Slashdot Mirror
Amit Singh's Challenge: Find a Decade-Old Bug
dreicodan writes "Well this has too many juicy Mac OS X nuggets in one bag! All details are on this page, but I'll summarise. Apparently Amit Singh discovered a 10+ year old serious bug in OS X. The bug started in Nextstep and is still in Panther (and apparently Tiger, too). Then Amit wrote a program to demo the bug, but also made the program capable of hiding what it does using some complicated Mach kernel voodo! He then threw a challenge open to OS X experts to figure out the bug. It turns out that a week and some 1000 downloads later, three brilliant hackers (Alexy Proskuryakov, Andrew Wellington, Graham Dennis) were able to solve the puzzle. Also looks like other than these guys, nobody got anywhere with the problem. Be ready for extremely gory details of how the program was written and how it was decoded. Its a thrilling read, and OS X hacking doesn't get any more hardcore than this! Hopefully Apple fixes this bug now at last."
It is impressive that these uber-hackers could figure out why the kernel was panicking. It is not impressive that NextStep and Apple have known about this panic bug for 10 years but haven't been able to fix it!
I think one of the reasons why only a few people submitted their analysis was because of how the contest was structured.
Singh said he was going to give the prize to the first person with a correct submission. Not the best submission, nor the most complete submission, or the most creative submission.
So I think people just gave up after the first couple of submissions were posted. He shouldn't have displayed the number of submissions that had been received.
Also, this challenge didn't hit Slashdot until after it was finished. I know I didnt' hear about it until after the first two submissions were submitted.
It was fun to track down though.
Would you care to submit an example of a similar or worse M$ (note clever use of $) bug that they couldn't find or fix for 10 years?
Why is it that M$ (dollar sign, LOL!) gets brought up every time Linux or Apple fucks up big time, when it's not related and usually worse than any similar issues that M$ (clever!) has ever had, let alone left unfixed?
Its not like there is any software immune to ancient bugs. Debian had an outstanding bug in apt-get that was recently fixed. Apparently, for seven years there was a lurking 'ignore random files while removing a package' bug in their linked list program. Of course, it wasn't random at all, it simply skipped every other node in the linked list under certain conditions (such as having a list with more than one item).
I don't think the person behind the challenge meant to imply that macs are toys. Only that very few people outside of Apple know much about the inner workings of their beast named OS X. As far as exploits go, a kernel panic is one of the safest out there. No way of intentionally damaging specific files, no remote execution of code. Of course, as one of the many people who doesn't know much about OSX internals, I suppose its possible that the vulnerability could lead to such things. I just don't know, and given that your name wasn't on the list, I surmise you don't either.
I Browse at +4 Flamebait
Open Source Sysadmin
I believe that, and a few others might qualify. Win32 API Shatter Attack, have they fixed that yet? Will they?
I think I remember hearing that unless M$ restructures the Sec model, there really isnt a way for them to stop it from happening.
and why do I use M$, well, because Bill Gates exemplified Greed to me. The Largest software developer in the world, Oracle not far behind, M$ exudes Greed, Avarice, and Exclusionism (w?). And that dear friends comes from a 30 developer , not a 13yo, like so many critics of Slashdot seem to think.
"God of Rock, thank you for this chance to kick ass. "
The flaw used by panpipes has existed unnoticed for over a decade. If attackers were indeed actively looking for flaws all along, did they miss this one? If nobody was ever looking for any flaws, could there be more exploitable flaws lurking?
The rest of the article is good fun, but this passage is a brain fart. There are millions of lines of source code in any modern operating system. Exploits don't sprout overnight like mana from heaven. The most useful skill for divining exploits is to notice the existence of edge cases in how various subsystems interact with one another. There is also the important case where "chance favors the prepared mind". This is where something funny happens as a result of an honest mistake, then the "prepared mind" notices (and pursues) the chance event's darker implications.
Serious bugs that lurk for decades are hardly unknown. The ASN.1 bug springs to mind. It's hard to image a bug more widely deployed that escaped detection for such a long time. The question here is why, for such a long time, this simple flaw evaded interactions with dark energy. It's for precisely the same reason that experts rarely make the best testers. There are certain kinds of elementary programming mistakes that the "prepared mind" will habitually avoid. This distribution has a slim tail. If the minions of evil fail to stumble into any telltale clues after five years, chances are good it will remain hidden for a long time yet.
This is in fact the same mistake that Kurweil makes in predicting the imminent singularity: that intellectual power is a fully ordered function, based on the premise that a really smart person can achieve any interesting result that any person much less smart can achieve. To put this in perspective, consider the recently discovered AKS primality test. This is what AKS achieved by some clever tricks using concepts of undergraduate algebra and a 15-year old theorem.
http://www.flonnet.com/fl1917/19171290.htm
Undergraduate concepts in algebra exploited to achieve mathematical immortality. That ought to frame a tiny, unnoticed flaw in OS/X.
This adds up to the toy image _some_ claim the Macs have. Why would someone play around with a serious security bug there for 10 years? Well, a mitigating fact is that it was there for 10 years, but still it's bad to delay a fix because of a game.
Well, apart from the attempt to disclaim responsibility for a statement whilst still presenting it as credible (the '_some_ claim' statement), there's the gratuitous insult aimed at provoking others - 'toy'.
Why bother claiming Macs are toys in a story about an obscure bug? What does a toy mean to you? Ironically one of the most persistent criticisms of Macs is that current games don't play well on them, so they are in fact not very good toys.
Apple should hire, even if they never hire another person for their OSX team, Amit Singh. It is truly rare that someone as gifted as this appears on the scene and then even has a passion for the intricacies of a kernel that does not garner much attention in the OSS scene.
Given that all the immense amount of detail that Amit has given on OSX as shown on kernelthread and in his upcoming book has been done in his spare time, could you imagine what he could achieve if this was his job. Granted, I'm no HR person, but I would think that Apple should be chafing at the bit to get him on board. I know that if it was up to me, I would offer him an almost blank cheque to write his own salary on.
He is the person who could get OSX into the enterprise.
Of course, if he did work for Apple, then his website would surely suffer, what with NDAs and such. Perhaps it's better that he doesn't work at Apple.