roughly Drafted goes on and says the Vista laptop "only reflects the state of Vista for users who have elected to install SP1", and not of users throughout 2007. So, where is the cut-off point? The real cut-off point is out there, in the wild. And out there, SP1 didn't make it very far as of yet. That's where exploits like the one that didn't work for that guy WILL work. And given the large user base you so fondly mention so often, it will have a much larger practical impact than a bug in a Safari lib which was already patched by now AND will be deployed to most users very soon. You're so bent on proving your points (like a good troll that you are) that you ignore the bigger points Daniel makes, and that damages OSNews. He goes on to mention that the security model and ecosystem of Windows are deeply flawed, unlike Linux or OS X. But do you care about the bigger picture? No, you want petty victories over obsessive little points.
Pratical impact... in the wild... large user base... blablablabla. Rules were simple: latest patches applied. It was valid for Vista and OS X too. But you're so blind in defending your faith that even simple things look hard to understand to you. Next time Apples could sign to a competition where rules are "latest patches only if Macs prevail... if not, let's get back to one unpatched level for other systems. If Macs can't prevail yet, repeat until that conditions is true..." yeah fair! ;-)
I won't even discuss the idea of a contest where rules state that systems should be applied only "most used patches"... that's clearly a boutade.
6. If Apple fails here, it is Apple's fault. Yes, granted. But they fix their mistakes (within days). And they have a deployment model that actually takes those fixes to the users. No software is perfect. It will have bugs. It's in how the maker handles the bugs where you get to see how good they are.
Oh sure... CanSecWest knew that Apple was going to fix that hole soon so they hurried to make their contest earlier in order to put Apple under a bad shadow... lol... New rules:"We can hold a contest only when all exploits have already been patched. You cannot set it to an arbitrary date because, after a few days, holes would have been fixed so...".
8. This is a very valid remark, but also an utterly irrelevant one in this specific context. Windows Vista does not ship with WebKit. He was talking about Flash. Pay attention. Very often a vulnerability in a cross-platform application is used by trolls (such as yourself) in order to use against Linux or OS X. They use anything they can find. Doesn't matter if they're web applications, web servers or multi-platform browser plugins that could just as well be used on any platform (hence the "cross-platform" term), right?
Laughable and unrelevant. While SOME cross-platform holes exist, you cannot claim your hole is not relevant because it's cross platform. That would be equal to say that if a Ford car explodes they could claim that's not a problem because also Ferraris could explode as well. Right, but I didn't buy a Ferrari, I bought a Ford. Users don't care if there could be holes in systems THEY DIDN'T BUY. They care about holes in ones they bought and if re-using code makes you more insecure, just don't do that. I never heard Microsoft tell that an hole in their systems wasn't that bad because there could holes in other systems. Typical fanboy argument.
9. Linux developers make FOSS look bad all the time. No, they make it look GOOD. Reporting bugs and [...]bugs routinely because you want the software you like to be better and because that's what good security is, well, becoming a sensationalist whore kinda starts to lose its appeal, you know?
Yeah, everybody hates MacOS. Laughable and typical fanboy argument.
10. The reason researchers like Miller can use open source software as an attack vector is not because of the inclusion of open source software in and of itself, but because Apple lags behind when it comes to integrating patches from open source software projects back into Mac OS X. Woosh. The point went right over your head. It being that since it's open source, one can look right at the code and find bugs. Again, no software is perfect. Apple may lag when integrating patches from outside projects (duh, they have to check it thoroughly otherwise someone will bitch how bad their products are), but that's not what the point was. You completely turned it around on its head (good troll! have a cookie.) It's not about how often or quick Apple fixes the code. It's about the code being exposed.
Except that Ubuntu, which wildly use OS software, didn't get hacked. So decision to use OS software in MacOS was bad? Wasn't that a selling point? Typical fanboy: one day using OSS is a great NEWS (innovative! WOAH!), the other day is source of problems (but it's OSS fault, not Apple's!).
I hope next Apple fanboy will have more solid arguments than "Everybody hates us" and "it's not Apple's fault!". It wasn't even funny because your trollish ability is not that good... ;-)
Nothing personal... we love apples...
Member since:2006-12-15
So you're responding to a very small percentage of users whose own ignorance will cause them trouble some day. Meanwhile, coming off as being as big of a fanboy/egoist as those you claim to be responding against.
The emperor has no clothes.
So what if Apple has a little pie in the face because of this? They will fix it and be stronger because of it. The user base will let Apple know they're unhappy and Apple will have to respond. Heck, how long did it take Microsoft to take security seriously? It's great news for everybody that Vista is more secure than its predecessors. It's no laughing matter.
The real news that everybody seems to be glossing over is that webkit is open source and I haven't read anything as to whether this "hole" is vulnerable across platforms.
Member since:2005-07-06
I think you'll find Microsoft patches are generally released more quickly than Apples and that Microsoft has to ensure that they don't introduce any new incompatibilities for far more software titles spanning a far greater length of time. They could easily have a hundred shims for compatibility.
You'll find that Microsoft's Security Life Cycle is second to none, that their processes are well known so not only do you know that their patches are reliable for software titles spanning decades - likely 2 orders of magnitude greater than Apple has to worry about - but also they are more predictable since you know exactly what processes are followed before being released. You'll also know how they rank the severity of the bug because the criteria is openly documented.
When it comes to making security a central part of software development, infact building it into every part of the business Apple is a 5 years behind Microsoft and only started to take it seriously last year. They had better hope they get their act together quickly or they are in for a rough ride.
Lastly you will note that the bug that allowed compromising the Mac system was an Apple bug and that the bug that compromised the Vista machine was an Adobe bug. Both have recently shown us how sloppy they can be recently by not even bothering to read their EULA's before shipping software - Photoshop express EULA gave Adobe full control of the images you upload and Apple's Windows updater not only tried to install Safari 3.1 in incomptabile OS's (Windows 2000) its EULA stated that it could only be installed on an Apple machine.
Very embarrassing, sloppiness is not a trait you want in company that is supposed to be providing secure afotware.
Lastly the Adobe bug could easily have been used against the Mac or any operating system running their software.
Edited 2008-03-31 20:43 UTC
Member since:2006-12-15
I think with the adoption of the iPhone, Apple is going to come under quite a bit more fire. Hopefully Apple will put more resources into its security process. While this hack requires some bit of user interaction, I don't think it would be too trivial to catch people, especially when many people I know will connect to Wireless Access Points with no discretion.
Member since:
2005-07-08
The first step in solving problems is to acknowledge the problems. The often unrealistic and fanatic fanboy attitude tends to be, however, to close one's eyes from seeing the faults in one's own camp or blame others for them. That kind of arrogance and hubris is not only foolish but often also dangerous.
I have no doubt that Apple's Mac OS X platform wouldn't be rather secure already or that it couldn't provide even better security. But like the saying goes: security is a process, not a product. A lot of Apple's resources and efforts seem to have concentrated on developing usability, GUI and such stuff, not so much on security, so far. They might perhaps even be technology leaders in GUI related things. But an advanced and good looking GUI doesn't certainly yet mean that an OS would have good security too.
It is now only a good time at Apple to start to pay more attention to security too so that we could have even better Mac OS X in the future.
Member since:2008-03-30
I completely agree, this is a good deconstruction of the Roughly Drafted article. Thom Holwerda did an excellent job. While RD sometimes has good insights and info, it is also prone to blind zealotry. This is one of the later; and the RDF is a bit too much.
Moreover, Thom's rebuttal is tough but fair to Apple. A few writers/bloggers are confusing the OS with the default install, but Thom is very clear on this.
As he points out, the bottom line is that it's Apple's responsibilty. Until they do, I think I'll be using FF.
Member since:
2005-07-06
I have a lot of respect for John Gruber. He defends OS X a little too blindly for my tastes sometimes but he is generally a very good and reasoned writer. That said he was mistaken or over simplified the nature of the exploit used against webkit.
http://trac.webkit.org/projects/webkit/changeset/31388
is the patch in question in case anyone would like to review it.
For those who do not want to look at the patch or are not familiar enough with C++ coding I will provide some highlights.
First and foremost the patch and flaw are not in the PCRE API as John suggests, but in the adapter code specific to webkit. Even the most basic of checking would have shown the PCRE is a C API (w/ a C++ wrapper) and that the patched code was the C++ code used as an adapter for PCRE in the Javascript module of Webkit and was specific to Webkit.
Now that we have that out of the way... What is occurring is that Webkit would have a regex expression and would estimate the size of the resulting compiled expression. As long as the estimate was not under it did not have to be precise (line 1992-1993 original). The flaw came in the factor that Webkit engine did not take into account a maximum pattern size for the expression allowing for very large regexes using repeats to be underestimated and causing an overflow.
the original, vulnerable check (2148 original) was replaced with code that checks not only for an overflow specifically within the repeat section, but also checks for exceeding the maximum pattern size in the overall regex. (2433-2444 new code) Further if the max size is exceeded it throws an exception (whereas before it would continue).
So what we see here is a library that had a flaw in how it estimated the size of an object, allowing for a overflow. This is not in any way the fault of the core PCRE.
You could still say it was a flaw in a Opensource application, but it was one released and maintained by Apple, not a 3d party API.
Member since:
2005-07-01
The problem with this whole contest is in the way it gets reported. I'm not sure what it's designed to achieve, but all it should do is highlight the importance of security. It is by no means guaranteed to accurately reflect the state of security in each of the three OSs.
The order of victories is certainly interesting and reflects a factor of computer security. Trouble is, the press report it like it's the definition of security. And if they don't, the fanboys will. Cue blogwar.
I still say no article with "Top X" (for any value of X), in the title is of any importance and the people who read them only have themselves to blame.
Member since:2005-07-06
This was a competition. It does not show which OS is more secure and I do not think CanSecWest ever implied that this was the case. The purpose of the competition was to get some exploits reported and fixed.
All it means is that someone had a flaw ready for Safari and Adobe Flash but not for anything on the default install of Ubuntu. No more, no less.
Member since:2006-02-05
Member since:
2007-03-12
So the Mac laptop has been pwned. Do you Mac guys feel insecure because of it? Well then, "Welcome to the real world", baby. It happens everywhere. It's the game: either the bad guys are faster or the good guys. Nothing else. I'd say this will just improve the overall security of Mac OS, which is surely a good thing.
So the Vista box has been cracked into because of issues with Adobe Flash. Does this scare me? Yes, it does. This proves that the widely used closed software is harder to review and the potential disasters are greater. Claims (even if unsupported) that this hack may be multi-platform makes me feel really uncomfortable. I'm waiting for a quick update of Flash Player from the ever-slow-moving Adobe. (but I'm not holding my breath)
So the Ubuntu box hasn't been cracked. Does this make me feel more secure? Not at all. Since I have been following the development of many free and open source projects, I know what problems they may have. It's the speed of publishing the patches/updates that matter. On every operating system, and by every vendor.
So the first successful person "had it in mind" or rather "in hand". I'd rather say he did his homework well to maximize his chances. I'm sure the rules for competition has been published sooner, so everyone was able to do the same. He did it and he won the gadget and some money. This time he was faster than the vendor. Next year this may very well be reversed. (shrug)
Overall the contest has been a fun to follow and read about. So can we now go back to our usual work? Pretty please?
Edited 2008-03-31 00:21 UTC
Member since:
2006-02-05
If the Mac (and the Vista box as well) were running Safari (Flash on Vista) as the root/admin user, this is not big news. Apps not built for security and doing non-trivial processing of data coming in over a network have holes, period (though I agree with the assertion that Apple is ultimately responsible for the Safari code, since it is a bundled app and the default browser).
Now, if the objective was to get root/admin, and if the Mac was running Safari as a non-privileged account, or Vista was running Flash that way, that is not only an application hole, it's an OS privilege escalation. And that's much more interesting...and scary.
Member since:
2008-03-17
Apparently another example of some apple users reading too much against their holy platform again. I really hate fanatics.
Then again with so many factual errors it does not make the writer seem very credible, even among mac users...Yup, from the comments on that site it would appear to be the case.
Member since:2005-07-24
As a Linux fan, this reminds me a bit of the time that Mindcraft handed us a lemon. We railed. We denied. We debunked. We demanded a rematch.
But in the end... our heroes, the kernel devs, made lemonade.
Perhaps the moral of the story is that it is counterproductive to take the incident too personally. Concerned Apple fans might do best to "make applesauce" and express their security concerns to Apple, help beta test new software releases, and see how things turn out next time.
Member since:2006-01-02
Member since:2008-02-26
Is this the reference? Read the first paragraph.
http://www.mindcraft.com/whitepapers/openbench1.html
Apparently, Windows NT4 beat the crap out of Linux in some benchmarks and fanboys cried in denial. Eventually, the kernel was upgraded and everything was fine again.
Member since:2008-03-17
Yup these things happen on all platforms. But it seems that unfounded paranoia occurs more often mac users(or is reported more often).
Windows probably has the least, mostly because it can't really inspire the passion of its users. That leaves mac and linux users. There are a lot fanatics using linux but on the whole I believe that linux users are more enlightened (I'm biased tho so take it with a grain of salt).
Member since:2005-07-24
Mindcraft was sort of our Pearl Harbor. Microsoft secretly funded some "independent research" conducted by a "company" called Mindcraft. They put together an unlikely combination of hardware, including 4 100mbit nics (rather than the usual single 100mbit or single 1000mbit interface) and proceeded to prove that Linux performance was really bad based upon a static web page serving benchmark. The scenario was completely unrelated to anything anyone would want to do in the real world. And it turned out that "independent" Mindcraft didn't actually have a lab at all. Microsoft loaned them theirs and paid for the "study" behind the scenes. (BTW, that's not a black helicopter assertion. Some clever people tracked down the evidence and Mindcraft, which as it turned out had only one "employee", fessed up.)
However, none of that shadiness changed the fact that Linux *did* perform very poorly in this scenario, due to lack of parallelism in the network and filesytem subsystems. (This was back in the 2.2.x days.) You can imagine the denial that triggered. For weeks there was at least one lengthy new rebuttal presented per day. Mindcraft set up a rematch in which Linux experts were able to properly tune the Linux box. And we still lost this particular benchmark.
Mindcraft was the impetus that led to kernel 2.4. It would have happened anyway. 2.2 laid the infrastructure that 2.4 utilized to parallelize a number of subsystems. It was really the plan all the time. But Mindcraft gave extra incentive to really make that top priority.
In the end, all the rebuttals were far less valuable than the work that the kernel devs did to fix the actual problem.
The analogy with the current topic only goes so far. I certainly do not imply that there was anything improper about the hacking contest. But the overall principle is really the same. Turn a current defeat into a future victory by learning from it instead of denying and rebutting it.
Edited 2008-03-31 14:33 UTC
Member since:
2008-03-31
If I remember correctly the rules of the comp were that no known weakness could be exploited. In other words Vista may have numerous vulnerabilities, all but one in a hundred known, and this one vector would be the way in. OS X has comparitivly few vulnerabilities but matey knows of one that does exist an d can then employ it to great effect in the comp. In other words nothing of any meaning has been proven at all.
Member since:
2005-10-13
So the RD response was basically a bunch of whining about how Apple doesn't get treated fairly by the press, who are hyping up this failure in order to make money.
Umm, newsflash! That's what the press does. If Vista had been hacked first, do you think there wouldn't have been headlines like "MS Vista Still Insecure"? Do you think they wouldn't have had a field day pointing out a Linux loss and that both commercial competitors had beaten it?
On top of that, the press is always adoring Apple. Look at how much positive press they get compared to their competitors, and it seems a bit hypocritical to complain so much about the occasional bad story.
Member since:
2006-11-24
Member since:
2006-01-04
.. just like a lot of fanatics.
Why is it so hard to admit that _right now_ Apples security is not as good as Vistas or Linux. Things can change in a week. Security is a process.
And people, just dont use vendor provided browsers .. it was a bad idea in 98 and it is still a bad idea.
Member since:
2005-11-16
@Kokopelli
What , what are you talking about?
yes the code is in webkit, but that does not change the fact that the original code is an open source code coming from PCRE.
In the source file pcre_compile.cpp, it is clearly stated this:
"
This is JavaScriptCore's variant of the PCRE library. While this library
2 started out as a copy of PCRE, many of the features of PCRE have been
3 removed. This library now supports only the regular expression features
4 required by the JavaScript language specification, and has only the functions
5 needed by JavaScriptCore and the rest of WebKit.
6
7 Originally written by Philip Hazel
8 Copyright (c) 1997-2006 University of Cambridge
9 Copyright (C) 2002, 2004, 2006, 2007 Apple Inc. All rights reserved.
10 Copyright (C) 2007 Eric Seidel <eric@webkit.org>
11
"
So clearly the code is derived from the original PCRE code, you can't state that it is not. Grubber says something correct, he says that the exploit uses a overflow bug in the in the PCRE regex library used by webkit, which is the case, the bug is in the PCRE regex library.
The issue was not specific to webkit per se, as a similar issue has been found in PCRE prior to the version 7.6. I bet that Miller could find something similar in webkit and that he of course knew the PCRE issue exposed a few weeks ago.
And on the PCRE web site it is said:
"PCRE was originally written for the Exim MTA, but is now used by many high-profile open source projects, including Apache, PHP, KDE, Postfix, Analog, and Nmap. PCRE has also found its way into some well known commercial products, like Apple Safari."
just in case if you still think that PCRE has nothing to do with webkit....
"You could still say it was a flaw in a Opensource application, but it was one released and maintained by Apple, not a 3d party API."
That's funny. When people talk about webkit, they usually come up and say youm ah no apple has nothong to do with webkit, this is a pure open source project, Apple does not do anything for it, bla, bla, but when a security issue is found they blame Apple and magically it becomes a code "maintained" by Apple. Strange, strange....
"It is now only a good time at Apple to start to pay more attention to security too so that we could have even better Mac OS X in the future."
Give me a break!
In Leopard, Apple has introduced important security features like Mandatory access controls, downloaded file tagging, Library randomization , Execute Disable, Sandboxing, and Application signing. But, you tell us that Apple is doing nothing? Come on, just don't talk about things that you don't know...
Member since:2005-07-08
Give me a break! In Leopard, Apple has introduced important security features like Mandatory access controls, downloaded file tagging, Library randomization , Execute Disable, Sandboxing, and Application signing. But, you tell us that Apple is doing nothing? Come on, just don't talk about things that you don't know...
Give me a break yourself... (Besides, that comment was made by me and not by Kokopelli.) If you could just sit back and calm down a bit, and read my whole comment, you could see that I was actually saying that "I have no doubt that Apple's Mac OS X platform wouldn't be rather secure already or that it couldn't provide even better security." So in no way I was saying that Apple would have done nothing to improve security. Were did you get that from? At least not from my text.
Apple has done a lot to improve the Mac OS X security - like others have done too to improve the security of their operating systems - but Mac OS X is still no OpenBSD. I was just saying that they could do even more, so that we could have even better and even more secure OS X in the future.
Edited 2008-03-31 09:43 UTC