U of Wisconsin's Mac OS X Security Challenge

digitalsurgeon writes "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet

Comments

Prove it!

[Bromskloss]

Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes?

So guys, what do you say? Should we all mabye prove ZDNet wrong by not breaking into that computer?

Re:Prove it!

[CheeseburgerBlue]

The poster then promptly disappeared in a puff of logic.

Re:Prove it!

[Ford Prefect]

I was appalled that someone might have hacked into this machine and thus given the impression that MacOS X was somehow ... insecure, so I hacked into it myself and patched it up with some new security features.

So to anyone wanting to compete in this challenge: sorry. :-(

Re:Prove it!

[mblase]

So guys, what do you say? Should we all mabye prove ZDNet wrong by not breaking into that computer?

Why don't we just do what Slashdot does best, and DDoS the thing instead? The way I see it, that's the best way to protect it from being hacked in the first place.

Re:Prove it!

[moro_666]

i think that after posting this story on slashdot, there's really little chance to do anything on the machine for today, and if you know a way to hack a mac, you wouldn't really expose it just yet :p

however, from tfa you can read that the zdnet "test" gave the hackers local access to the machine meaning the hackers had regular user accounts on it to use.

ftfa
"How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?"

I think *BSD will stand for a while, if the linux machine has a reasonable distro (meaning not everyone can do sudo let-the-hack-begin) it will again take quite a while to punch a hole.
  as for windows, a regular user account on a regular windows installation - zap :)

i'm very disappointed in zdnet for this "masterpiece" ...

ps. i will get a mac one day ... if i can afford it ... preferably a non-intel-mac

Re:Prove it!

[yabos]

I bet it'll be pretty hard. The page is all text and he's on an .edu pipe. Good luck!

Re:Prove it!

[Golias]

i think that after posting this story on slashdot, there's really little chance to do anything on the machine for today

The new RTFA: Before complaining of a site being slashdotted, check to see if it's actually... you know... slashdotted.

'cause it's not. It's chugging away nicely.

Go OS X, Apache, and hogging your university's network resources!

Re:Prove it!

[Anonymous Coward]

Yeah, but it's running on a slow as shit Mac. Should be incredibly easy.

Re:Prove it!

[aywwts4]

And I was wondering why the net was running a little slow...

kidding, still clipping along at 3894kb/s, something tells me doit, can cope with a little "slashdotting"

A Different Test

[Paradise Pete]

While I appreciate this test, and expect it to not be breached, it is simply not the same test. The original test was to see if a regular local user could elevate its privileges to admin. The fact that the "proof" was to be done by changing a web page is a red herring. The real story was that someone was (apparently) able to do that.

This test is of the web server, and of remote cracking without local access. Also, the explanation page says that the original article did not mention that local access was given. Well, perhaps they've updated the article, but it certainly says so now:

"Participants were given local client access to the target computer and invited to try their luck."

As I said, I appreciate this test, but I am also concerned about the apparent ability of an ordinary local user to gain admin status.

Re:A Different Test

[Yahweh Doesn't Exist]

the point of the original test was supposedly to test OS X in 'server' mode rather than 'home desktop' mode, hence the ridiculous number of open doors. yet even that does not justify a local user account on ssh.

Re:A Different Test

[mekkab]

I think you can't "see the forest for the trees."

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.

But how often do you allow someone into your machine? For A desktop, not often, perhaps never.

The biggest risk to most computers is a network based attack; this is the real meat and potatoes and a better test of the security of a machine.

Re:A Different Test

[Anonymous Coward]

Participants were given local client access to the target computer and invited to try their luck.

I can only imagine how many Mac zealot mails it takes to get zdnet to change an article.

Re:A Different Test

[daveschroeder]

Yes, they updated the article.

And the whole point isn't that the test "isn't the same". This is how most Mac OS X machines will appear to outside entities on the internet. The original article - and definitely before it was updated - left people with the impression that a Mac OS X machine could be owned in 30 minutes just by being connected to the internet, without the user "doing" anything, and the subsequent coverage of this in most press proves it. None speak to the fact that a local account was given, or even explore the implications. What could have been a useful article was useless, vague sensationalism. I updated the bottom of the page this morning:

Update

The ZDnet article has been updated to include the sentence, "Participants were given local client access to the target computer and invited to try their luck." But might it not have been interesting to explore:

- What are the implications of local account access, and under what conditions might a computer be used in that way?

- How can such access normally be obtained? Do home users behind firewalls and with no ports open need to worry?
How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue?

- What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in products, like the "hacker" they interviewed, and actively choosing to NOT give the vendor an opportunity to fix the problem(s)?

- How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?

- A discussion about how since much of OS X is closed, this might make it more difficult for the community to discover - and report and fix - potential vulnerabilities in the closed pieces

...and things of that nature, instead of leaving people with the impression that any Mac OS X machine connected to the Internet can be taken over in 30 minutes?

Re:A Different Test

[Kangburra]

Well, perhaps they've updated the article, but it certainly says so now:

        "Participants were given local client access to the target computer and invited to try their luck."

This has been added since the article was published, and it does make a huge diffence. It's like Microsoft doing a similar test and giving out the TS login details.

Re:A Different Test

[Tim C]

Lots of hosting companies offer ssh access, not to mention that if an account exists on the machine with ssh access, it may be only a matter of time before someone manages to gain access to it.

Re:A Different Test

[Fahrvergnuugen]

The problem is that the media presents the original test as though Mac OSX is insecure out of the box. It's very misleading.

An acquaintance of mine runs a small web hosting company. His original service plan offered SSH accounts to every hosting account. Despite his best efforts to secure the box, it was still rooted by a script kiddie.

His customer's PC was compromised and the ssh password for his account on the linux server was found by the script kiddie. The shell account had access to GCC. The script kiddie logged in as the non privileged user and used gcc to compile a rootkit. The rest was a walk in the park.

The OS was Slackware linux. All of the accounts were jailed, and all of the "best practice" measures were taken to harden the box (I can't comment on every detail as I am not a linux system admin).

My point is that when a malicious user gains shell access to any *nix system, you're in deep trouble.

My friend has since stopped offering SSH access to his customers.

Re:A Different Test

[Paradise Pete]

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!"

I don't think that analogy is quite apt. It's more like locking someone in your basement and they figure out how to gain access to your whole house.

When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.

Right now we have only this one supposed demonstration of it. What I'd really appreciate seeing is that *original* test repeated. If we can look at this as if it were an experiment, then when someone publishes a result others try to repeat it under the same conditions. They don't conduct a different test with different conditions in order to disprove the original.

Re:A Different Test

[jav1231]

Exactly. If you wanted to truly compare OS X to Windows in this scenerio, put a PC on the Net with TS opened and give out the user account information.

Re:A Different Test

[Anonymous Coward]

"But how often do you allow someone into your machine? For A desktop, not often, perhaps never."

But for a server, all the time. If you're considering a timesharing system, there may be thousands of users. The central ITS computers at every university I've been to (the ones you SSH to, and run Pine to check your email) have thousands of user accounts. Everyone at the school has one. (An older book, but still a good read about the important of priviledge escalation bugs - look for "The Cukoo's Egg")

Now you can argue that you're only giving accounts to people at the university, and they're trustworthy (or at least you can punish them if they try to crack the server). But out of ten thousand accounts, someone's going to have a guessable password. Or they'll answer a phishing scheme. Or (if you let people put CGI/php scrips on their webpages) someone will write a buggy script. Or your SSH/web/ftp daemons will be found to have a bug (don't know what Apple's using, but OpenSSH/wsftpd/apache all have bugs in the past and are likely to still have some bugs).

Now, I run linux at home because I need something which plays well with the network. I can log in remotely, run programs, upload and retrieve files, etc. I tend to find the distinction between "desktop" and "server" blurs, because I want to be able to access my computer from anywhere.

Re:A Different Test

[walt-sjc]

This is quite true. I had a hosting account that did NOT provide SSH access, so I installed cgi-shell and was able to chsh my account to get ssh. Mainly I wanted it to use scp / rsync instead of ftp. Ftp blows.

Re:A Different Test

[sabin1001]

Well, as long as we're doing anecdotes. My host, dreamhost.com, offers ssh accounts on its webservers and hasn't seemed to had any problems.

Re:A Different Test

[Perl-Pusher]

Until you posted this tidbit on slashdot.

Re:A Different Test

[Paradise Pete]

They don't conduct a different test with different conditions in order to disprove the original.

Let me clarify my own post by saying that I realize that the tester is *not* trying to duplicate the original. I didn't mean to imply that I think he's doing anything sneaky or underhanded. It's just the opposite, in fact. I apologize if I implied anything else. I'd sure like to see the original test confirmed, though.

Re:A Different Test

[Anonymous Coward]

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!"

The original test was for basic unix security. Nothing more, nothing less. OS X didn't pass on a default install. Instead of preassuring Apple to fix their crap you come with all kind of excuses. A real Unix should handle multiuser usage without being cracked in 30 minutes.

I wonder how anybody could think OS X could act as a Unix, maybe because the zealots have been raving about OS X being a Unix for 5 years now. But when somebody tries to actully use OS X as one you (And every other Mac user here) tell me it can't handle it. I fail to see what he did wrong. The box was cracked without the hacker finding a configuration error.

If this is just scraped under the carpet as a missuse I stick with Linux. Not necesarilly because it is more secure, but on Linux bugs are recognised as bugs and fixed.

This new "hacker challenge" is ridicilous. Instead of finding out what went wrong in the first one he just remove functionality until the box can't be cracked.

Re:A Different Test

[utlemming]

Well it is a "different test" the results could be remoteley generated. But you would have to have a web browser on their end running to get it to work. You simply write a Java program that runs locally on the client machine. When the client machine connects, they download your Java program. This java program then launches SSH (which, BTW, Java can do), compromises the root account, and then downloads a native Mac OS X malware/spyware program. Sure this is a different test, but it does demonstrate that the root account could, theoretically be compromised remotely. The program could even act as a trojan and phone home.

The other thought that passed my mind is that since it is a University what is the likely hood that this Mac is really a Honeypot of some sort? Sure it may be hardened, but they may be trying to figure out how secure Mac OS X is and just trying to get at the ego of hackers.

Re:A Different Test

[Total_Wimp]

How can such access normally be obtained? Do home users behind firewalls and with no ports open need to worry?
How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue?

The answer to the first question is pretty easy. Local access can be gained by the cleaning crew in most buildings, by students in others, and don't forget your friendly neighborhood coworkders. The answer to the second question is just as easy. Spouse, kids, kids friends.

I don't have an answer to the third one, but I know how similar questions get answered when Microsoft is the vendor. The answer is: they have the vulnerability. The vulnerability is bad. They should make a "more secure" operating system.

I think you're attacking the article justifiably, but I think you're also defending the vendor without justification. If they can really be owned by a local user exploit, then that is a serious problem.

TW

Re:A Different Test

[Fnord666]

This is how most Mac OS X machines will appear to outside entities on the internet.

By default web sharing and SSH are not enabled in OSX. You would have to turn these options on explicitly after a normal OSX install.

Re:A Different Test

[mgblst]

...and here, classs, we have another example where somebody is desperate to make a comment, and actually has nothing to so, while being pompous and arrogant at the same time as trying to look clever.

While one person makes a analogy which is not perfect, another person attacks them for it.

The two things are different, very different. Quit trying to post useless comments. Some comments on home secutiry/computer security are better than others (this wasn't one of them).

Re:A Different Test

[hcob$]

I think the first test was an excellent illustration of one simple rule of network security:

If you let someone have local access to a machine, it's been compromised.

Re:A Different Test

[tpgp]

For the curious, you can read the article as it originally appeared here

Whilst I agree with you that the original article was a typical zdnet troll attempting to stir the angry mac masses into page views, your statement: left people with the impression that a Mac OS X machine could be owned in 30 minutes just by being connected to the internet, without the user "doing" anything, is not really true if you read the whole article.

For instance, the original article contained the line:

Mac acting as a server -- with various remote services running and local access to users...[emphasis mine]

You also say:- How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?

I don't know about Windows / Commerical Unix, but under linux you have the option of using grsecurity to harden against unkown vulnerabilities. Nothing like this exists for the Mac that I'm aware of.

I understand the point of your test - that a mac can sit on a hostile network & not get hacked. But you seem to completely miss the concludion I drew from the outcome of the original test - do not underestimate the seriousness of local privilege escalation.

For instance (as I've written before), an unpatched local privilege escalation, used in conjuction with the vulnerability discussed in this article could result in a rooted machine - simply from visiting a hostile website (or even a website you visit regularly, that runs IIS and has been hacked itself)

Re:A Different Test

[Anonymous Coward]

This is how most Mac OS X machines will appear to outside entities on the internet.

Why does most OS X machines have a webserver enabled? Why do they have ssh? If you wanted to show how "most OS X machines" are seen on the internet why not close every port on it? It seems you took away some functionality because you know (by now) OS X isn't secure enough to go multiuser on. If your ssh gets cracked before the 10th you will just close that port and start up a new contest.

Secure your shit and make it the same contest, everything else is just excuses.

Re:A Different Test

[mekkab]

The two things are different. Very different. Quit trying to make analogies with them. Some attempts at home security/compute security analogies are better than others (and this one wasn't one of them), but they're almost always flawed in one way or another.

Thanks for making an assertion without even providing any evidence to support it! ;)

I this case, I think the analogy holds VERY well. Its much easier to defend a single point of entry (or a limited number of entry points) than it is to defend each and every thing that is precious and valuable. In this case, the TCP/IP stack and the the network services that ride on top of them are your "limited entry points"; vs. tying down absolutely every application.

Re:A Different Test

[daveschroeder]

I say that on the actual site itself:

Mac OS X is not invulnerable. It, like any other operating system, has security deficiencies in various aspects of the software. Some are technical in nature, and others lend themselves to social engineering trickery. However, the general architecture and design philosophy of Mac OS X, in addition to usage of open source components for most network-accessible services that receive intense peer scrutiny from the community, make Mac OS X a very secure operating system. There have been serious vulnerabilities in Mac OS X that could be taken advantage of; however, most Mac OS X "vulnerabilities" to date have relied on typical trojan social engineering tactics, not genuine vulnerabilities. The recent Safari vulnerability was promptly addressed by Apple, as are any exploits reported to Apple. Apple does a fairly good job with regard to security, and has greatly improved its reporting processes after pressure from institutional Mac OS X users: Apple is responsive to security concerns with Mac OS X, which is one of the most important pieces of the security picture.

The "Mac OS X hacked under 30 minutes" story doesn't mention that local access was granted to the system. While local privilege escalation exploits can certainly be dangerous - and used in conjunction with things like the above Safari exploit - this isn't very informative with regard to the general security of a Mac OS X machine sitting on the Internet.

Of course, I'd have no problem with this if the original article had actually talked about it meaningfully in the context of a local privilege escalation and explored the implications; instead, they just made it sound like you could throw a patched OS X box onto the internet and it'd get owned. The average reader would leave with that *distinct* impression, and most of the subsequent coverage of it talked about it exactly in that fashion.

Mac OS X has had several local privilege escalation vulnerabilities, just as other OSes have had. Apple fixes them when they become known. (Also, and this is another discussion, but what can Apple do if the "hacker's" claims are correct, i.e., that the vulnerability is unknown to Apple? It doesn't prove that Mac OS X is "insecure"; all it "proves" is that open scrutiny is difficult with closed source pieces, and that some people intentionally and knowingly refuse to give vendors a chance to fix problems.)

Re:A Different Test

[Stalyn]

If we can look at this as if it were an experiment, then when someone publishes a result others try to repeat it under the same conditions. They don't conduct a different test with different conditions in order to disprove the original.

Science never enters the picture here, this is a religious debate.

Re:A Different Test

[Cmdr-Absurd]

I don't think that analogy is quite apt. It's more like locking someone in your basement and they figure out how to gain access to your whole house.

In most basements that would not be hard. pick one:

• weak interior door/lock to basement
• lots of fun power tools in basement -- drills, cicular saws, reciporcating saws (aka super-destructomatic)
• phone in basement -- call 911 and claim to have been kidnapped
• start a fire using water heater or furnace
• insert your own "basement hack" here

Re:A Different Test

[AKAImBatman]

This is how most Mac OS X machines will appear to outside entities on the internet.

Let me just say, thank you. All these trolls seem to think it's perfectly natural that you'd let hundreds of anonymous users into your system, who's only purpose in life is to compromise one of the hundreds of software packages installed in an attempt to gain higher priviledges. That's just ridiculous. Mac OS X is a desktop system. It is configured as such, and is bound to have problems that could be exploited by a sharp human. (Trojans, worms, and viruses tend to need an exploit that's guaranteed across a large number of systems. This may not be the case.)

If the guy had wanted to test Mac OS X server, he should have run Mac OS X server. Yet even then, there's absolutely no admin worth his salt that would allow shell access to a Unix machine before first performing a full lockdown of the machine. The defaults are never good enough, because the system is still evolving for its intended use. When you're configuring all the services you need, it's always important to set the security to match the level of trust you give the users. In some cases that may mean that you've exposed yourself to potential compromises, but you trust the user (or users) with that responsibility. In other cases, you don't trust the users at all, so you revoke just about every right you can think of.

Or in other words, security is based on trust. Thinking that a system that's intended to trust its users (a Desktop) is going to stand up against untrustworthy users is silly. So again, thank you for trying to set the record straight here. When you're done, we can get the Onion to sydicate the ZDNet article. ;-)

Re:A Different Test

[shippo]

The original machine had had various extra bits of software installed via the Fink project, such as MySQL. The Fink project is very lax at getting updates in place, and there appears to be no specific security policy, particularly if installed from the so-called 'stable' release.

It is entirely possible that one of the pieces of software installed by fink had a root exploit, perhaps using SETUID.

Fink should not be installed on production systems.

Re:A Different Test

[phasm42]

You're confusing local PHYSICAL access with local user access (e.g., an unprivileged login). There are numerous hosting companies that give out shell accounts. That isn't to say it's easy to do right, but rather that you shouldn't equate it with being compromised.

Re:A Different Test

[neuroticia]

"But how often do you allow someone into your machine? For A desktop, not often, perhaps never." Err. Not quite. Desktops are often shared among members of the family, and even friends that are visiting. Your fourteen year old son's friend comes over, jumps on to check his email- he has access. Also, anything that can be done manually as a human can also be done programmatically, and run with the permissions of the user. So if a regular user account can sieze control of or elevate their permissions, then so can an application that runs at the level of that user. Got a clueless end-user that actually downloads and double-clicks that thing pretending to be a JPEG? "how often do you allow someone into your machine? for a SERVER not often" would be a better statement. Most mainstream non-dedicated hosting companies do not allow SSH/telnet access to accounts.

Re:A Different Test

[rolosworld]

you receive emails do you?

if you do the email could be a mail package with a time bomb...

"The biggest risk to most computers is a network based attack; this is the real meat and potatoes and a better test of the security of a machine."
remote exploits can be avoided with a firewall (winXP style) but local exploits can't be avoided unless the OS is fixed. Sure remote exploits are worse for servers, but local exploits are as much worse for desktops... mac is desktop, so I would be more worried by local exploits.

Re:A Different Test

[xtracto]

When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.

I agree and I believe one of the dangers of a nonpriviledged application being able to elevate its privileges can be for example if it is used to install rootkit like software. I mean, nothing stop one of those DRM rootkit companies from using those exploits to do it no?

Re:A Different Test

[Anonymous Coward]

Also, and this is another discussion, but what can Apple do if the "hacker's" claims are correct, i.e., that the vulnerability is unknown to Apple?

Isn't the answer obvious with the x86 transition? NX/W^X/PaX/ExecShield?

Re:A Different Test

[Guido von Guido]

But how often do you allow someone into your machine? For A desktop, not often, perhaps never.

While this is a fair point, many root compromises happen in two parts. First someone gets shell access as a non-priviliged user through a hole in some service, or through a compromised account. Then they use some local privilege escalation attack to become root.

The fact that OS X doesn't run ssh by default is good for desktop users, who aren't going to be running a lot of services which can be compromised. Nonetheless, local exploits are still a problem.

For instance, apparently there was a recent OS X vulnerability where a malicious web site could execute arbitrary code when you visited it (with Safari). I don't know how easy this would be to exploit, but it could probably be used in conjunction with a local exploit to compromise a desktop.

Re:A Different Test

[Wolfrider]

Make sure you are using the blowfish encryption algorithm for fastest transfer speeds...

Re:A Different Test

[dougmc]

I this case, I think the analogy holds VERY well.

Ok, let's look analogy given :

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.

And as a reminder, the test allowed users into the box, and they then had to escalate their priviledges in order to alter the contents of the web site.

Specific problems with the analogy?

• The attacker wasn't supposed to `steal' anything. He was supposed to change something that he did not originally have the needed priviledges to do.
• He wasn't even a thief, or even a criminal, as he was invited to come in and do this.
• The attacker wasn't challenged to alter (or steal) `anything' -- he was challenged to alter a specific thing, something that was believed to be well secured. The analogy could be improved by mentioning `stealing a paper in the locked safe in the house', but even that has many of the same flaws of the original analogy.
• Unlike your typical house, properly secured *nix systems DO have everything `bolted down' (yes, it's an analogy, I know.) You should not be able to alter files that you do not own (unless they have permissive permissions, or there's some other mechanism to allow you to alter the file, of course), period.
• The security model of a house is basically `crunchy on the outside, chewy on the inside' -- once you get past the outside security, there is no further security on the inside and you can do whatever you want. While many computer systems do have a somwhat similar security philosophy, *nix does allow you to give users shell access to your box and still keep them from doing certain things, and that is what the test was testing.
• ... and a house isn't even very `crunchy' on the outside. Most houses have windows, and a burgler can get into any house with a window using no special tools in a minute or two -- just break it. The reason that they don't do this more often is that it's likely to be noticed and bring a quick response, either from the police or a homeowner with a shotgun. Adding bars to your windows makes it more difficult to get in, but a few minutes with a socket set would get them removed.

  Compare this to a computer, where an attacker may try to get access many *millions* of times (depends on how he's trying to get in) and unless there is some sort of intrusion detection system running, it's unlikely that anyobdy will notice, and even more unlikely that they'll notice quickly enough to do anything about it. He may also be able to attempt to break into thousands of computer systems simultaneously.

• Generally breaking into a house (or a safe in the house, if you want to use a further analogy) involves doing damage to the house. Breaking into a computer system usually does no damage -- often it doesn't even leave any clues, beyond some possible log messages.
• And then there's the danger to the attacker himself. In order to break into a house, your thief generally has to be physically present at the house, leaving himself open to arrest or getting shot. In contrast, a networked computer is almost always broken into from afar, with the attacker being safe in his house or cyber cafe. If he's extra paranoid, he's even bounced his connection through a few other machines in order to make himself hard to track down.

But yeah, other than that, the analogy holds VERY well. Uh-huh.

If you must make an analogy, don't even use a house. It's a public train station, with no police, and the attacker is challenged to write his name on a piece of paper. But the challenge is that the piece of paper is in a locked viewing cabinet behind bullet proof glass.

... and even this analogy has serious flaws. Here, the attacker has physical access and given enough time could do any number of things

Re:A Different Test

[mekkab]

Desktops are often shared among members of the family, and even friends that are visiting.

Good point. My only counter is that Most people don't protect against the people they invite into their home/computer. Or if they do, they limit what websites their kids can see, but not often what programs they run.

Or at least, that is my understanding. Remember, I grew up with clueless Parents. I wonder if these days parents of youngsters are more savvy on internal security?

So I'm stating that when most people think of computer security, its protecting from against the outside. Only the security-savvy /a.k.a. real admins are concerned with the total package, inside and out.

Re:A Different Test

[massysett]

The shell account had access to GCC.

That's part of the problem. My hosting company does not allow me to compile anything. How much security experience did your friend have?

Re:A Different Test

[mekkab]

Good point. I would lump e-mail and also user-downloaded website exploits with network security, too.

I'm not feeling especially witt today, so insert some sendmail bug joke here.

Re:A Different Test

[ratboy666]

Of course it is only a matter of time. My incoming SSH daemon is hit thousands of times a day with guessed user/password combinations.

Of course, time is relative. If a determined attacker tries one account, 10,000 passwords a day (and she can't do more than that), in 1000 years, she would have gone through 50 billion attempts.

At which point, I probably would start caring...

Of course we don't want weak passwords, but SSH does have the ability to create and use strong keys. And the attackers so far just shotgun users/passwords. Which means I will start worrying in around a million years.

A matter of time, indeed.

Re:A Different Test

[jlarocco]

Gaining root access locally is as easy as inserting a LiveCD and rebooting the computer.

Re:A Different Test

[ScriptedReplay]

*sigh* are you guys hopeless? The point of the original test was not to hack the machine from outside, but from inside. All the noise about Windows getting hacked 4 minutes after it was connected to the net was due to lack of firewalling and vulnerable services - turn on firewalling and the vulnerable services are no longer accessible. What does that prove? nothing - they didn't magically become secure. OSX probably has fewer vulnerable services (active or not) but that was not the point.

The point is even with proper design of user separation, local security is hard to get right. Every OS has this problem, to various degrees. And if you want a sample of what this type of problems mean, here is one: malware will not be required to ask you for a password to elevate privileges - see? all those 'this is not a virus, it asks for your password and that should set your alarm bells going' argument goes puff! in smoke. This is the same type of issue that plagued non-administrator users in Windows for a long time now. So let me put it this way:

1. Local privilege escalation is bad - and hard to prevent (see all the attempts done by other OSes - NX, canaries against stack smashing, grsecurity, PAX, load address randomization and so on)
2. Local privilege escalation to root is really bad. There are precious few places where one should have to look for things that run as root. Most of them are in the default install. And the worst that can happen is a kernel-level exploit, as that would be likely to affect OSX Server as well, which is far more likely to be used in a multiuser setup.

So, to come back - your test is utterly irrelevant for the type of people that would be interested in the original one. What you are trying to test is the security of the OpenSSH and Apache installs + your setup (yeah, and password strength - expect to be hit by automated dictionary attacks from scripts that couldn't care less about your test). If I had an XServe machine with several users having ssh access I would really want to know whether any of those users really can get root on the machine or not (if they can, XServe has no place in such enviroment). And I would be really worried. As it stands, I still have worries, but at least I know that I have a certain amount of protections in place against such problems (this not being OSX though - no OS names since I'm not interested in 'my OS is more secure than your OS' flames) But this is a real security concern and yet you turn around and say 'but these other things are secure.' Yeah, the article could have sounded misleading for anyone not willing to check the site and see the conditions (but few people would do that anyway) but how are you any better? All this is countering journalistic sensationalism with more of the same, since your box is neither set up as a home user's nor your setting is pertinent to the original multiuser problem.

To toss in my 2c of an analogy - the original test was to check whether a bank's employees (with access to the bank building) can empty the main safe to which they do not have the combination[*] while yours is to check whether a customer can; all this on a Sunday when the bank is closed.

And now mods feel free to mod me down - although a more rational answer would be welcome.

[*] to all those saying 'by dfault root is not even enabled in OSX': bah! 'enabled' pertains to login and privilege escalation couldn't care less about login restrictions; the account is still there. And in fact, the thing that 'get root' means is 'get uid=0 access'

Re:A Different Test

[mekkab]

I appreciate your analysis, thanks.

f you must make an analogy, don't even use a house. It's a public train station, with no police, and the attacker is challenged to write his name on a piece of paper. But the challenge is that the piece of paper is in a locked viewing cabinet behind bullet proof glass.

Analogies are indeed a MUST. and M-U-S-T must must must. Sorry, but sometimes you do need to reduce things down to a simplified set.

I liked the "there's a guy you let in your basement, and he's getting into the main part of your house" as an analogy for priv-elevation, but the train station is a nice one, too.

Re:A Different Test

[hcob$]

You're confusing local PHYSICAL access with local user access (e.g., an unprivileged login). There are numerous hosting companies that give out shell accounts. That isn't to say it's easy to do right, but rather that you shouldn't equate it with being compromised.

No, I'm very aware of what I'm saying. I'm just extending an old axiom to today's world.

Re:A Different Test

[99BottlesOfBeerInMyF]

I don't think that analogy is quite apt. It's more like locking someone in your basement and they figure out how to gain access to your whole house.

Agreed, but the coverage was like reporting said situation with the headline "Burglars Can break into the Average House in 15 seconds!" ...without ever mentioning that is if you agree to lock all the random strangers who stop by in your basement while you are out.

When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.

Sadly, this is not too far from the truth. A mediocre cracker can find a local escalation on the average desktop OS, be it Linux, OS X, or Windows. This is part of the reason security minded OSs have implemented VMs and the like for both software and users. I'd like to see OS X implement this with a usable GUI and become one of those ultra-secure OS's but I don't think there is a lot of market demand for it right now, since OS X does not really have a malware or cracking problem in the eyes of the market.

Re:A Different Test

[Anonymous Coward]

- What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in products, like the "hacker" they interviewed, and actively choosing to NOT give the vendor an opportunity to fix the problem(s)?

What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in your products, like Apple does, and actively choosing to NOT fix those bugs in a timely manner?

Re:A Different Test

[squiggleslash]

I'm not sure even that's reasonable.

It's more like (gag, these analogies are beginning to suck) like the owner of a hotel testing the security to see if a resident would be able to get into the Janitor's room, where the master key for all the rooms is kept.

The test was specifically aimed at the notion that many machines are multiuser, be they because they belong to a hosting company that provides shell access, or because they're just used by a wide variety of people (say, shared computers in a classroom); and whether Mac OS X is up to the task. Clearly, if it can be hacked in 30 minutes, it isn't.

Also, as I said yesterday, it proves that as long as you can persuade the user to run a program (which 90% of Windows exploits seem to be about), you'll be able to escalate its privileges to root and do a whole bunch of things that shouldn't be possible, even without using simple trickery to get an admin's username and password (which, thanks to a major UI flaw of Mac OS X, is actually something a user expects to see on a regular basis. The funny thing is that most people think it's a security feature, rather than a screw-up.)

Re:A Different Test

[99BottlesOfBeerInMyF]

The point of the original test was not to hack the machine from outside, but from inside.

True and it confirmed what most everyone already knew, a mediocre cracker can find a local escalation. There is no problem with the original test. There is a problem with the way the media misleadingly depicted the original test. This second test is designed to help debunk some of the FUD generated by the poor media coverage, by replicating the situation they misleading led readers to believe were the conditions of the first test.

Re:A Different Test

[ZoOnI]

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!"

Your analogy could better. It would be more like you have an apartment in a secure apartment building you shouldn't be able to get into other peoples apartments unless you are the apartment manager. But you find a way and other people and there property are not safe.

But how often do you allow someone into your machine? For A desktop, not often, perhaps never

If Macs are used in library or other public place people could get admin access collect users info or add programs to those machines to do harm. If those machines are in shared areas of a University then students can have finances and property at risk.

Re:A Different Test

[farble1670]

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.

uhhh. no. that would be true if users were offered a local root account. they weren't. it was a regular user account. if a regular user account can hack a machine, what's the point of having user privs at all? windows 95/98 had it right i suppose.

a better analogy would be: i'll leave a window open to a locked bedroom, and see if the anyone gets into my other locked bedroom. if the thief can do it, it doesn't say much about the locks on the bedroom doors.

Re:A Different Test

[saltydogdesign]

You do know that a perfect analogy is, in fact, an identity, right?

Re:A Different Test

[funk49]

All the noise about Windows getting hacked 4 minutes after it was connected to the net was due to lack of firewalling and vulnerable services - turn on firewalling and the vulnerable services are no longer accessible. What does that prove? nothing - they didn't magically become secure. OSX probably has fewer vulnerable services (active or not) but that was not the point.

I know one large security vendor with what is likely the best R&D department in the world that PWNED Windows SP2 machines running the firewall as early as the alpha release. The security that is provided by the MS FW is a smokescreen at best.

There are too many threat vectors in Windows to make the default FW effective.

Re:A Different Test

[hvatum]

The point of the original test was not to hack the machine from outside, but from inside. All the noise about Windows getting hacked 4 minutes after it was connected to the net was due to lack of firewalling and vulnerable services - turn on firewalling and the vulnerable services are no longer accessible. What does that prove? nothing - they didn't magically become secure. OSX probably has fewer vulnerable services (active or not) but that was not the point.

No, the point of the orignal test was to provide fodder for a pointless, sensationalist and outright misleading article. Given the original wording of the article the argument that "your test is utterly irrelevant for the type of people that would be interested in the original one" is patently false. People who were interested in the "original test" would not have even known the original article concerned such a test. The original article never mentioned what was being tested.

This new test has in fact forced ZDnet to change the wording of the article to make clear what was even being tested in the first place. So instead of one useless ambigious article we have two informative tests. The desinger of the second test has done us all a large favor - unlike antagonistic pedants like you.

Re:A Different Test

[TubeSteak]

Oh boo.

You can prove anything with science if you setup your question, assumptions, parameters/criteria inappropriately.

Schroeder is saying that the parameters/criteria surrounding that previous test were invalid and do not support the conclusions being drawn from it.

Stalyn (662) is obviously not new here, but did you RTFA?

Maybe you're just jaded from years of Mac is teh b3st vs n00b, W1nd0wz is t3h 4wes0m35t

Re:A Different Test

[dougmc]

You do know that a perfect analogy is, in fact, an identity, right?

Sure, but then it's not an analogy at all, since an analogy is a `similarity in some respects between things that are otherwise dissimilar' -- they have to be `otherwise dissimilar'.

The problem is that home security is very different from computer security, and so most analogies that people attempt to make confuse the issue more than they clarify it. The one made in this thread comparing a priviledge escalation to being locked in the basement was actually pretty good, but comparing it to somebody stealing something from your house was pretty bad. (Though it could be improved with little effort by replacing `stealing anything' with `altering a document locked in your safe.' Still not perfect, but far better.)

mekkab feels that analogies are a must, needed to simplify things. I tend to disagree in general, but do agree that sometimes they're useful, especially when broken down to their simplest level (like talking about a lock/key vs. talking about an entire house.)

Re:A Different Test

[adam1101]

Of course, I'd have no problem with this if the original article had actually talked about it meaningfully in the context of a local privilege escalation and explored the implications; instead, they just made it sound like you could throw a patched OS X box onto the internet and it'd get owned. The average reader would leave with that *distinct* impression, and most of the subsequent coverage of it talked about it exactly in that fashion.

So your main problem is the press coverage? How is your "challenge" going to change that? If your box doesn't get cracked by Friday, would ZDNet run an article titled "Mac OS X not hacked in five days" ?

Re:A Different Test

[Anonymous Coward]

You said, "Now, I run linux at home because I need something which plays well with the network. I can log in remotely, run programs, upload and retrieve files, etc. I tend to find the distinction between "desktop" and "server" blurs, because I want to be able to access my computer from anywhere."

I tend to call them laptops. :-)

Re:A Different Test

[Anonymous Coward]

if *any* programme is exploited/owned then you could get root access from there

if ur hosting using the mac or if ur running a big website then other people may a legitimate need for an account on the machine, but you don't want to give them complete control.

Re:A Different Test

[asdfghjklqwertyuiop]

The OS was Slackware linux. All of the accounts were jailed, and all of the "best practice" measures were taken to harden the box (I can't comment on every detail as I am not a linux system admin).

Well no, obviously he missed something. It was a walk in the park because he left some well-known vulnerability on his system, possibly in the kernel. I don't think Slackware blows off local vulnerabilities and doesn't bother releasing fixes.

My point is that when a malicious user gains shell access to any *nix system, you're in deep trouble.

No you aren't. There are plenty of companies out there that will grant shell accounts. I grant shells to friends and friends of friends on my own server. There are even places places out there that will give them to the public for free. The key is the system administrator has to know what they're doing and you have to be running an operating system whose designers and maintainers take local security seriously.

It IS doable.

Re:A Different Test

[Anonymous Coward]

*sigh* are you guys hopeless? The point of the original test was not to hack the machine from outside, but from inside.

This was the point of the original test, yes.

However the problem is that this was not the point of the original test as presented in the ZDNet article.

So, to summarize:

* Guy does OS X privilige escalation test.
* ZDNet writes story saying "GUY DOES OS X HACKING TEST!"
* Dave Schroeder fellow goes "Hey, that wasn't a hacking test, that was a privilige escalation test. This is a hacking test."

Re:A Different Test

[Deathlizard]

All this second test is proving is that OSX is secure from a Remote attack. Any OS (And I mean Any OS) can be secured to survive one of these.

What the ZDnet attack was trying to prove was a Local attack is possible in OSX. There's a ton of bull out there that states that OSX can never be affected by malware, and the ZDnet test proved that wrong hands down. It doesn't matter that he had shell access because your standard user will have that level of access. What matters is that he did it using a standard user accout that most OSX users are going to have when they first pull the machine out of the box and use it. It only means that now you have to trick the user to run something to hack it for you, and that's very easy to do.

The ZDnet article may have not been the best written article, but that doesn't change the fact that the box was locally exploited, which in the hands of a good social engineer and a stupid user, results in a local to remote exploit and a possible virus.

Re:A Different Test

[bemenaker]

You're point is? A privilage escalation test IS A HACKING TEST. DUH!!!!!!

Re:A Different Test

[Anonymous Coward]

Seriously, having ssh access or not to a hosting account is completley irrelevant, the only people you deter this way are script kiddies.

The web server itself is a shell that can be used to do just about anything you can do from an interactive shell.

Hell, you can even open an interactive shell without having local logon privileges using xterm.

Re:A Different Test

[Just Some Guy]

all of the "best practice" measures were taken to harden the box

No, they weren't. If all the filesystems that customers have write access to are mounted "noexec", then self-compiled binaries don't present a lot of exposure.

I'm not saying that it's not a good idea to remove GCC, just that its presence isn't an automatic compromise.

Re:A Different Test

[TheNetAvenger]

Exactly. If you wanted to truly compare OS X to Windows in this scenerio, put a PC on the Net with TS opened and give out the user account information

Not to be an ass, but there are 100s of open accounts all of the internet with TS enabled and client and guest logins allowed for companies to showcase their software.

This is one of the things people actually do with TS is use it for software demonstration purposes, and people are 'encouraged' and 'allowed' to sign into Windows 2003 servers to test software or concepts the companies are selling or demonstrating.

If you think that there are no Windows Servers on the Internet that meet the exact same setup criteria as the MacOSX orginal test had, you really need to get your head out of Steve Job's butt and see what the real world is doing and not just what he wants you to see.

And BTW the same is true for many different OSes and *nix variations, there are 'guest' and local account access for public use, this has been around a LONG time, I don't understand how Mac Users think this is unfair or even unique? What do you freaking think XWindows was designed for? Do you realize that it is used for 'guest' accounts and distributed applications all the time?

As for SSH not 'usually' being open, you would be surprised of the number of people that DO run with either SSH, an XServer or even MS's RDP type of technologies on and enabled, like for example 99% of the Web with headless servers.

If it weren't common or safe, you wouldn't see different OSes have remote 'guest' accounts for customers all over the place.

Here just to demonstrate I'm not making up the remote access account senerio and how predominate it is, do a search on on like Web Hosting, SSH, XServer, RDP(Remote Desktop/Terminal Services) access...

I know of several examples of companies that use Remote Desktop type of technologies (not just SSH) to allow ANY customer to have full login access via (TS/RDP) to Windows Servers to testdrive their software. Do a search on these for yourself to see they exist, I won't post links to watch these companies get /.ed or become a target for attempted hacking.

Re:A Different Test

[ichin4]

[A privlege escalation vulnerability] doesn't prove that Mac OS X is "insecure"...

I beg to differ. This is precisely what it proves, if "insecure" is to have its normal meaning of "someone gets to do something that the system is designed not to allow him to do".

Re:A Different Test

[Anonymous Coward]

10,000*365.25*1000=3,652,500,000

Re:A Different Test

[jav1231]

First, my head isn't up anyone's ass. You should really calm down. I responded in spirit in which it was given. Your entire rant mentioned only server OS's. I realize that it's UNIX base makes OSX more like a server but that's really beside the point. How many XP boxen are on the Net with TS opened? AND of all of those TS servers you mentioned, how many are in a DMZ scenerio? How many were hardened?
This test was spun in such a way to make it appear that someone could merely put their machine on the Net and have it hacked. The truth was, there was a remote login opened for the hacker. Was there still an exploit? Absolutely! Should Apple address it? Definitely. But was it a fair and open test? Wait, was the COVERAGE fair and clear? No.

Re:A Different Test

[Anonymous Coward]

You can prove anything with science

That's funny. If you ask real scientists, they'll tell you that science can't prove anything. All you can do is test a hypothesis. Mathematician prove things.

Re:A Different Test

[kaffiene]

Thank you - one of the few sane posts on this topic. Everyone has these issues (local permission escalarion), but they are significant and shouldn't be ignored by flag-waving fanboys.

Re:A Different Test

[hvatum]

Yes, that was my point. The original article strongly implies that remote vulnerability alone is being tested. Were it not for the second test ZDnet would have likely never changed their article as to make it clear that they were indeed testing the likelyhood of a local attack.

So now we have a test of remote vulnerability and second test of local security, whereas before we had one article full of misleading drivel.

Re:A Different Test

[kaffiene]

You say that as if permission escalation isn't important. I totally disagree. Any multi-user system needs to take that situation seriously. So the original article made Macs look bad - so what, I don't care. I *do* care that it raised a serious security issue that no-one seems to be concerned about since internal security doesn't matter on Macs according to the fanboys.

Re:A Different Test

[NutscrapeSucks]

ll these trolls seem to think it's perfectly natural that you'd let hundreds of anonymous users into your system,

That's been the Unix use-model since pretty much the the beginning. Unix wasn't invented to run locked down webservers -- it was designed to provide interactive shells to tons of semi-anonymous students / ISP customers / etc.

(Yes, it's not ideal, but yes it's supposed to be "secure").

Re:A Different Test

[Lockejaw]

Humor appears to be lost on you.

Re:A Different Test

[Lockejaw]

Actually, I regularly do all of that on my laptop. And given the way I've arranged my desk, the distinction between "laptop" and "desktop" is getting a bit blurry as well.

Re:A Different Test

[TheNetAvenger]

First, my head isn't up anyone's ass. You should really calm down. I responded in spirit in which it was given. Your entire rant mentioned only server OS's. I realize that it's UNIX base makes OSX more like a server but that's really beside the point. How many XP boxen are on the Net with TS opened? AND of all of those TS servers you mentioned, how many are in a DMZ scenerio? How many were hardened?
This test was spun in such a way to make it appear that someone could merely put their machine on the Net and have it hacked. The truth was, there was a remote login opened for the hacker. Was there still an exploit? Absolutely! Should Apple address it? Definitely. But was it a fair and open test? Wait, was the COVERAGE fair and clear? No.


Ok, I actually apologize, as my initial response was to be directed at your comments, but went more into a general rant directed at all the people that don't realize this is more common than they realize and not a biased test of OSX.

So I do apologize for it seemingly be directed at you, when it wasn't after I was done writing.

As for the Unix/OSX debate, this is something you have to give and take on. Mac OSX is not Unix, but a Unix type OS. However, it common in the 'new' Mac world to see OSX in the same class as other standard classic and new Unix OSes. Mac users can't have it both ways, and use this as an excuse when OSX fails to live up to hype that Apple actually generated.

But with that said, WindowsXP (non-server) does not allow a non-administrative level user to use RDP(Remote Desktop), so there is no way to compare WindowsXP in the same scenario, the only commonality here is Windows 2003 server is the 'same code base' as WindowsXP, but does allow guest (TS/RDP) logins, and is something used quite a bit. In the Windows world SSH and Telnet type of technologies are not predominate, so there is not a good comparison here, even though a WindowsXP or Windows Server can be fully administrated using this type of technology.

Oddly, Windows has actually surpassed the 'non-command line' model, and 99% of all remote access and administration is done using a GUI and GUI based tools. (Which is strange as the ease of administration has passed XWindows technologies and even the inherent Mac world technologies for use and management.) - For example, in Windows you don't ever have to drop to a *nix type terminal (or Command Prompt) to change settings or do things locally or remotely, which we are now finding advanced Mac OSX users doing, and are still common in most of the other *nix OSes. XWindows was originally the poster child of a GUI protocol to leave command line usage and administration in the past, and 20 years later, it has been fragmented by its openness to still not deliver this. (Not that openness is a bad thing, but when some standards are left a bit loose, they don't ever get tightened by any leaders.)

You are right about the ZD article being jaded, and I do get it. However, what is being missed here is the article is basically demonstrating OSX is not any better than any other OS, which a lot of Mac and OSX users are finding a slap in the face. Even with OSX abstracting the root from the basic level of user operations, it is not 100%, even though it 'appears' to be, and Apple would love for people to believe it is. Other *nixes do a better job of abstracting User Login levels from root than OSX does.

OSX does well, but it is not perfect, not better than other OSes in this regard and certainly NOT 100% safe, even if permissions have been reduced to nothing. Policy management on Windows can do the same, but it still isn't 100% either.

(And no I am not arguing Windows is one of the OSes that does the root abstraction right, in fact they are the poster child of being the opposite, and this is also the evil double edge sword for MS. Their OS is built upon years of 3rd party application compatibility that allows programs to run unfettered on NT without regard to the NT security system. If Microsoft would have forgone t

Re:A Different Test

[Anonymous Coward]

You are correct that the original analogy was incorrect, however your "basement" analogy is even worse.

This "challenge" was just a test of the security of SSH, not the OS itself.

Sensational media bullshit is an apt description if you ask me. (did you ask? :-)

Re:A Different Test

[arminw]

....Desktops are often shared among members of the family, and even friends that are visiting. Your fourteen year old son's friend comes over, jumps on to check his email- he has access......

If a person has physical access to your computer and comes prepared to hack it, there is nothing that can secure it. Bring a laptop and a firewire cable. Reboot the victim computer in disk mode and use it as an external drive on the laptop. Booting from an OSX installation disk should also allow a new admin password to be generated. Apple tells you that's what you must do if you forget your password. 99.99% of all computer attacks come from the network. What will make OSX MUCH safer is unplugging it from any network and keeping it in a locked room guarded by a mean Rottweiler. The next level of safety is turning it off entirely and put it in the doghouse with the Rottweiler.

Re:A Different Test

[arminw]

....Local access can be gained by.....

Why even bother talking about local access as a security issue? All an attacker need to do is bring an OSX installation CD and boot the computer with it. After that, reset the password and go from there. If the computer is not physically secure, the thief might just steal the whole thing and be done with it. I could also use the computer to be hacked as an external firewire drive on an old TI Powerbook running OS9 and do anything at all, since OS9 ignores all permissions.

There is no way any computer can be secure if the attacker has unhindered physical access to it.

Re:A Different Test

[jav1231]

I don't want to take this on point-by-point. I think there are ways to have a user-level access XP remotely with other tools so a better comparison still could have been made.
In the long run, you are right. OSX is not perfect. I've supported Windows for many years. I'm very familiar with it and only recently switched to OSX for my main system. Their were several reasons for that. Windows doesn't offer the same set of tools as a *X based systems. Most importantly, the reduction in spyware and viruses mean I don't have to worry about my family PC becoming a little breeding ground for them. Are there problems with OSX? Sure. But when you look at the big picture, Windows is by far the most vulnerable system to be running on a regular basis. Can it be done? Sure. I have a friend who runs zero AV software and doesn't get infected. He, however, and knows what he's doing. I could do the same. I, however, have two daughters and a wife who could not.
One big problem I see lately is, a worm or exploit comes out that targets OSX and Windows users yell, "AH!" Given the thousands of exploits and huge outages that Windows exploits have caused, this is a bit short-sighted.

Re:A Different Test

[99BottlesOfBeerInMyF]

You say that as if permission escalation isn't important.

Permission escalation is important, but it is not as important as providing protection against remote exploits, which is the most common vector for attacks, especially on a desktop OS. Over-hyping the problem is both deceitful and counter-productive.

So the original article made Macs look bad - so what, I don't care. I *do* care that it raised a serious security issue that no-one seems to be concerned about since internal security doesn't matter on Macs according to the fanboys.

It's not that it doesn't matter, it is just that it does not matter as much. Apple fixes 5-10 of these each month in their security release, a good number of which are found by third parties. The same is true for Linux and pretty much every OS anyone uses as an everyday desktop (except Windows they don't bother fixing the thousands they have outstanding). It is just a fact of life. There are ways to fix this and I hope Apple eventually does so, but the truth of the matter is this will affect only tiny portion of users. Most non-server editions of Mac OS X are used by one person and the majority of the rest are shared by a family of trusted users. The only large segment where this is a concern is schools, but students usually have physical access to the box at that point so they can gain privileges in an easier way. If you're using OS X or a standard Linux distro to give out shell accounts to random people you are almost certainly going to get burned. You want one of the select few OS's that make security the number one priority, like SELinux, OpenBSD, or TrustedLinux. Of course don't expect it to be a functional desktop, since making them so is not a priority for them.

All the first series of articles has done is mislead the clueless. Security people know the score for local escalations. Clueless users don't know and mostly don't need to know about local escalations. They see security as a single attribute that OS X has and Windows doesn't. Now, maybe a few more people will stick with Windows because even though OS X is orders of magnitude more secure, they were led to believe otherwise by these irresponsible articles. The net result: less secure computers in general.

Re:A Different Test

[TheNetAvenger]

I think there are ways to have a user-level access XP remotely with other tools so a better comparison still could have been made.

There are, but the default remote access tools of XP is RDP technology in the GUI, sure you can do PC Anywhere or other tools. And there is built in Telnet, and you can also download the free Unix subsystem, and access and the system via SSH.

You are right about OSX, but I know this also gets said by both sides of the issue a lot. NT was in the same area OSX is now, we didn't need Virus checkers for NT 3.1-3.51. Viruses failed on NT due to security. It wasn't until NT admins got cocky and NT got popular that Virues were even written for NT.

So don't for a second think OSX couldn't have the same road if Apple doesn't stay on top of things. Apple does have an advantage, as NT was a network OS in a world of a lot of closed systems. Where OSX and Apple were able to watch the Internet and the problems of exposure that they watched all OSes be subjected to, even some of the 'robust security' *nixes.

Also, don't discount MS, they haven't given up, nor are they stupid, they should find the balance, even XP now with SP2 and MS Anti-Spyware is quite free from problems or any security issues, and is freaky stable. Vista will be were MS makes or breaks their name in pulling off security by shifting the balance fully the other direction. So the next year will at the very least be interesting.

Take care and again sorry for the long posts...
The Net Avenger

Re:A Different Test

[johan-toan]

Well said!

The different tests obviously represent two very different scenarios, both of them interesting in their own way.

Re:A Different Test

[oc255]

This is an incredibly interesting point (seriously). I never thought about the OSX administrator prompt (where you type in your password like sudo) as a negative.

But, I wouldn't consider it a major flaw. For one, how are you planning on popping a program up at will on my desktop? If you have a trojan, why aren't you logging my keyboard input? If you are a webpage or applet, I see an application border ... maybe there are other ways.

You could use my home dir (which the user has write access to). Suppose I downloaded an app into my home directory and it emulated the OSX sudo prompt/administrator prompt. Let's call it ~/BadJuju.app and I think it's a nifty text editor.

But it wouldn't ever fire off. Let's say I install an OSX security update which needs to write to / somewhere. The update downloads, it tries to write to some file or folder outside of the user's directory and the system prompt is displayed. The fake administrator prompt ~/BadJuju.app is not executed, /Library/realapp.app or whatever the Admin prompt is launched as usual.

So what you'd need is to replace the system files with fake ones to trick me. And that's called a rootkit. sudo works the same way in *nix. You could prompt with a fake sudo and collect root passwords all day long.

But your point is still scary to me ... if your installer prompted for the admin password, you might catch a few more people. Big software packages in OSX usually require admin privileges. But at that point, you might as well just fire your payload, trojan or bad juju since you have admin access (assuming I'm an admin) and my password.

Vista is probably going to work like this. So unless you have a really nice, usable and usable (I said usable twice) way to replace this, it's not a major UI flaw. It's actually one of the best things IMHO because I see how 'intrusive' a program is in a day-to-day way.

But, good point squiggleslash.

Re:A Different Test

[geoffspear]

Analogies are indeed a MUST. and M-U-S-T must must must. Sorry, but sometimes you do need to reduce things down to a simplified set.

Yes. And those times are when you have no convincing argument against your opponent's point, so you M-U-S-T must must must construct a straw man.

Re:A Different Test

[mekkab]

sigh.

Fine. I'll use Searle's Chinese Room as an analogy. It depends on where you draw the line between inside and outside. And that was my point.

Feel free to disagree.

Re:A Different Test

[squiggleslash]

For one, how are you planning on popping a program up at will on my desktop?

Either make use of a remote vulnerability, should one exist, or, in the mean time, trick the user into running something.

At this point, the virus or trojan will have ordinary user privileges (even if the user's admin), so it's still going to need to get itself escalated some how to cause serious damage. It can, if the user's an admin, change a few programs in /Applications, but it has to be careful if it wants to avoid detection. For example, if the program is likely to be launched because the user is opening a file with it, then OS X (at least, any versions released or patched in the last year) will actually warn the user.

If you have a trojan, why aren't you logging my keyboard input?

Because, at this stage, I can't. If I need your admin username and password, then it's safe to say I have no way of getting root access at this stage. I need root access to log keyboard input.

If you are a webpage or applet, I see an application border ... maybe there are other ways.

This particular flaw would probably not be that useful to a webpage or applet type attack. The malware needs to have a certain amount of local access to be convincing. I don't just mean because of borders, but also timing. If a username/password box is thrown up in the middle of nowhere, it'll alert the user something's up. If it runs when Software Update is apparently running (either because the trojan has launched something with a similar icon, or because the trojan just sits in the background waiting for it to run, immediately pausing the process and then putting up its own dialog), then it'll be difficult for an end user to tell they've been screwed.

It's actually one of the best things IMHO because I see how 'intrusive' a program is in a day-to-day way.

Nah, it's a flaw. The problem isn't that OS X asks your permission, it's that it prompts for a username and password. If OS X just asked your permission, an application that put up a fake dialog wouldn't have any extra information it can use to raise its own privileges. Therein lies the flaw.

Re:A Different Test

[Anonymous Coward]

WTF, mods on crack! This guy is just trying to help ya know

Re:A Different Test

[lisaparratt]

Obviously you keep very different things in your basement.

Someone locked in my basement wouldn't be going anywhere! *whip crack* ;>

DDOS

[BJZQ8]

I think that this will probably turn into a DDOS rather than an outright hack...

Re:DDOS

[Anonymous Coward]

> I think that this will probably turn into a DDOS rather than an outright hack...

Pffew ! It's one of the few URL's mentioned on the front page of Slashdot that's still reachable (and quite quick at that !) of late ...

Hackorama Windows

[CDMA_Demo]

I wish someone running windows 2003 professional could start a competition like this.

Re:Hackorama Windows

[racebit]

"I wish someone running windows 2003 professional could start a competition like this."

A competition to crack a win 2k3pro server isn't a competition, that's a free-for-all.

Re:Hackorama Windows

[rabbit994]

I'm sure Microsoft has held competion to do so as well. Windows 2003 is pretty secure out of the box as well considering almost no services are in the ON state and it comes with a GUI firewall in SP1. Microsoft has a long way to go but you can't fault them for not trying.

Re:Hackorama Windows

[Anonymous Coward]

Winning a 'hack my windows box' competition is like getting 'first post' on slashdot. It's not hard, you just have to be quick.

Re:Hackorama Windows

[IflyRC]

Windows 2003 Professional doesn't exist.

1) Windows XP Home

2) Windows XP Professional

3) Windows Server 2003

Re:Hackorama Windows

[Anonymous Coward]

"I wish someone running windows 2003 professional could start a competition like this"

Well, they *could*, but they probably know better.

Re:Hackorama Windows

[WWWWolf]

I'm sure Microsoft has held competion to do so as well.

Microsoft did a Windows 2000 hacking competition. I think they claimed a success or something.

I can't remember much of the details except that it was covered in Slashdot. The server itself was pretty damn unresponsive all the time through. I remember they had a log of stuff that showed a suspiciously large number of reboots. (I can't remember if "Changed the desktop wallpaper, needed to reboot" was someone's attempt at humor or a genuine entry, I suspect the former =)

Re:Hackorama Windows

[evil_tandem]

i actually saw one. and i've tested it myself. i just installed win2k3 on a machine, hooked it up to a t1 and left it for a week (monitoring the traffic). lots of people found it but no one i saw ever got in.

win2k was a completely different story. i did this test with that and people were in by the end of the day.

Re:Hackorama Windows

[trintron]

Windows 2003 Professional aka Windows XP Pro x64 Edition.

Re:Hackorama Windows

[Mark Kroehler]

First, get the version right, dimwit. Second, they already did. http://it.slashdot.org/article.pl?sid=05/05/05/182 6248

Re:Hackorama Windows

[guy-in-corner]

Correct. To clarify, Windows 2003 comes in Standard, Enterprise, Datacenter and Web editions. There is no Professional edition. There are Windows 2003 R2 versions of Standard, Enterprise and Datacenter.

See the feature comparison page for more info.

I'm not entirely sure why MS chose to call it R2, rather than Windows 2005, but that's marketing for you.

Re:Hackorama Windows

[geekee]

"I wish someone running windows 2003 professional could start a competition like this."

Yeah, because there aren't any Windows 2003 professional boxes on the web running web servers.

Logs

[Bromskloss]

Mabye logs could be published (in real-time) so that we all can see some of what possible challengers are up to. That would be interesting.

Re:Logs

[Zemplar]

In effect, that would turn into a DDOS quite quickly once the logs grow and site traffic increases exponentially. Still, the idea would be cool to see...perhaps if hosted on one of Sun's 8-core Niagara chips instead of a Mac Mini.

A hybrid solution would be a summary of the logs and perhaps a popularity percentage and other "smart" metrics.

Re:Logs

[Saevio]

Couldnt this be done with something similar to a real time RSS Feed?

Re:Logs

[tolan-b]

The logs could be served from another box.

Or perhaps just published after the challenge.

Re:Logs

[Zemplar]

True, but would not the access from another box provide another potential breach point and statistically skew our security findings?

Re:Logs

[kminchau]

Here is a sample log:
2006-03-07 08:21:24 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:25 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:26 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - 72.33.255.254 pawn yo!
2006-03-07 08:21:28 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:29 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:30 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
2006-03-07 08:21:31 66.35.250.150 - 72.33.255.254 80 GET /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
....

Re:Logs

[feronti]

Not really... the contest machine just needs to periodically push the logs to the publishing machine. This can be done without opening up anything else. There's a slight increased risk of DOS, but if you're generating enough log entries to DOS the machine, your connections alone are probably enough to do the job anyway.

Re:Logs

[Zemplar]

Yep, I even thought of this later after I finished my cup of coffee. It wouldn't be "real-time" but could be sufficiently close to be useful.

Re:Logs

[Anonymous Coward]

Most RSS readers have a delay between checking for updates - an hour or so, so it wouldn't really be realtime. But it would be easy to do, yeah.

Kinda funny

[faloi]

Wouldn't the people that can do it, assuming they're out there, most certainly not do it on a machine that can be used to identify their methods? After all, if they were doing it for security research legitimately, they would've already told Apple...or the entire Internet if they felt Apple wasn't being responsive enough.

Re:Kinda funny

[garaged]

It's an incentive to search new vulnerabilities too

I think that is a good reason to make something like this, appart from the press attention

* yawn *

[Noryungi]

I am sorry, but what exactly does this prove? That ZDNet is wrong? That Mac OS X is secure?

It proves neither: every operating system on the face of this earth has been hacked, cracked, and 0wned. Numerous times. Get over it.

Instead of inane, immature competitions such as this one, I'd rather have a nice manual (RTNM -- Read The Nice Manual) on how to improve/lock down an OS X machine. Even better, make that two manuals: one for the average joe, with nice color screenshots for every step that has to be taken, and another for people like me, who manage systems for a living. THAT would be a valuable contribution to the field of computer security, instead of this stupid challenge.

Re:* yawn *

[Yahweh Doesn't Exist]

you'd only need one manual, and it would say:

"don't open all ports and turn on all services and turn off the firewall and give everyone who asks a local ssh account and post your IP on the internet with a challenge to be hacked"

Re:* yawn *

[Anonymous Coward]

The NSA has just such a document.

http://www.nsa.gov/snac/downloads_macX.cfm?MenuID= scg10.3.1.1

Next time, considering knowing what you're writing about, before...you know...writing.

Re:* yawn *

[plate_o_shrimp]

[quote]I'd rather have a nice manual ... on how to improve/lock down an OS X machine.[/quote] There's this..... http://www.nsa.gov/snac/downloads_macX.cfm

Re:* yawn *

[sjonke]

The one for the average user would look like this:

    1. There is no step 1.

SSH and everything else is off by default and the average user won't enable them, probably won't even know how to enable them.

Re:* yawn *

[Fahrvergnuugen]

"Instead of inane, immature competitions such as this one, I'd rather have a nice manual (RTNM -- Read The Nice Manual) on how to improve/lock down an OS X machine."

You can start by not giving out shell accounts to users who are trying to root the box ;)

Re:* yawn *

[cunamara]

The National Security Agency has a PDF based handbook on securing OS X. It's a bit outdated (written for Panther 10.3.x). Is that what you were looking for?

Re:* yawn *

[frdmfghtr]

Try this one...I'm not experienced enough with OS X (or *nix of any sort) to really make good sense of it, but what I was able to understand and apply made sense.

http://www.corsaire.com/white-papers/050819-securi ng-mac-os-x-tiger.pdf

Re:* yawn *

[NutscrapeSucks]

SSH and everything else is off by default and the average user won't enable them, probably won't even know how to enable them.

Right. So what's the point in enabling them for this "security challenge"? If the goal is to enulate a server environment, why not a OS X Server machine? A desktop Mac is far more likely to have SMB and AFP turned on than SSH -- why aren't they enabled?

Re:* yawn *

[Anonymous Coward]

The one for you is allready made. Its on the NSA website.
Just search for Mac OS X

Re:* yawn *

[Anonymous Coward]

It proves neither: every operating system on the face of this earth has been hacked, cracked, and 0wned. Numerous times.

Oh yeah?

There's a challenge going on right now to prove that! Try to change the web page at test.doit.wisc.edu/

Re:* yawn *

[Tacvek]

every operating system on the face of this earth has been hacked, cracked, and 0wned. Numerous times. Get over it.

Ok... I'm sure most operating systems have been hacked, but all?

Here is a short list of OS's that have not had remote explit vulnerabilites that I am aware of (Some probably have had vulnerabilities):

• MS-Dos

• Z/OS

• VMS

• ReactOS

• RISC OS

• AmigaOS

• Plan 9

• CP/M

• Commodore BASIC/KERNAL

Fairly obscure OS's:

• IBM's Basic Operating System

• BugOS

• GCOS (formerly GECOS)

• i5/OS (formerly OS/400)

• MenuetOS

Anyway I'm pretty sure at least one of those has not been exploited. And I did not even include embedded operating systems.

Possible Danger

[zaguar]

Email das@doit.wisc.edu if you feel you have met the requirements, along with the mechanism used. The mechanism will then be reported to Apple and/or the entities responsible for the component(s).

With virus/spyware becoming a multimillion dollar business, do you really think that the real hackers (sorry for the use of the term) will stay away from this, due to the this very condition. Do you think that the dangerous exploits and cracks that are, for the moment, unknown by Apple, and are hence, very valuable. They will not be willingly sent to Apple for some minor publicity and no material, no, they will be auctioned off in some sleazy IRC channel in Russia.

Re:Possible Danger

[Anonymous Coward]

Considering there is no malware to date for OSX and not alot of OSX servers, I doubt they are as valuable as you think. This would probably be a good point if they where taking a shot at windows 2003 server though...

Re:Possible Danger

[zaguar]

No, the lack of malware makes the first malware package, and the associated virus/trojan etc. even MORE valuable.

Re:Possible Danger

[Anonymous Coward]

No. You are implying that there is a market for OSX exploits. If this is true, than OSX is pretty damn secure since we haven't seen any malware yet. So either:

1)No one is interested enough, so the exploits are less valuable than a moment of fame hacking this box.
2)There is a market for OSX exploits, but noone is competent enough to create malware for OSX.

I wouldn't throw money at an exploit if it had no use to me ;) So, pick your poison...

Re:Possible Danger

[vertinox]

They will not be willingly sent to Apple for some minor publicity and no material, no, they will be auctioned off in some sleazy IRC channel in Russia.

Great idea... I just used my credit card and got this file from @russian_hack3r of IRC which I am willing to paste here to show off my l33t skills:

Contents of OSX_Hack.nfo

Step 1: Make a text file with the name OSX_Hack.nfo
Step 2: Copy and paste following the body of this text file into that text file.
Step 3: Auction the text file off to some dumbass on IRC that thinks there is profit to be made with an OS X hack.
Step 4: ????
Step 5: Profit!

Oh wait a minute....

Re:Possible Danger

[Ford Prefect]

Oooh! Oooh! I'll give you two hundred dollars cash for a copy of that file!

Re:Possible Danger

[99BottlesOfBeerInMyF]

They will not be willingly sent to Apple for some minor publicity and no material, no, they will be auctioned off in some sleazy IRC channel in Russia.

I have little doubt there are remote exploits for OS X "out there" in the hands of a few security experts and crackers. And these people are not likely to respond to this challenge unless they have a large number of them and feel like show boating. If one of them does compromise this machine in short order, well it means one of two things: either security is a lot worse than most of us think or someone smart who normally would not be cracking decided to make it their mission and find one.

The point of this challenge is to undo some of the PR damage done by the sensationalist presentation of the last test, which was hyped by the media in such a way as to mislead the majority of readers. This test is written to be similar to what most readers thought the previous test was, based upon the misleading articles that were widely spread. 99.99% of users are not going to be attacked by one of these rare experts, instead of script kiddies or worms. Those few who are likely to be attacked should be running a more secure server OS and more secure configuration anyway. All of this is news only to people who are not in the security field in the first place, like those who read and were mislead by the articles about the previous "test."

Re:Possible Danger

[amliebsch]

The point of this challenge is to undo some of the PR damage done by the sensationalist presentation of the last test, which was hyped by the media in such a way as to mislead the majority of readers.

The real mystery to me is why a state employee is using my tax-funded resources to do so.

Re:Possible Danger

[99BottlesOfBeerInMyF]

The real mystery to me is why a state employee is using my tax-funded resources to do so.

Well, it is educating the public and it does have some value as a research project, especially if students are able to analyze a remote exploit. Not knowing what part of the university is doing this, however, I'm not really sure that it is a "proper" use of resources.

Re:Possible Danger

[amliebsch]

Well, it is educating the public and it does have some value as a research project, especially if students are able to analyze a remote exploit.

All commercial advertising is "educating the public" in some sense - that doesn't make it a legitimate mission of a state university.

the original post

[rayde]

here is the original comment posted by Dave Schroeder about this challenge pretty much posted right after the 30-minute hack article was posted here. I'm actually quite curious whether the University of Wisconsin has approved this whole thing, as I'm not so sure they really wish to have a machine on their networks in the crosshairs.

Re:the original post

[daveschroeder]

Yes, this is approved. But it's getting moved to its own /29 today...unfortunately, that didn't happen before slashdot got to it. ;-)

There is an identical clone of that Mac mini waiting to go on the new network, and our DNS TTL is currently set to 5 minutes, so when the cutover happens, it should be pretty transparent.

Re:the original post

[saras]

nice idea, das... "uncle steve"

Does /. win...

[CupBeEmpty]

...if the little Mac Mini melts from a good /.'ing?

Re:Does /. win...

[MacBoy]

Well, this story has been on the /. frontpage for about an hour now, and the website on the Mini still loads in a snap.

Generic smear campaign

[catwh0re]

I've noticed a significant rise in anti-macosx articles recently. To the point where I'm beginning to believe that it is staged. Each article usually has 3 points to make: Mac OSX is not *nix, Max OSX is insecure and "easy" to hack (and not a target due to small install base.) and that Apple are slow with patches to security faults.

So far each article has been based on unique situations that lack credibility to begin with, give little detail, and take focus away from the fact that it's basically a machine running a collective of industry proven software (such as apache and openssh.)

Also of note is that Mac OSX currently has an a user base of over 10 million machines. So the argument that it's too small a target is ridiculous. In fact it's a bigger target as it's untouched territory with a bonus of headline making news.

Re:Generic smear campaign

[grasshoppa]

Who the hell modded this insightful? Let's take this post, and see how they stack up against your 3 points.

1) MacOS is not *nix.

I can't seem to find where that's being said in this article. Maybe you'd like to point that out for me.

2) MacOS is insecure

If anything, this article is a rebuttel against that belief.

3) Apple is slow with patches.

Point out to me where this is even TOUCHED upon in the article. Thanks

Mods: Get your heads out of your asses.

Re:Generic smear campaign

[nicklott]

It's probably just a backlash from the years of mac fanboy articles.

Re:Generic smear campaign

[Tim C]

In fact it's a bigger target as it's untouched territory with a bonus of headline making news.

And headlines are the last thing that the criminal groups creating botnets want.

Re:Generic smear campaign

[NutscrapeSucks]

Also of note is that Mac OSX currently has an a user base of over 10 million machines. So the argument that it's too small a target is ridiculous.

How many of these are server machines running Apache and OpenSSH? Only a tiny percentage -- OS X Server has something like a 0.2% marketshare last I heard.

As per usual, Mac users are overly fixated about their platform's reputation. OS X is a Unix (especially on the server) -- and Unix's reputation is hardly complete airtight security. There's a ton of Unix hacking knowhow out there, which a less competant OS X administrator could fall victim to.

The bottomline is that Operating Systems aren't secure, configurations are secure. So unless there's some horrible flaw found in the default install, I wouldn't get so worked up about how this reflects on your beloved platform.

Re:Generic smear campaign

[bradbeattie]

I'm probably paranoid in thinking this, but is this smear campaign more than just a bunch of disparate writers working independantly? I mention this because it's the exact field my sister is in: corporate PR. She schmoozes magazines, writers, etc on behalf of various companies in an effort to convince the media to show her represented companies' products in a positive light. Would it really be a stretch to think that there are some who try and get writers to bad-mouth a specific company or product? I'm not pointing fingers, but I think it's clear who'd have the most to gain in this situation.

Re:Generic smear campaign

[Overly Critical Guy]

The poster said "usually" and in reference to all recent articles, not one specifically. Lots of the press have said OS X isn't UNIX, particularly in the recent Library/StartupItems articles, because UNIX doesn't allow any old code to run as root. Never mind that this behavior doesn't exist in Tiger.

Lots of press has also claimed that security analysts are unhappy with the speed at which Apple fixes security issues.

Re:Generic smear campaign

[Overly Critical Guy]

How many of these are server machines running Apache and OpenSSH? Only a tiny percentage -- OS X Server has something like a 0.2% marketshare last I heard.

But the ones that do run OS X Server are pretty high-profile targets.

Re:Generic smear campaign

[SharkJumper]

I would guess that it's more a natural symptom of Apple's growing popularity. As something rises to the top of public consciousness, it's going to get evaluated and critiqued. You'll have haters as well as lovers. The other side of the coin is: any press is good press.

SharkJumper

Re:Generic smear campaign

[daveschroeder]

Someone should tell the Army to at least have the url http://army.mil/ work. ;-)

(It seems only http://www.army.mil/ works...something about sites are configured like that bugs me.)

Re:Generic smear campaign

[SoulRider]

Um, MS is releasing a new OS this year, arent they?

Re:Generic smear campaign

[NutscrapeSucks]

The Army is an interesting example, because they moved to MacOS Classic to get away from Unix and it's security complexity. Now it seems like they have a bit of a legacy problem (4D is still around!?) -- legacy nonstandard Mac crap + all the same security pitfalls.

Hacked Pixel #F0F8FF

[digitaldc]

I hacked in, and in 22 minutes changed one of the pixels from #FFFFFF to #F0F8FF, but it is very hard to tell.
In fact, nobody even noticed.

Re:Hacked Pixel #F0F8FF

[Kadin2048]

Oh -- I hacked in and changed it back.

Sorry.

Re:Hacked Pixel #F0F8FF

[ichigo 2.0]

Was that before or after I hacked in and completely removed the pixel, creating a tiny hole in everyones monitor?

Re:Hacked Pixel #F0F8FF

[eyepeepackets]

It was after you hacked in and completely removed the pixel, but before _I_ hacked in and turned your tiny hole into a _black_ hole which will spread over the net, sucking in everyone's monitors.

Oh, and before I forget: YO MAMA!

Cheers

Re:Hacked Pixel #F0F8FF

[hritcu]

I see dead pixels

Dupe!

[tpgp]

This story was a comment a few days ago

I don't think Dave understood the point of the original challenge however - local privilige escalation - or maybe he was just taking issue with the way it was reported on zdnet.

Re:Dupe!

[Anonymous Coward]

If that was the point of the original challenge, then the original challenge is pointless. It is common knowledge in the Mac community that OS X has a large number of unpatched local root vulnerabilities. Many other OSes do as well, so this is not surprising, although OS X's are often interesting in that they arise in different ways than on most UNIX systems. But going through a lot of trouble to prove that OS X is vulnerable to local root escalations is ridiculous.

It is running Apache 1.3.33

[bryankwalton]

If I recall correctly, isn't there some security hole in 1.3.33 that was fixed in 1.3.34?

Re:It is running Apache 1.3.33

[onyx00]

This is the hole: "A flaw in mod_imap when using the Referer directive with image maps. In certain site configurations a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers."

However, because this test is wildly unrealistic, I doubt this can be exploited.

If you want a real test of Mac OSX: Give it to a person who surfs the web between 2- 4 hours a day, and who has no computer security knowledge whatsoever. This is, in fact, the typical Mac OSX user...

Re:It is running Apache 1.3.33

[LittleLebowskiUrbanA]

Give it to a person who surfs the web between 2- 4 hours a day, and who has no computer security knowledge whatsoever. This is, in fact, the typical Mac OSX user...

    Like hell. Most hardcore Linux users I know have a Powerbook.

Re:It is running Apache 1.3.33

[hogfat]

Like hell. Most hardcore Linux users I know have a Powerbook.

And? I presume most people who make comments like that have some knowledge of logic. Unless "most hardcore Linux users [you] know," qualify as typical Mac OSX users -- perhaps we can have some indication that they number well into the millions -- it's completely useless to even consider the apparent implication that hardcore Linux users possess computer security knowledge.

Re:It is running Apache 1.3.33

[Anonymous Coward]

Yes, I'm sure no Windows users can figure out how to use Office, but boy they sure "get" that Office for Macs...Hate to break it to you, but there is about 100 X the software for Windows than Macs.... The only people I know who use Macs on a regular basis are - Professional graphic artists / publishing people, music studios running ProTools. Macs only have about a 5% market share overall.

Re:It is running Apache 1.3.33

[LittleLebowskiUrbanA]

It can go either way. Either we assume all OS X users are clueless and maybe most Linux users are too or we can assume that a good deal of them made an informed decision for a better OS and are a bit mroe savvy. I've never seen a clueless OS X user that can compare to the typical clueless Windows user.

Re:It is running Apache 1.3.33

[Anonymous Coward]

Tell me one specific thing these PC folks can do on a MAc that they can't with a PC then.

I'm not sure what the value of this is.....

[8127972]

Because we know that ANY OS is insecure if it is not properly hardened. What may be of value is for someone to figure out how to harden OS X and then toss that computer on the net and see if it gets hacked. If it doesn't get hacked, feed the method for hardening the computer back to Jobs and company and see if it ends up as part of a future OS update.

Re:I'm not sure what the value of this is.....

[Chanc_Gorkon]

Even harden boxes can get hacked. Don't fool yourself.

Re:I'm not sure what the value of this is.....

[emerrill]

The point of this is to see how secure the OS is w/o hardening, and in a more typical networked situation. For that matter they are softening it to attack compared to the stock configuration.

The ZDnet article simply was not reported correctly, and gave the wrong implications. Even with the added sentence, the article tries to make it sound like its vulnerable to remote exploits and you have to be worried about having your machine on the internet.

Re:I'm not sure what the value of this is.....

[Jim Hall]

For those of us that are thinking about buying our first MacMini for our living room, I find this a very interesting test. Thanks to UW-Wisconsin!

over 15 posts!

[ikejam]

and noone calls dupe?

http://apple.slashdot.org/article.pl?sid=06/03/06/ 1446207

That.. must be a record.

incidentally the original post seems to reflect a more updated view :-s

Re:over 15 posts!

[Stalin]

duplicate -- adjective |?d(y)o?pl?kit| [ attrib. ]
1 exactly like something else, esp. through having been copied : a duplicate license is issued to replace a valid license which has been lost.
2 having two corresponding or identical parts : a duplicate application form. twice as large or many; doubled : duplicate taxes on oil and gas.

If you actually _read_ the /. articles you will see that the word "duplicate" does not apply to them.

Re:over 15 posts!

[MacBoy]

This is not even close to a dupe. It is a follow up. Come one, man, RTFA.

Re:over 15 posts!

[xtracto]

Yep, and one of the comments in that story was made by the original author of the challenge:

Dave Schroeder

I do not know why that comment was not in the main summary.

The IP

[zaguar]

The IP of the server under the test. Saves you a ping of the site.

128.104.16.150

Re:The IP

[Kadin2048]

Is that before or after the changeover? Dave Schroeder (the guy running the test) mentioned elsewhere in the thread that because of the high traffic, the test was being moved to a different subnet, and the IP would change at this time. It was supposed to happen last night.

I see it still works now (7 Mar 0940 EST) but it was also mentioned that the new box is not going to be the same one, but a clone of the original, so it's possible that by using an IP address you could be pointing to the old one.

Re:The IP

[Anonymous Coward]

My computer, at 127.104.16.150, is unhackable. I'd like to see someone prove me wrong.

Re:The IP

[cpollett]

I noticed telneting in that the server is Apache/1.3.33. Googling on the version number there seemed to be two minor flaws in this version. Why didn't they bother to upgrade to 34?

Re:The IP

[flutkatastrophe]

No No No... it's 127.0.0.1
Hack away...

/obligatory

Re:The IP

[Anonymous Coward]

Those patches may have been backported to .33 by Apple, though its certainly worth a try.

Re:The IP

[daveschroeder]

That was the IP of the machine before it moved to its new network. As I described in another post, there are two minis, both identical, with one on the new network so the cutover would be transparent.

The new IP is 72.33.255.254, and will remain as such. Once DNS has propagated sufficiently, the original host will go away.

Re:The IP

[MirrororriM]

Actually, the IP address appears to be 72.33.255.254 as of March 7, 1:50pm EST

Hint

[spike2131]

One of the user names is "das".... as in http://test.doit.wisc.edu/~das/

So run that against a dictionary and see if you can get in....

Re:Hint

[AcornWeb]

Which stands for David A. Schroeder (look him up in Wisconsin directory)

Re:Hint

[Anonymous Coward]

Then the other is guest. And root ;-). Will it help you?

Re:Hint

[kajoob]

One of the user names is "das"

I knew zee germans were behind this!

Re:Hint

[artemis67]

DAS is dead!

Long live Vindows!

Re:Hint

[woodlouse_man]

And I bet the password is "rover" - the name of his dog... Or at the very least "revor".

Re:Hint

[Drizzt Do'Urden]

root account is disabled by default on MacOS X.. unless he openned it up?

Re:Hint

[amliebsch]

No, no, no. The password is "boot".

Re:Hint

[artemis67]

Your Windows PC is my other computer.

Sounds like a series of bumper stickers in the making.

"My kid got root on your honor student's PC"
"Root Happens"
"(I Love You) Stop the Hacking!"

Re:Hint

[Anonymous Coward]

The other user account is "guest" as in
http://test.doit.wisc.edu/~guest/

Here's MY CHALLENGE!

[Dystopian Rebel]

In this age of silly, vapid Challenges to prove the resilience of OS X, it's good to know that there is one formidable Challenge out there...

Come on, I dare you, come on I say and try to hack my G4 desktop running OS X 10.4.5 with Security Update 2006-001. It has FTP, SSH, Finger, Apache, PHP, VB running under WINE, and the extremely vulnerable Robots game running.

Oh! Had enough, eh? Come back and take what's coming to you, you yellow bastards! Come back here and take what's coming to you! I'll bite your legs off!

Re:Here's MY CHALLENGE!

[Otter]

Sorry -- you're running WINE on a G4? How do you do that?

Re:Here's MY CHALLENGE!

[yabos]

Install Linux in VPC then install WINE in Linux?? God that must be so slow.

Re:Here's MY CHALLENGE!

[Bazzalisk]

Nah, use Qemu, VPC is expensive (and has a tendency not to work with some Linuces).

Do over!

[LaminatorX]

This is the sort of test that the previous one purported to be. The other test had the system configured to allow anyone to create shell accounts by remote connections, thus quickly becoming a local security test rather than a test of srver robustness. It probably got forkbbombed or something similar. Not many systems can hold up against a serious attack from the inside. This time around the machine seems to be in a more typical web server configuration. This is still fairly close to default setup rather than a specifically hardenned one. Let us see.

Your wish has been granted:

[daveschroeder]

Corsaire - Securing Mac OS X Tiger

NSA - Mac OS X Security Configuration Guide (not yet updated for Mac OS X 10.4)

Apple - Common Criteria configuration guide

And for the "average joe"?

- Keep your machine patched
- Don't randomly open ports for services you don't use
- Have a personal firewall/router
- Don't run software you don't trust

And this doesn't "prove" anything, except that the initial ZDnet article was totally vague and sensationalistic, making it seem to an average person reading that article that a Mac OS X box could just be "hacked" by being on the internet. That is wrong, and I'm showing that. Simple. It's all explained on http://test.doit.wisc.edu/

Re:Your wish has been granted:

[SolitaryMan]

• Keep your machine patched
• Don't randomly open ports for services you don't use
• Have a personal firewall/router
• Don't run software you don't trust

Excuse me, but an "average Joe" doesn't have to know what any of these words means. Until then, we're bad engeneers.

Re:Your wish has been granted:

[sqlrob]

1) Automatic update is on by default
2) Everything is closed by default
3) Not as important with (2) true
4) This is the big one you'll never get around. People are stupid

Re:Your wish has been granted:

[Fnord666]

See also

Corsaire - Securing Mac OS X Panther

for those still using OSX 10.3.

Re:Your wish has been granted:

[frankie]

"average Joe" doesn't have to know what any of these words means

1. When the Software Update box pops up, click the blinking blue "Install" button
2. Don't touch anything in the "Sharing" System Preferences (ports closed by default)
3. Still don't touch anything in the "Sharing" System Preferences (firewall on by default)
4. When you receive a file that claims to be pictures (or movies, or music), and when you try to open it a box pops up saying "You are about to open this application for the first time, do you really want to?", click Cancel

A better version of #4 would be appreciated, but it must be accurate and specific. "Don't be an idiot" is too vague and difficult to accomplish.

Re:Your wish has been granted:

[varmittang]

Its not that we are bad engineers, but more of we are helping them survive instead of letting natural selection work its thing and letting these none up-to-date people just get lost. Otherwise, we will be supporting these types of people for life rather than making them adapt.

Re:Your wish has been granted:

[SoLoatWork]

Then teach them.

Contest? Pffft.....

[archeopterix]

Any reason why The Fallacy of Cracking Contests doesn't apply to this one?

Re:Contest? Pffft.....

[Anonymous Coward]

Many. The primary reason is that everyone is supposed to understand that if the mac survives to the 10th day, it doesn't mean that all Macs are really, really secure. If it does, we can only say that the original 30 min hack was sensationalist and unless you do something really stupid, your out-of-the-box mac probably survives at least three days, even if you post its address on slashdot. This challenge is to prove that properly admined mac box is not that insecure.

Quick and pointless answers to the points in schneier's essay
1. This contest probably is fair.
2. The contest doesn't try to prove secure-ness, but insecure-ness.
3. There's no prize.

Thanks for hosting this contest

[nule.org]

I'm interested to see what will happen (I know what my money is on). Hopefully ZDnet will run a follow-up after the test is complete.

I also find it impressive that a little mac mini can withstand a slashdotting (granted, the page is just plain text with one graphic). How's the load on that little guy?

Not sponsored by University of Wisconsin

[mrm677]

This little contest is organized by one employee who works at the University of Wisconsin internal IT department (DoIT).

It is NOT sponsored by the University of Wisconsin. In fact it has nothing to do with acadamia or UW's top-10 Computer Science department.

Re:Not sponsored by University of Wisconsin

[Anonymous Coward]

It is NOT sponsored by the University of Wisconsin. In fact it has nothing to do with acadamia or UW's top-10 Computer Science department.

My 180 IQ and 1580 SAT also have nothing to do with this story. Neither does my academic decathalon award.

I just wanted to make this clear.

~A UW student

Re:Not sponsored by University of Wisconsin

[Anonymous Coward]

Fu*$em Bucky! Nice to see my alma matter doing something useful like fighting FUD.

It's the International Communist Conspiracy

[typical]

I've noticed a significant rise in anti-macosx articles recently. To the point where I'm beginning to believe that it is staged.

So either (a) there is a secret conspiracy out to overthrow Apple or (b) Slashdot likes controversial articles that generate a large comment count.

In case we missed it..

[MrShaggy]

From the original article; "On February 22, a Sweden-based Mac enthusiast set his Mac Mini as a server and invited hackers to break through the computer's security and gain root control, which would allow the attacker to take charge of the computer and delete files and folders or install applications. Participants were given local client access to the target computer and invited to try their luck. Within hours of going live, the "rm-my-mac" competition was over. The challenger posted this message on his Web site: "This sucks. Six hours later this poor little Mac was owned and this page got defaced". The hacker that won the challenge, who asked ZDNet Australia to identify him only as "gwerdna", said he gained root control of the Mac in less than 30 minutes." Right in there it says that local access was given..I dont understand how they missed it.

Re:In case we missed it..

[MacBoy]

Right in there it says that local access was given..I dont understand how they missed it.

They didn't miss it. ZDNet updated the article later, due to the backlash that this omission created. This is clearly stated on the challenge website referred to in the article. I don't understand how you missed it.

Re:In case we missed it..

[DancesWithBlowTorch]

Before Dave has to answer this one as well: May I say, RTFA? It's all there:

Update

The ZDnet article has been updated to include the sentence, "Participants were given local client access to the target computer and invited to try their luck." But might it not have been interesting to explore:

What are the implications of local account access, and under what conditions might a computer be used in that way? How can such access normally be obtained? Do home users behind firewalls and with no ports open need to worry?

How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue? What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in products, like the "hacker" they interviewed, and actively choosing to NOT give the vendor an opportunity to fix the problem(s)?

How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?

A discussion about how since much of OS X is closed, this might make it more difficult for the community to discover - and report and fix - potential vulnerabilities in the closed pieces

...and things of that nature, instead of leaving people with the impression that any Mac OS X machine connected to the Internet can be taken over in 30 minutes?

Slashdotted/Denial Of Service

[cspring007]

Does it count if everone from slashdot tries to hack at the same box at the same time?
If a singular Mac Mini could hanlde that, i would buy 100 of them and start a supercomputing center somewhere in the Nevada desert.

Re:Slashdotted/Denial Of Service

[bloobloo]

Slashdotting would certainly count as "altering the website" in my book.

2 services only ?

[drfrancky]

how sweet that you have only ssh and http .. how about cutting the cable and becoming even more secure ? your chalenge sounds like "hack my pc that is ISP NAT , my local router NAT, and it's my desktop actualy and i dont have any services running" /* and has ssh and http open - a lot more than most Mac OS X machines will ever have open. */ and you are telling me that this peice of junk can be only desktop ? get real

Re:2 services only ?

[Metrathon]

If security is of some concern (and you need services for incoming traffic) I don't see why you would need anything beyond ssh.

Disable password access and tunnel throgh that one connection is pretty safe as long as you can keep the bad guy from getting your private key and the passphrase to unlock it.

Contest closes March 10?

[TheSkepticalOptimist]

So Mac OSX security only works for 3 days, while someone is closely monitoring all web traffic?

If this was a legit challenge, then don't close the challenge. Leave it open, so that when you least suspect it, someone has hacked your site.

But is this challenge stating the security of OSX? Defacing a website is the same as having a Trojan virus installed that wipes out your applications or formats your system? Why not offer a challenge to find out if someone can write a virus that will adversely affect OSX. The delivery is unimportant, as long as there are people happily downloading apps from P2P, opening email attachments, and downloading security updates from email warnings. No OS is truly secure from human ignorance.

I guarantee that some hacker will deface the website, but I question the legitimacy of imposing a time limit on the challenge. Certainly hackers don't have a time limit when they corrupt Linux or Windows based website servers, so why impose one for Mac. I think someone is closely monitoring the challenge website, ready to counter any possibility of it being hacked in order to solidify the OSX security myth.

Re:Contest closes March 10?

[Anonymous Coward]

Yeah, I'm sure there's 24-hours monitoring of the system. No one acually has anything better to do.

Moron.

Re:Contest closes March 10?

[Anonymous Coward]

It's called packet capture, and an IDS, you fucking faggot moron. Suck it bitch.

Where to find TNM (The Nice Manual)

[Savage-Rabbit]

Instead of inane, immature competitions such as this one, I'd rather have a nice manual (RTNM -- Read The Nice Manual) on how to improve/lock down an OS X machine.

This has been done already, TNM can be found here. Two caveats:

1) The manual is for OS.X Panther although it should be mostly just as valid for OS.X Tiger.
2) The publisher has a dubious reputation with the tinfoil-hat crowd.

I found it to be interesting to read and it should be fairly easy for moderately computer-literate users to understand.

Traffic growth -- really exponential?

[Bromskloss]

You have a good point in that the data transfer may become to much for it (if not handled by a separate computer), I didn't think of that. However, I'm not sure that "exponentially" is the right growth rate. Read on.

In effect, that would turn into a DDOS quite quickly once the logs grow and site traffic increases exponentially.

I'm not sure how you got to that growth rate. Let's suppose there are a fixed number of log readers accessing a log with a fixed frequency. Let's also for the moment suppose that the accessing of the log isn't logged.

If challengers' activities are resulting in a constant flow of events to log, then the size of log file will be proportinal to time. The log readers will then generate a data speed (information per time unit (bits per second, for example)) that is also proportional to time. I.e. it's linear, not exponential. The total amount of transferred data is the time integral of the data speed, and will thus grow quadratically with time.

Now, suppose that each time someone downloads the log, a log entry is inserted in the log. The additional information in the log, compared to the former case, will also grow linearly with time, since there are a fixed rate of log accesses (number of readers (fixed) times their accessing frequency (fixed)). That means that the log size and data speed will still grow linearly with time, and the total amount of transferred data will still grow quadratically.

Finally, suppose that each packet (or something equivalent) is logged in the file, so that its contribution to the log size is proportional to the data speed. Now the challengers will still generate log entries that will contribute to the log size in a time-proportional manner. The log readers, however, will make a contribution that is proportional to the log size. Write down the simple first order linear differential equation if you want, or just realise that the time derivative of the log size is proportional to the log size itself, and that this behaviour will actually produce an exponentially growing log file. Remembering that the log readers' data speed was indeed proportional to the log size, we arrive at a data speed that grows exponentially.

Mabye this was what you thought about? In that case I have nothing to add, exept that when setting up this kind of real-time logs, one might want to avoid the latter case.

Re:Traffic growth -- really exponential?

[Zemplar]

The exponential growth factor was pulled out of the air and was based on the probability of growth [human interest] of such a cool contest with live logs. Nothing more.

Re:Traffic growth -- really exponential?

[psmears]

Now if the server sent out the inverse log, that would be exponential...

*ducks*

Easy, To Do

[LifesABeach]

The process is pretty simple, "It's too expensive to compromise the Hardware, but the Humanware; That's cheap, and easy. First your dog/pet/loved is shoot, dead, in front of you. The next comes easier. The gun is pointed at you, and you are given 2 minutes to change the web page to some off topic theme. If you are given an extra 5 minutes, you'll learn Photoshop so that you can put an image of you doing it to a male Shetland pony in front of the members of the supreme court, all looking down on you and smiling in that knowing fashion." The D.O.D. Security Instructor that said this to me didn't even bat an eye; That's the chilling part.

Re:Easy, To Do

[SEWilco]

"...dog/pet/loved is shoot, dead"

• We're talking about a nerd. In Wisconsin.
• You can't hack your own web page in 2 minutes after your computer has been shot dead.

Re:Easy, To Do

[gardyloo]

You can't hack your own web page in 2 minutes after your computer has been shot dead.

      Then you're not trying hard enough, Marine! Your buddies will hold you down and beat you with soap-inna-sock some night. Now HACK.

No, you're still wrong about the REAL problem

[xiphoris]

The real problem is that tests like this are garbage in the first place.

In fact, Bruce Schneier (a respected cryptographer, responsible for Blowfish) addressed the topic thoroughly almost 8 years ago in his column Crypto-Gram. Here's a relevant snippet:

You see them all the time: "Company X offers $1,000,000 to anyone who can break through their firewall/crack their algorithm/make a fraudulent transaction using their protocol/do whatever." These are cracking contests, and they're supposed to show how strong and secure the target of the contests are. The logic goes something like this: We offered a prize to break the target, and no one did. This means that the target is secure.

It doesn't.

Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic reasons why this is so.

You can read the original here.

Re:No, you're still wrong about the REAL problem

[Anonymous Coward]

The logic goes something like this: We offered a prize to break the target, and no one did. This means that the target is secure.

I agree with your point.

However, the test is more of an attempt to show that the "30 minute breach" piece published by ZD-Net is incomplete and misleading to readers, and therefore unworthy of publication. The test is, so far, proving that point.

Re:No, you're still wrong about the REAL problem

[yorugua]

I guess Schneier is referring to what happens in a security contest if your product *pass* it, whether if you can consider it secure or not (Schneier say it is not), and then it goes to explain why you should not consider it secure. Here, given a certain scenario, the product *failed*.

Schneier further says that the U of W test will show nothing if it passes, but say nothing (but I would assume bad things) if it fails.

In Schneier's example, if you are not given a certain algorithm or the key in use, but only say ciphertext, and then in a contest someone comes up with the algorithm, the key and the plaintext, I say some work needs to be reviewed.

Re:No, you're still wrong about the REAL problem

[mattsucks]

Hmmm, just had this thought. If you really knew how to break into the system that was the focus of the $1,000,000 challenge, your best bet would be:

1) Confirm that your hack/exploit really works, but DON'T CHANGE ANYTHING
2) Wait until the contest ends and the system is declared "uhackable"
3) Wait a bit longer until the "unhackable" sytem is adopted by a bunch of big businesses
4) Make a lot more than the original prize fee by pillaging the "unhackable" systems.

oh.... I suppose it should have read

4) Profit!

How unfair!

[Linux_ho]

They've removed the biggest security hole in an OS X system: The Mac User. The Mac User will set "fluffy" as their password, and attempt to install any interesting-looking screensaver that gets e-mailed to them. Not that any other OS would do much better in the face of such adversity. But it's funny that they would use a test like this to "demonstrate the security" of a desktop OS.

Re:How unfair!

[zpok]

That's not fair. Haven't you noticed the macs are now white instead of gummy? So our passwords are now more in line with the new vibe. "Shiny" seems to do quite well...

/.ing

[emerrill]

I know its a very simple page, with only one image, but it seems to be doing well under the /. load

Sad.

[ninja_assault_kitten]

I don't understand the point... Basically all you're saying is "Is the version of SSH vulnerable to a remote exploit? Is the version of Apache vulnerable to a remote exploit?"

Why is it that the world only considers remote vulnerabilities to be of consequence? Somehow local vuls are now irrelavent.

It's pretty sad that we've come to this.

Re:Sad.

[prockcore]

Basically all you're saying is "Is the version of SSH vulnerable to a remote exploit? Is the version of Apache vulnerable to a remote exploit?"

True, i'd prefer if ARD was installed, because that's at least indicative of Apple-written closed-source, but if this is an intel mac mini, that's impossible, since ARD won't run on an intel mac.

Re:Sad.

[99BottlesOfBeerInMyF]

Why is it that the world only considers remote vulnerabilities to be of consequence? Somehow local vuls are now irrelavent[sic].

You're missing the point. This test is not trying to imply that local vulnerabilities are inconsequential, it is trying to undo some of the misinformation that has been spread by the press. The previous test was fine, but the representation of it in the press was that a regular OS X machine put on the internet can be hacked in 30 minutes. This is wrong in many, many ways. Thus, someone made angry by these misleading articles set up a test that is closer to the condition those articles presented and hopefully the press will also report on how misleading their previous reports were. Most of them have retractions or updates up now, but since the damage is already done, this seems like a reasonable solution to me.

Please note, neither of these tests is gathering much in the way of useful information for security people, they are just providing yet more evidence of what most security people already know. A medium competent cracker can find a local exploit for OS X. A really good cracker can find a remote exploit for OS X. If you are going to be giving shell accounts to random people or are likely to be attacked by experts, you should be running one of the secure OS's that uses jails or virtual machines. None of this is news.

This is not about security people though, this is about giving the average person an accurate view of how secure OS X is, without the FUD.

Re:Sad.

[ninja_assault_kitten]

And you're missing my point. It's not misinformation. Providing local accounts to unix-based systems isn't uncommon. Sure it's not common on a desktop, but it is on servers. The article was never specific about what type of environment they were replicating. That, if anything, was the problem.

Re:Sad.

[ninja_assault_kitten]

But this is FUD too. And do you think anyone outside the 'geek' community is going to hear about it? DO you think ZDnet is going to re-post an updated article about how they were wrong and in fact you need to make a distinction between local and remote vulnerabilities and the level of skill and available required for both? Probably not.

This is just as retarded as the ZDnet posting.

Re:Sad.

[99BottlesOfBeerInMyF]

But this is FUD too.

No. FUD is fear, uncertainty, and doubt. It is misinformation. This is designed to spread accurate information.

DO you think ZDnet is going to re-post an updated article about how they were wrong and in fact you need to make a distinction between local and remote vulnerabilities and the level of skill and available required for both? Probably not.

Well, they've already edited their initial article to include those facts (after everyone already read it). Yes, I do expect ZDnet to run another article, because it is news. Hopefully, this one will be more accurate. If not ZDnet I do expect other periodicals and sites to run articles.

Re:Sad.

[99BottlesOfBeerInMyF]

And you're missing my point. It's not misinformation.

When one thing happens and you depict it as another, it is misinformation. If it was not, the articles would not now have edits and retractions up. The test was not misleading, the articles written about the test were definitely misleading.

Providing local accounts to unix-based systems isn't uncommon. Sure it's not common on a desktop, but it is on servers. The article was never specific about what type of environment they were replicating.

The articles read "mac mini hacked in under 30 minutes." What percentage of Mac minis have SSH enabled and give out accounts to anyone using a Web based setup? Since it actually took about two hours, I'd say that makes the headlines more than a little misleading. This was not a common configuration for a mac mini and it was portrayed as such.

The article was never specific about what type of environment they were replicating. That, if anything, was the problem.

The article(s) also never said that there was a root account enabled (which is not the default setup) nor if a backdoor program had been installed previously by a hacker. Given this lack of information most people assume therefore that neither action was taken, since it would be unusual. It turns out they would be wrong in the first case and right (as far as I know) in the second. Articles don't have room for everything in them, but to not note the major changes done to the system to make it insecure is very, very misleading. This was probably by design since it got a lot more people to read the article. It is irresponsible and very poor journalism.

Re:Sad.

[ninja_assault_kitten]

>The articles read "mac mini hacked in under 30 minutes." I believe it read: "Mac OS X hacked in under 30 minutes". > The article(s) also never said that there was a root account enabled (which is not the default setup) nor if a backdoor program had been installed previously by a hacker. This is ZDnet. 99.999% of ZDnet readers have no idea what a root account is, nor would it make any difference to them.

Re:Sad.

[99BottlesOfBeerInMyF]

This is ZDnet. 99.999% of ZDnet readers have no idea what a root account is, nor would it make any difference to them.

True, but they should have pointed out that a lot of steps had been taken to bypass the majority of the security before the "test." Writing that monkeys are exploding is fine, but if they only do so in a microwave and you neglect to mention that, then you are misleading people.

Re:Sad.

[Anonymous Coward]

What is misleading about "Mac OS X hacked in 30 minutes" - that's what happened. now if the headline read "Out of the box Mac mini with no configuration changes made at all and no other software installed or services running hacked in 30 minutes" that would be a bit of misinformation. but which part exactly is untrue about the real headline??? It was OS X, it was hacked, it took 30 minutes.

Re:Sad.

[99BottlesOfBeerInMyF]

What is misleading about "Mac OS X hacked in 30 minutes"

What is misleading about "Babies explode killing those nearby!" just because you don't mention that those babies were fed inert explosives and put in a microwave?

We're not talking just about the headline either. There were entire articles that failed to mention that most of the primary security was bypassed by extensively altering the system, by enabling SSH and HTTP, building a Web UI to hand out SSH accounts and passwords to anyone that asked, enabling the root account, and installing a lot UNIX CLI tools. That is why those articles have retractions and updates now.

It was OS X, it was hacked, it took 30 minutes.

Yes, but it was not a default install of OS X, which is what most people would assume and it did not take 30 minutes, it took 2 hours from the beginning of the contest. That is very misleading.

Busted?

[jrmcferren]

I think it's done, It now says "Welcome Slashdot" with a link to this page.

Big deal..

[Mark Gillespie]

You can put any modern OS on the net, with Apache and SSHD the only available services, and it will be secure. This includes XP, Win2k3, Linux, Solaris etc etc etc.. This test proves nothing...

Re:Big deal..

[99BottlesOfBeerInMyF]

You can put any modern OS on the net, with Apache and SSHD the only available services, and it will be secure. This includes XP, Win2k3, Linux, Solaris etc etc etc.. This test proves nothing...

Actually, there are several other ports open, but that is still two more ports than are open on a default install. This test is merely replicating the conditions that the sensationalist articles misleading reported were the conditions of the previous test. Well, actually many of them did not mention that these ports had been opened up either, so this goes somewhat above and beyond. This test is not so much to "prove" how secure the OS is as to debunk the misleading articles about how secure the OS is.

Fink could have contributed to the original "hack"

[Been on TV]

One of the unusual things about the "hacked" machine was that Fink was installed. This most likely means that the Apple developer tools were installed (although Fink can install precompiled binaries), making it possible for the hacker to bring his own code and compile on the system. Although Apple ships the developer tools on the OS X client install DVD, it is not installed by default, nor is X11.

Fink lists a catalog of 6359 open source projectsthat can be installed, many of which are tools that could help a hacker exploit a machine or that are exploitable in themselves. Fink is a Debian style package manager for Mac OS X.

Server Version - What would be my favorite vector

[xxxJonBoyxxx]

The server appears to be Apache 1.3.3.3, one version behind the current release. The 1.3.3.4 release has a fix for this item, which would be my favorite vector, but I doubt that this server has an application that uses chunked encoding (often used for file uploads).

    *) SECURITY: core: If a request contains both Transfer-Encoding and
          Content-Length headers, remove the Content-Length, mitigating some
          HTTP Request Splitting/Spoofing attacks. This has no impact on
          mod_proxy_http, yet affects any module which supports chunked
          encoding yet fails to prefer T-E: chunked over the Content-Length
          purported value. [Paul Querna, Joe Orton]

Much better analogy!

[mekkab]

I don't think that analogy is quite apt. It's more like locking someone in your basement and they figure out how to gain access to your whole house.

Okay- I like that analogy better. I've got deep deadbolts on my outside doors; the door between my basement and house has a cheap handle lock that can be popped with a long, thin screw driver.

Not to get lost in the analogy details, but I think you'll find most security skews the same way.


When I run a third party program I am essentially letting them inside, but as a non-priviledged user I'm confining them to a specific area. But if this ability to elevate privileges turn out to be a fact, then any program I run can have full access.

I think this ability to elevate privs should be analyzed on a case by case basis for all programs; as such if you are concerned about what applications a user can and can't run, remove the ability to run those applications from the machine.

However with most desktop machines your biggest worry isn't normally* an attack from within; its usually from without.

*)people on slashdot aren't normal and typically have needs that extended beyond normal users. Feel free to contribute some examples that counter this assertion.

Re:Much better analogy!

[Anonymous Coward]

However with most desktop machines your biggest worry isn't normally* an attack from within; its usually from without.

Well, I can think of a few scenarios where an attack from within might be a major issue for a desktop machine. For example, in a family situation, the parents might desire to restrict the children's access to a computer, say to prevent them installing P2P software or browsing porn sites. But of course a restricted account is no substitute for good parenting...

Re:Much better analogy!

[Anonymous Coward]

Or more commonly, computers installed in, say, a library. If you do a priv escalation there and take control of the machine, you could have lots of fun.

Doubtful...

[TCQuad]

While you're right on the "das", it's doubtful that a dictionary crack would fix it. Since "das" is also his U of Wisc NetID (ref. the e-mail address at the bottom of the page), it's more likely that the password is the same as his U of Wisc password.

So... Anyone up for breaking into the U of Wisc password database?

Re:Doubtful...

[1729]

While you're right on the "das", it's doubtful that a dictionary crack would fix it. Since "das" is also his U of Wisc NetID (ref. the e-mail address at the bottom of the page), it's more likely that the password is the same as his U of Wisc password.

So... Anyone up for breaking into the U of Wisc password database?

Good luck with that. However, the link you provided was to the College of Engineering computer network, which is entirely separate from both DoIT (where Dave Schroeder works) and from the campus wide NetID. And a NetID won't get you onto the DoIT network, nor the CAE network. And test.doit.wisc.edu probably doesn't use the DoIT network for login information...

Re:Doubtful...

[daveschroeder]

For the record, no, the passwords are not the same.

(And for those wondering, the NetID/username is the non-private part of our NetID credential.)

Also, I'd hope that one would also understand that going after other machines in that way is bad form, and doesn't speak to Mac OS X's security (or insecurity), but rather to the practice of having strong/different passwords across multiple secure systems.

Re:Doubtful...

[bk4u]

It would not be his University of Wisconsin password, or the password to the College of Engineering accounts like the link goes to, it would be his password on the Department of Information Technology (DoIT) system.

Re:Doubtful...

[MirrororriM]

So... Anyone up for breaking into the U of Wisc password database?

Why try brute force when you can pull a social engineering attempt:

Daer DAvid Schroeoedir,

I am A NIGERIAN PRINCE WHO HACE RECENTLY MOVED TO WISCONCIIN And AM Vary INTERISTED IN OBtaining AN ACCOUINT ON TEST.DOIT.WISC.EDU...i CUULD WIRE YUO 1 MILLION DOLLARS...

A bigger real threat for OS X

[jscotta44]

First, let me say that if a user can exploit an OS X vulnerability from a true user account (not admin) to gain root, then that is very bad. However, that has not been proven. The supposed hack has not been proven or the claim of unpublished vulnerabilities (of which the hacker said there were many) been proven.

The real problem for the majority of OS X users and security is the decision Apple made in the interest of convenience. When you first set up a computer, the first user is an Admin user. This is the account that the majority of home and small business users will use daily for their work. Apple does nothing to educate or guide users in setting up a daily work non-admin account and a separate admin account for maintaining the computer. Very many people fall into the realm of only running from the original admin account. This is simply not a good practice.

A better solution would be to give people the option of taking the more convenient but less secure set up or the more secure set up from the very beginning. And even after people have chosen the less secure one, give people an easy option to change the configuration without having to think about it much.

Re:A bigger real threat for OS X

[Anonymous Coward]

A fresh install of OS X does give you an admin account but not a root account.

BTW, how does your plan work? "I can't create an admin account for my self because I don't know the admin password." Or the opposite -- any user can elevate themselves to an admin account because no one user is controlling that decision.

I tend to think...

[artemis67]

that professional hackers always ignore challenges like these. First of all, the last thing they want is lots of publicity. Secondly, the last thing they want is for their exploits to be found.

But to get to your comment, the point of this is to expose security holes in a very public way so that they can be patched.

Info

[Anonymous Coward]

http://das.doit.wisc.edu/
http://test.doit.wisc.edu/~das

If it helps...

This is a brilliant test...

[Anonymous Coward]

...a brilliant web load test that is.

Original Test Was More Interesting

[adam1101]

Actually, I think the original test was more interesting than this one. For years we've read countless +5 Insightful posts that OS X is more secure than Windows because normal users run in restricted accounts by default. That trojans can't do anything to the system unless you're "stupid enough to type in your password". If the original hack was indeed an exploit of an undisclosed buffer overflow, it means that this argument is pretty much moot. There have already been lots of posts in this and the previous article that amounted to saying "a local exploit is no big deal, everybody has them, if you have local (restricted) access you should be expected to be compromised anyway". Are these posters saying that the supposed advantages of restricted user accounts on OS X are very overrated? Are they saying it's no big deal if the next social engineering attack is combined with a buffer overflow exploit, meaning no popups asking for your password?

If the original hacker Gwerdna (Andrew G?) was right that there are many undisclosed priviledge escalation bugs, that is a case for concern, not something to be dismissed as a mere "local" vulnerability. BSD, Linux and even Windows already have patches for NX to contain buffer offerflows, where is Apple on this?

I think that, especially if you're an Apple user, it is very important to test the claim that the OS is rifle with local priviledge escalation issues. And that's why I think the first test was much better than this one. I don't expect this U of W box to be hacked anytime soon. But this proves very little. You can even setup a Windows SP2 ISS+Remote Desktop box like this, and I don't think it will be hacked anytime soon either. But if you redo something like the original box (give normal user ssh accounts to anyone) and get hacked very quickly again, it proofs a lot. Namely that the local security measures of OS X that many have come to thrust amount to very little.

Re:Original Test Was More Interesting

[yabos]

I'm pretty sure that the G5 doesn't have an NX bit, and for sure the G4 doesn't as it was developed too long ago. Since Apple is moving to Intel they will no doubt be moving in the direction of the NX bit to stop buffer overflows. It's supposedly very hard to perform a buffer overflow attack on PPC architecture so it's not as big a deal as it is on x86.

My guess is that they used some other way to gain escalated priviledges.

Re:Original Test Was More Interesting

[Anonymous Coward]

PowerPC's have always had the equivalent of the NX bit. It's only the Intel x86 architecture that was broken and needed it added and hyped.

Now whether Apple takes advantage of the bit or not I have no idea.

Re:Original Test Was More Interesting

[LionMage]

BSD, Linux and even Windows already have patches for NX to contain buffer offerflows, where is Apple on this?

According to what I've been able to glean from Apple's developer resources (available at developer.apple.com), and from various articles about the new Intel-based Macs, the Macs with x86 processors all have chips that support the NX bit, and the NX bit is turned on by default. There is supposedly a work-around to allow you to compile a specific application without the NX bit set, so that the app can execute code on the stack (something that apparently some badly-written apps do). The "work-around" is a compiler flag. Certainly, few or no apps that you download or buy pre-packaged are going to have this bit turned off... unless you manage to download a trojan.

I don't recall whether or not the PowerPC ABI allows so-called stack trampolining (executing code on the stack). I know some compilers took advantage of the ability to execute code on the stack to implement certain language-level constructs, though at the moment I'm drawing a blank on the specific ones; regardless, you can implement such features without resorting to executing code on the stack.

I do recall, however, that the PowerPC ABI gives preference to argument passing through registers, whereas the x86 ABI requires passing arguments to functions on the stack (because the x86 has far fewer registers). This is one reason why PowerPC Macs are less vulnerable to buffer overflow / stack based exploits.

Re:Original Test Was More Interesting

[Anonymous Coward]

Hardware NX is no silver bullet

http://www.suse.de/~krahmer/no-nx.pdf

Re:Original Test Was More Interesting

[persnowfall.se]

I think that you are missing the point.

The ZDNet article made it sound to average Joe's like his out of the box OS X machine could be hacked within minutes, witout making an effort to explain that this depends on the fact that you manually have to let the hacker in first (The hacker then gets in a little futher, which of course is a big problem to, but still a slightly smaller one). The challenge was in my view a greate way to criticize a piece of lousy journalism, not an interesting test in itself.

Re:Original Test Was More Interesting

[Anonymous Coward]

Thats not true, Book-E type PowerPC chips have always had NX bits at the page level, G3s and G4s were not Book-E type CPUs

Re:Original Test Was More Interesting

[Anonymous Coward]

All PowerPCs have segment level No-Execute control. This is all applications without self-modifying code (i.e. most of them) need.

Re:Our tax dollars at work

[daveschroeder]

No, my position is not funded or "rewarded" by Apple.

Also, I can't say I've *ever* gotten a "freebie" anything from Apple in 22 years other than a couple of T-shirts. Oh, and a nice pen once. I've also never heard of anyone in enterprise or education getting free flat panels and iPods from Apple (except for the free iPod promotions they've had when people buy certain laptops).

Also, since Mac OS X is used *heavily* in education, particularly at large research universities, and diversity of computing platforms is important to avail faculty, staff, and students of the best resources to do their jobs, I'm sure many are interested in the general security of a typical Mac OS X machine with a couple of typical services running on the internet, especially in the wake of such misleading press coverage of the same. The only interests I represent are those of the University of Wisconsin - Madison.

And yes, this challenge is sanctioned. I'm glad that the University of Wisconsin supports the genuine interests of its faculty, staff, and students, and encourages individual thought, research, discovery, and exploration. That's why it's a great place to be!

Comment removed

[account_deleted]

Comment removed based on user account deletion

Don't play this down

[kestasjk]

Don't play this down, this is a serious flaw. UNIX security is all about user accounts; if a UNIX based system can't enforce user accounts its entire security model is useless.

Just because a vulnerability is 'local' doesn't mean you have to be sitting at the computer. Take the U of Wisconsin's honey pot box running Apache and ssh. Both Apache and ssh run in a lower privileged user account whenever they can, so that if there's a flaw in code which runs in the lower user account it can only do damage within that lower user account.
Right now if you found a hole in low privilege context code you could use it to get admin access in OS X; this is a serious problem and it makes the UNIX security model, which Apple gives as the reason for OS X's great security, useless.

This doesn't mean OS X is insecure and everything else is, but it is a very serious flaw (especially being unreleased) and I don't understand why everyone is downplaying it.

Re:Don't play this down

[mythz]

How can we take this seriously. No one know how the exploit was achieved, what services was left open and what was installed on the target machine.

The target machine as far as we know does not represent any typical OSX installation. So this exploit has not made a OSX user's typical desktop installation any less secure or a typical Internet any less secure webserver, as it would not have had the same settings.

The fact that the result of the exploit has been published without any information relating to how the exploit was done and what tools were used renders this article a bad PR Stunt.

Re:Don't play this down

[Verminator]

Right now if you found a hole in low privilege context code you could use it to get admin access in OS X; this is a serious problem and it makes the UNIX security model, which Apple gives as the reason for OS X's great security, useless.

Quite true. And if, say... you "found a hole" in the security systems at Fort Knox, you'd be able to walk away with lots of gold. By your reasoning, every means of securing anything on the planet is useless, as someone could "find a hole" in the securing mechanism.

The fact is, no one has "found a hole" in the "low privilege context code" of OS X. I think it's unlikely someone will. Time will tell.

Re:Don't play this down

[Anonymous Coward]

Furthermore - daemons were installed through fink, such as apache - as was php.
It is thus entirely possible that the exploit had nothing to do with Apple installed software.

Re:Don't play this down

[Anthony]

I can't believe this comment is at -1. Apple have been slack with responding to local vulnerabilities. A former colleague spent a day and found 5 in OS X. reported them all to Apple and never heard from the company again.

A more "real-world" test?

[redmoss]

It seems to me that tests like "remote break-in using ssh" are not as good of a fit to today's common home computing environment. For something like OS X, most home machines probably are not running any services, so it is rather pointless to try to break into them using standard ssh/http attacks.

I would prefer to see test break-in attempts set up like this:

an unprivileged "test account" is created on OS X and set up with email, web browser, and other common desktop programs

the "test account" is set up with several common methods of communicating with the outside world: email, IM, commonly-browsed web sites, webmail, banking sites, etc

the test account's email address and IM account are made public to the would-be attackers

someone regularly checks the test account's email and acts like a "gullible user" would, eg click on spam and phishing links, go to hostile web sites, follow dubious instructions received via IM from supposed friends

the challenge: attacker must be able to do something "bad": control box resources (think spyware), steal critical system information (think remote root), get bank account information (think phishing), whatever

A few years ago, this was trivial on Windows. I hear they've cleaned up their act to some extent. How well would OS X hold up? How about a standard desktop version of Linux?

Re:A more "real-world" test?

[ratboy666]

You have the answer

The ORIGINAL "hacked in 30 minutes" test was that.

The idea is that an exploit can get in via ssh (remote login, perhaps a weak password). It may get in by exploiting a buffer overrun in the network stack. Lots of things can happen. But the EASIEST is to spoof the user into running an attachment.

Since we know that priviledge escalation is possible in OSX, we know that any clicked-on program can achieve root.

Is Linuz more secure? I don't know.

Ratboy

HOW DO YOU KNOW MY PASSWORD !?!

[Anonymous Coward]

Damn it, there goes fluffy. Hmm, how bout something similar, puffy maybe hmm.

Oh, nice screensaver, gotta run.

Data General used to Boast

[Greyfox]

That their B2 secure version of UNIX was so secure that you could safely post the root password on the Internet. I always thought that was rather disingenuous seeing as how pretty much every UNIX I've worked with required additional configuration to enable remote root logins, but root never had much power on those systems even if someone did find a third party server (or telnetd *cough*) with a possible exploit.

Then IBM bought Data General and that was the last we heard of DG/UX B2 Secure. Pity really. They should have ditched AIX instead. But I digress...

OSX is pretty damn secure right out of the box, but Apple could do more to make it tighter by default. They've already managed the security versus usability balance far better than Microsoft has managed so far. I think Apple could push a little more over to the security side of the thing without noticably affecting usability. I also think that Apple users would accept slightly less user friendly systems in order to continue to walk around with that air of I-can't-get-spyware-or-virusses smugness that no Windows user will ever understand until they've seriously used an Apple machine for a few days. Apple's selling more than a machine. They're selling the ability to not have to live in fear every time you connect that machine to the Internet. They're selling the ability to not have to run so many third party security applications that the shiny new machine runs like a shiny new machine from 5 years ago. I think that is worth any percieved price premium.

Re:Data General used to Boast

[Anonymous Coward]

IBM didn't buy Data General. EMC bought Data General. And they continued offering DG/UX for years afterward.

Security Hole...

[xxxJonBoyxxx]

See this: http://apple.slashdot.org/comments.pl?sid=179501&t hreshold=1&commentsort=0&mode=thread&pid=14866045# 14866379

And yet companies do it

[Sycraft-fu]

I host on a company called Pair (www.pair.com), as do many others including major sites like Tom's Hardware. It's all UNIX hosting, FreeBSD specificly, and you get SSH with all but their most basic accounts. Somehow, they are able to do that, and not get their shit rooted all the time, or indeed ever that I'm aware of.

Still no comparison

[massysett]

Lots of hosting companies offer ssh access, not to mention that if an account exists on the machine with ssh access, it may be only a matter of time before someone manages to gain access to it.

True, but this test still does not compare to what hosting companies are doing. Web hosting companies are (hopefully) run by professionals who secure the boxes. Web hosting companies run operating systems like RHEL that were designed for server use--Mac OS X on a Mac Mini was designed for home use.

Most importantly though, hosting companies are not giving ssh to any anonymous joe off the street, which is exactly what happened in this contest. At a minimum, web hosting companies have your credit card number before they offer you ssh. Some will demand additional information, such as a faxed copy of a driver's license. Of course a crook can get a drivers' license and a stolen credit card, but these are additional hoops to jump through that make the process of cracking the machine that much more trouble. Plus, if someone does crack the machine despite his lack of anonymity, the hosting company might be able to track him down.

This contest as reported on ZDNet was a joke. The guy gave ssh accounts to anyone who asked for them, without demanding any proof of identification. He ran it on an OS that was not designed to be run with untrusted users logged in. Furthermore, the crack was done by an anonymous person using an "undocumented" security hole, which to me calls the credibility of the whole episode into question. In what real-world situtation does anyone allow ssh login to any random, anonymous Joe?

Re:Still no comparison

[kaffiene]

The reality is that a user was able to elevate their permissions to root - that's a security concern and ought to be pointed out as a weakness. It would be a weakness if it happened on Windows or Linux, it doesn't become a non-issue because fan boys think that only web security is important.

The fact is *all* security gaps are important. If there's a network hack that can only get you a non-priviledged account, but you can then jack that up to root access using this local hole, then that hole was mighty significant. This whole "Mac has no security faults" meme is dangerously delusional. It's significantly more secure than Win32, but at least own up to faults (small as they may be) and get them fixed, don't bury your heads in the sand.

Re:Still no comparison

[guet]

The fact is *all* security gaps are important. If there's a network hack that can only get you a non-priviledged account, but you can then jack that up to root access using this local hole, then that hole was mighty significant. This whole "Mac has no security faults" meme is dangerously delusional. It's significantly more secure than Win32, but at least own up to faults (small as they may be) and get them fixed, don't bury your heads in the sand.

Have you read the page at http://test.doit.wisc.edu/ ?

He doesn't say it's invulnerable, and he doesn't say the local hole is unimportant, just that it's unimportant to desktop users (which it is), and applicable only to servers giving out ssh accounts. At present there is no network hack that can get you a local account, and most desktops wouldn't even have the services he has turned on enabled. Once something has a local account, you can only try to contain it, and for most desktop users it's game over, as it has access to all their files, address book etc. The worst hole so far has been due to Apple's stupidity in adding a feature to open downloaded files automatically to Safari, allowing trojans an easier route to trick users.

I haven't heard anyone say 'The Mac has no security faults', almost everyone here will readily admit that it has faults, and the stream of security updates from Apple attest to that. What people do say is that it's fairly secure, and more secure than Windows, by design.

I find it interesting he took the test down so quickly though, it's almost as if he was worried : )

Re:This whole thing is bogus.

[mindstrm]

I'm curious why you think all these applications, all of which run as the user, would somehow let you escalate priveleges?

I'm a student at UW-Madison

[herrvinny]

The University isn't running this, it's being run by a guy in our technology department.

He has a Slashdot ID here.

Hope he succeeds in proving that Mac OS is bulletproof.

Re:Our tax dollars at work

[ktappe]

Our tax dollars at work

Not many of them, anymore. Have you seen tuition prices? Have you not seen the constant press about the Fed. and state governments constantly cutting back student loan support and other funding for education? Your "tax dollar" claim is ringing pretty hollow.

I thought about emailing the UW CIO to ask, but I've got better things to do.

Like posting defamatory claims about Dave on Slashdot?

-Kurt

Can we break into it?

[edunbar93]

I dunno, but I'm pretty sure it's been slashdotted:

Mon 7 March 2006 8:45 AM CST

Welcome, slashdot.

Can anyone verify if they've changed the webpage to support the load?

Re:Can we break into it?

[CthulhuDreamer]

"I dunno, but I'm pretty sure it's been slashdotted:"

Security by popularity?

OT: Badgers

[merc]

[ed: Go Badgers]

mushroom! mushroom!

Re:OT: Badgers

[everphilski]

snaaaaake! its a snaaaaake!

Just down the street

[jafiwam]

I am just down the street from there.

Someone want to pay me to whack it with a bat?

Does "down" count as "modify a web page"?

Re:Just down the street

[Anonymous Coward]

I am just down the street from there.

Someone want to pay me to whack it with a bat?

Does "down" count as "modify a web page"?

Please do, it might bring some common sense to them.

I just find it funny how an article can come out on how easy it is to hack a fresh install of Windows XP, and noone cares; but god help you if you say "boo" to a Mac user.

Reasons for this?
  * Those on the non-mac side realize there's no such thing as perfect.
  * People actually code on windows, more applications, and more people playing around with "exploitable stuff."
  * Other OS users generally aren't pompous jackasses who think their shit doesn't stink.

So cry foul if you must, mac users; cry all day and all night, the rest of us have better things to do with our lives.

Re:Just down the street

[Verminator]

I'm betting that's your best chance.

My money (upwards of $1.73 at last count) says nobody gets in by Friday.

I could easily win the challenge...

[ScottSCY]

I could easily modify their site if they were only using a wiki.

Re:This whole thing is bogus.

[aurum42]

You are incorrect--the release version of OS X for Intel does support the "NX" (no execute page protection mode, and by implication, PAE) feature, and has stack pages marked NX by default. Get your facts right before bloviating, troll. I believe, but am not sure, that the G5 equivalent is supported as well, but given the architecture+ABI differences, it's somewhat less vulnerable than x86 to stack smash style vulnerabilities.

CNet

[aclarke]

I think much of the fault lies at the feet of ZDNet/CNet. They'll write anything to get page views. It doesn't matter if a piece on their site is entirely non- or anti-factual as long as it inflames enough people to read it out of pure disgust.

I'm still subscribed to some of their newsletters, where they email me about what this or that person has "blogged" on their site recently. I guess if you call it blogging then you don't have to do any journalism, but they'll have two people playing off both sides of an argument so so we'll keep clicking and ringing their page count up.

I think the best solution is to ignore them so they'll go away, or otherwise to make sure you make judicious use of Adblock.

Get in trouble with your ISP

[Anonymous Coward]

I think, depending on the types of attacks you try, you may get in trouble with your own ISP (wtf is all this weird traffic). Also not sure of what the laws say.

U of W should have stated something .. did they?

Mac Mini Survives Slashdotting

[Anonymous Coward]

I love how the mac mini is surviving the slashdotting no probs. Sure its mostly text, but I've seen similar sites crumble in no time.

http://test.doit.wisc.edu/

Chris

Virtual Servers?

[SuperKendall]

Lots of hosting companies offer ssh access, not to mention that if an account exists on the machine with ssh access, it may be only a matter of time before someone manages to gain access to it.

Yes but how many of those ssh accounts are to virtual servers? It's basically like compromising a box only you are on at that point...

And it's going to be a very long time indeed before someone unwanted can get into a system via ssh if the password is well chosen.

Does look concerted

[SuperKendall]

I have to agree that there are a lot of stories, and many of them look eerily similar. I'm not really one to buy into conspiracy theories but it would be interesting to track down the sources behind some of these things...

It proves one thing:

[Anonymous Coward]

that Mac users get their panties in a bunch for *anything*. Face it, this isn't acemdia or science - this is pure religion.

They did for the other box...

[SuperKendall]

With virus/spyware becoming a multimillion dollar business, do you really think that the real hackers (sorry for the use of the term) will stay away from this, due to the this very condition. Do you think that the dangerous exploits and cracks that are, for the moment, unknown by Apple, and are hence, very valuable. They will not be willingly sent to Apple for some minor publicity and no material, no, they will be auctioned off in some sleazy IRC channel in Russia.

Well the person that cracked the other OS X box used an unpublished exploit on a computer that could have been logging out the wazoo, so there's at least one person willing to do so...

Not garbage, just looked at wrong

[Roadkills-R-Us]

Such competitions certainly don't "prove" a system is secure.

But they do help in some situations. For instance, one of the things MS supporters constantly use as a defense is that the other OSes are only "safe" because nobody bothers to try and hack them.

Contests focus attention and effort on these systems. If they survive, it does undermine the original claim, which is merely an opinion to begin with, although often treated as cold, hard, fact.

Re:Our tax dollars at work

[NMerriam]

Yeah, because everyone knows there is no legitimate interest about computer security in academia. You should probably send a message to the Regents of the University of California at Bekley -- I hear some of their people have been wasting time on computer stuff over there, too! A blatant waste...

And yet somehow it still hasn't been compromised

[__aaowgu6674]

At least at 9:28 AM on Tuesday March 7th.

Re:This whole thing is bogus.

[aurum42]

Try again troll. See Apple's documentation

Intel processors include a bit that prevents code from being executed on the stack. On Intel-based Macintosh computers, this bit is always set to On.

You must work for that Eweek rag, you appear to follow the same brand of FUD-spreading methodology, involving outright lies...

Rereading the original ZDNet Article...

[podperson]

It appears that the original article has been changed since originally posted. It currently reads:

"On February 22, a Sweden-based Mac enthusiast set his Mac Mini as a server and invited hackers to break through the computer's security and gain root control, which would allow the attacker to take charge of the computer and delete files and folders or install applications.

"Participants were given local client access to the target computer and invited to try their luck."

Other related blog entries have noted the update.

Even so, the article fails to mention that this vulnerability relies on extra work on the part of the system administrator to create the accounts and open ssh.

It's running Apache 1.3.33

[Spy der Mann]

Not Found
The requested URL /blah was not found on this server.

Apache/1.3.33 Server at test-2.local Port 80

And here are the response headers:

Date: ***** (censored by moi) *****
Server: Apache/1.3.33 (Darwin)
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

404 Not Found

Also, I have the feeling it's running PHP, because it says "Welcome, slashdot!". So it's using scripting alright. It's not JUST a simple text page, it's scripted.

OK that ought to be a start :) Now, onto the vulnerabilities search! I wonder if it still has the PHP XML-RPC vulnerability. hmmmm....

Re:It's running Apache 1.3.33

[Anonymous Coward]

It's HTML silly. He put that in there because the site was slashdotted...it's not detecting the referenced URL.

Re:It's running Apache 1.3.33

[Spy der Mann]

It's HTML silly. He put that in there because the site was slashdotted...it's not detecting the referenced URL.

Oops :P

Competing in the pro leagues now!

[Anonymous Coward]

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.

Are you trying to dethrone BadAnalogyGuy?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Why encourage hacking?

[Control-Z]

I'm not a Mac fan but why encourage people to hack Macs? This is almost like someone wants to destroy the smug "unhackable" world that Mac users live in.

People start hacking Macs and the next thing you know Mac viruses and worms are commonplace. Even if I don't hang out with my Mac neighbours, I don't wish them any harm.

Re:Why encourage hacking?

[Cid Highwind]

"This is almost like someone wants to destroy the smug "unhackable" world that Mac users live in."

Exactly. Antivirus and firewall vendors want Apple users to pay for their "solutions" to problems that don't yet exist, Windows and Linux fanboys want Mac zealots to feel the pain of spyware infestations, insecure default configurations and constant brute-force attacks on open ports, and the tech press likes negative reporting. We're seeing the collision of many interests creating a huge storm of hype around some minor flaws in OSX security.

Unscientific

[wolfi]

This challenge is moot.
  If noone cracks the server it is no proof that the server is secure -- it could as well be that those that could do it save their knowledge for more rewarding targets.

Must be nice...

[Anonymous Coward]

...to have a boss that'll let you fuck around with stupid "challenges" and post on slashdot all day at work, and have the Universi-frickin'-ty of Wisconsin "sponsor" it. Sheesh.

a better analogy

[geekee]

"I think you can't "see the forest for the trees."

The original test was equivalent to saying "I'll let a thief into my house. Let's see if he can steal anything!" Most houses don't have everything bolted down to the floor.

But how often do you allow someone into your machine? For A desktop, not often, perhaps never."

Bad analogy. Unix is supposed to support multiple users.

A better analogy. I let someone move into my apartment complex and give him the keys to his apartment. He shouldn't be able to break into anyone elses apartment. And he shouldn't be able to break into the office and get the master key.

Re:a better analogy

[bjohnson]

perhaps Unix is supposed to support multiple users. I'd wager 99% of the OSX Macs on the net have only one, or perhaps one for each family member.

Random strangers do not get accounts.

Yes, Sponsored by University of Wisconsin

[TubeSteak]

http://apple.slashdot.org/comments.pl?sid=179501&c id=14866581

by daveschroeder (516195) on Tuesday March 07, @10:44AM (#14866581)

And yes, this challenge is sanctioned. I'm glad that the University of Wisconsin supports the genuine interests of its faculty, staff, and students, and encourages individual thought, research, discovery, and exploration. That's why it's a great place to be!

No +1 Informative for you.

Re:Yes, Sponsored by University of Wisconsin

[hogfat]

Sanctioned by what? The IT department? And is that sanctioned or allowed? There's a big difference between a non-academic, infrastructure support department permitting a staff member to use a large amount of bandwidth and an academic college sponsoring an open research challenge. Until such can be clarified, attributing this occurance to the University is exceedingly disingenius and misleading.

Re:Yes, Sponsored by University of Wisconsin

[Anonymous Coward]

Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community.

try it for Windows or Linux...Re:A Different Test

[javaxman]

Right now we have only this one supposed demonstration of it. What I'd really appreciate seeing is that *original* test repeated. If we can look at this as if it were an experiment, then when someone publishes a result others try to repeat it under the same conditions. They don't conduct a different test with different conditions in order to disprove the original.

What I'd like to see is that same test repeated for Windows, and maybe even Linux and Solaris... and OpenBSD. Now *that* would be interesting.

Guess what? I'm going to wager that all of those systems are prone to some sort of privilege escalation attack. ( actually, I don't have to guess, just check out CERT on this one. )

Are you trying to say WindowsXP or Linux is more secure when it comes to privilege escalation attacks than OS X ? Somehow, I'm tempted to think all of these systems have issues in that area. I'm not saying it's good, and I definitely won't defend Apple's somewhat lax approach in this area ( especially regarding the holes they've put in their security via LaunchServices and SystemStartup ), but uh... you should be fair, I think. It's not like a WindowsXP box, or even a Linux box, would last much longer if you just *gave* everyone user accounts on them, or ran software of questionable origin. That's just not something safe to do, regardless of what system you're on.

Now, if your intention is simply to point out that Apple's systems aren't any more secure than anyone else's in terms of this kind of attack, then you have a good point, one that Apple and their users both need to listen to and act upon.

attack on my system just moments after

[Anonymous Coward]

funny that just moments after I goto the test server, my logs indicate a hack attempt on my webserver, from 69.76.121.90 that address just happens to be a former sysadmin from the university.. wtf?!?

Re:attack on my system just moments after

[rbannon]

Just visited his site and my logs are starting to fill up! Yikes!

You need a reward

[geekee]

There's no point in providing a hacking challenge with no reward. All you've proven if it isn't hacked is you didn't interest anyone enough to bother. If you offered $1,000,000, as an opposite extreme, and no one hacked it, then you can say that even for a million dollars no one was able to hack the machine. It's hard to imagine no one bothered with a large reward.

Re:A Different Test ?? No kidding.

[necro2607]

Dude. The fact is, news sites around the world are saying "Mac OS X system hacked by some guy on the net", when they should be saying something more like "Mac OS X user locally escalated priveleges using unpublished exploit".

It's a very well accepted fact that there's nearly no way to protect from local privelege escalation. It happens all the time, and new exploits are constantly found. The kind of access you need to use a machine to a reasonable extent (locally, at the console) means you'll always be able to find ways to escalate your priveleges.

"The original test was to see if a regular local user could elevate its privileges to admin."

Actually, the original "test" was something along the lines of "See if you can get into my machine and erase everything, over the network connection. Oh yeah here's an SSH login if you want." Read the FAQ.

automated root escalation

[Stu Charlton]

malware will not be required to ask you for a password to elevate privileges - see? all those 'this is not a virus, it asks for your password and that should set your alarm bells going' argument goes puff! in smoke.

It's one thing to say it took someone 30 minutes to gain root access from a local acocunt; it's a very different thing to say that a piece of malware will *automatically* do this in a matter of seconds/minutes. Yes, it's a step towards an automated solution, but since the approach wasn't made public it's unclear whether it's universally exploitable, or only under certain conditions, etc.

No Pingy

[Anonymous Coward]

Its not responding to pings or anything. Does anyone know what going on with the machine?

Re:try it for Windows or Linux...Re:A Different Te

[Paradise Pete]

Are you trying to say WindowsXP or Linux is more secure when it comes to privilege escalation attacks than OS X ?

How could you infer that from what I wrote? I never once mentioned any other OS. I have little doubt that XP is less secure, but that's not the issue. Up until a few days ago, no one was claiming to be able to escalate user privileges under OS X. Now someone is claiming that. And if it's true, it's a problem not to be taken lightly. And if it can be done programatically, then it's a very serious issue.

For what it's worth, I don't run XP. I don't run Linux. I run OS X, and I've done so since it first came out. And I ran Mac OS 9, and 8, and 7, and 6, and even had a original Mac with only a floppy drive. So I'm not looking to bash Macs. In fact, my friends who I drive nuts with my "Mac talk" would laugh at the idea.

But that still doesn't mean this is a trivial issue. And it doesn't really matter that's it's "less bad" than XP. I take that to be a given.

Why Dave Schroeder is wrong (and MSFT is right!)

[ichin4]

It's certainly true that the original ZDNet article was sensationalist and overly alarmist about the implications for Mac security. But by implying that the original contest is irrelevent for a typical Mac user and that his test will prove that Macs are secure, Dave Schroeder is being equally, if not more, misleading.

The original test showed that Macs are vulnernable to local privlege escalation. It is true that most Mac desktops users are not offering accounts to external users. But a great many of the attacks out in the real world today are luring attacks, where a local user is tricked into running an executable with his local user permissions. The original test shows that such a executable can successfully elevate its privliges and own the machine. This is very relevent to the typical Mac desktop user.

Dave's new test doesn't have a user on the machine randomly surfing the internet and clicking on any link that says "get yer naked pics here"! Instead, as he freely admits, he is really just testing apache and ssh security, which are rarely turned on a typical Mac desktop configuration. Of course, were a hacker to exploit a vulnerability in one of those services, he could presumably use the same privledge escalation attack that was used in the original test to own the machine.

One of the more interesting ideas about how to deal with luring attacks has actually come out of the Microsoft .NET Framework. In its security model, the permissons of on application don't depend just on the user that's running it, but also on the origin of the application, as defined by a signed certificate. This system has the potential to greatly improve security, but sadly most Windows applications are not yet managed, and most Windows machines are not yet configured to strictly limit which managed applications are allowed to do what.

gullible user test script?

[impala_sc]

I propose a CLIENT side internet security challenge. I cannot script MacOS, but I'm led to believe it is easy to do. So, script two applications as semi-gullible users: Mail and Safari.

For Mail, publish an email address that the Mail client on the target system receives and hackers can spam. Script the mail client to open (view) messages, and to open links in messages. Finally, you perhaps can open (view) attachments to messages. This mimics social engineering techniques which are here for good. Your computer should offer some protection against this.

For Safari, publish a web form for hackers to submit URLs to. Perhaps they can submit a series of them. Script Safari to visit these URLs as if the user had typed them in, or clicked a link.

Run both scripts in the normal MacOS Finder shell with normal user rights (not admin)*.

In both scripts, if an authentication dialog (or any warning dialog) is prompted, cancel it. The user is gullible, but not dumb.

Success would be if no hacker acquired a shell or launched a process.

Utter failure would be if a hacker acquired a root shell and launched a process with root authority.

Mild failure would be a hacker acquiring a shell, or launching a process, but without gaining root authority. I doubt this would happen.

* MacOS does have one of the same big flaws that MS Windows does. If a home user gets a system and sets it up, the OS only leads them to create a second (other than root) administrator account. It doesn't lead them to create a non-admin account for everyday computing. So most home users are running on the internet with administrator rights. Granted, the MacOS second administrator is not as powerful as the WinXP second administrator (which might as well be root), but is privileged.

If the first client security challenge succeeds, repeat but have the Finder and apps run with administrator rights, as a normal home user will do.

Re:What it proves

[Anonymous Coward]

I do not know which is worse; a test that was poorly done and basically rigged, or your flawed logic.

By letting somebody on the system, it is only a matter of time before somebody is through the system. There is no system going that will be able to confine 100% of all users if they make it on. At that point, all LOC are in play and any OS that was not mathmatically proven will fail (which would be all).

Now, you read the report, but I am guessing that you have no real background to judge it for being a good enough test. Yet, you comment on it as though the test was valid.

All it proved is that you are once again, an idiot who lies.
 
  Sad, really. You are a waste of space and reading.

Re:try it for Windows or Linux...Re:A Different Te

[javaxman]

javaxman: Are you trying to say WindowsXP or Linux is more secure when it comes to privilege escalation attacks than OS X ?

Paradise Pete: How could you infer that from what I wrote? I never once mentioned any other OS.

Precisely, you never mentioned any other OS with regards to privilege escalation attacks... and you'll notice I was really just _asking_ if you were trying to imply something about another OS, so actually, I didn't infer it as much as I wondered if you meant to infer it.

I have little doubt that XP is less secure, but that's not the issue. Up until a few days ago, no one was claiming to be able to escalate user privileges under OS X. Now someone is claiming that. And if it's true, it's a problem not to be taken lightly. And if it can be done programatically, then it's a very serious issue.

Um. Ok. Here's the thing: just about every form of *nix under the sun has had a history of problems with privilege escalation. Go to this CERT document and search for "elevated privileges"... as just one example of how widespread and ( fairly ) well-known this type of problem is. While you're there, note that OpenSSH is what OS X uses. I'm sorry that you ( and apparently a lot of other people ) weren't aware of this as a problem, and usually such attacks are fairly difficult and too obscure for most people to do, but... they are a real problem, and always have been.

For what it's worth, I don't run XP. I don't run Linux. I run OS X, and I've done so since it first came out. And I ran Mac OS 9, and 8, and 7, and 6, and even had a original Mac with only a floppy drive. So I'm not looking to bash Macs. In fact, my friends who I drive nuts with my "Mac talk" would laugh at the idea.

Well, consider for a minute then that OS 9 has pretty much *no* such concept as privileged and unprivileged users... it does have some user restrictions, but they never worked terribly well in part because they weren't implemented by much more than the Finder and system services. Would you have given someone an account on your OS 9 machine if you didn't know who they were? I doubt it.

But that still doesn't mean this is a trivial issue. And it doesn't really matter that's it's "less bad" than XP. I take that to be a given.

Yup... definitely not a trivial issue. Definitely an issue that Apple ( and, clearly, developers and system designers in general ) would like to ignore... because it's complicated and restricts what you can do. Apple needs to step up and treat privilege escalation as a more serious threat than it seems they have in the past. Hackers need to step up and do the right thing by reporting these problems when they find them. But most importantly, users like you and I need to remember that there is no such thing as giving someone "safe" access to your machine... if you're going to open up SSH or any other avenue that could be used for attack, do it carefully, check out OpenSSH CERT reports, and remember that you're not invulnerable, no matter what operating system you're using. They have not built an unsinkable ship, nor have they built an operating system that you can give someone "some" ability to directly execute arbitrary code on. You might think OS 9 did that, but it didn't- it made it really, really hard to execute arbitrary code from anything but the console, but once you were a user, it was easy to do whatever you wanted. OS X is an improvement on that, really... even *if* you give anyone who wants one a login account and ask them to own your machine. And it's definitely an improvement on WindowsXP, though I do wonder if OpenBSD or something might be more safe.

It really is like locking somone in the garage or basement and daring them to get into the rest of the house. If you actually *want* to be safe, you'll lock them out at the gate outside your house, and not let them in where they can start to attack through the drywall.

Simple!

[r_jensen11]

I'll just walk to the doit office. Depending on which office it's in, I could be there in as little as 2 minutes, or if it's across campus, it'll take me roughly 20 minutes. I suppose I could figure out where it is by finding out what it's IP address is....

Re:Simple!

[herrvinny]

Assuming you also go to UW-Madison, you just got on my friends list ;-).

sorry mate

[weierstrass]

as the first person to try to draw an analogy between computers and houses or cars, you have automatically lost.

better luck next time.

Re:sorry mate

[mekkab]

as the first person to try to draw an analogy between computers and houses or cars, you have automatically lost.

Oh damn! This is probably some godwin-like rule with computer analogies!

Unplug the modem on port 8.

[Anonymous Coward]

I can't dial in. Busy signal all the time. Damnit Nikki.

Hacked?

[darthservo]

They updated the front page:

"The testing period will be closed at 11:59 PM CST on 7 March 2006 (0559 GMT 8 March 2006). Test results will be published." - Mac OS X Security Test

Re:Our tax dollars at work

[Anonymous Coward]

You are a blathering idiot, and a good excuse for retroactive birth control. Sucks to be you.

MiniSlashdotting

[EigenHombre]

Am I the only one who is impressed that a single PowerPC (not multi-core Intel) Mac Mini can survive a slashdotting? (Not to mention the additional DoS attacks -- and with rather zippy response time to boot.)

- Former Badger, glad I ordered one of those new MacBooks

Re:Our tax dollars at work

[NutscrapeSucks]

You really think this Mac Zealot guy has a legitimate interest in security? Har. Since when is arguing with ZDNET about Macs legitimate academic anything?

Re:Fink could have contributed to the original "ha

[Anonymous Coward]

Sorry, Fink is not part of the ADC OS X Developer Tools. Try Again. Show me on ADC where I can download Fink?

I wouldn't touch Fink with a 10ft. poll. I build myself from source if I need something.

Cheers

I can atest to Dave's concern

[Anonymous Coward]

In an Apple forum I had been visiting, a Windows fanboy had started a thread referencing the ZDNet article to show how Mac OS X can EASILY be hacked by simply being connected to the Internet. Of course this is a clueless fanboy who didn't realize the hacker was given local access. So yeah, fanboy like him will use the misleading article to spread FUD.

Re:This whole thing is bogus.

[thopkins]

You are correct sir, but:

Lighten up, Francis.

Pulling out early.

[devfsadm]

Bravo. You managed to prove that your Mac can stay online in a hostile environment for 38 hours. - sorta impressive.
I am sure I won't be rushing off and buying them for homeland defense.
Changing the time was Bull.
Next time your in fear of being proven wrong.
Don't take your ball and bat and go home, play through.
I see you forget to mention that you changed the ending time on the final page.
You experiment proved nothing. And you pulling out said volumes.
If you really want it hacked challenge blackhat.com or put the challenge up to www.zone-h.org. However, Since it is a Macintosh no one is really paying attention.

Re:Pulling out early.

[Anonymous Coward]

I am sure I won't be rushing off and buying them for homeland defense.

That's all right. The Army already did.

http://www.taborcommunications.com/hpcwire/hpcwire WWW/04/0625/107903.html/

coverage

[Anonymous Coward]

Gee, I wonder if Yahoo! and other online news websites are going to give as much coverage to this story as they did the original ZNet article?

Right...

[jscotta44]

The only people with brains and with the knowledge to hack a Mac only do it for money. There is no fame or reputation involved. There is no academic interest. There is no proving all the Mac fan-boys wrong motivation. This is a world of pure money.

Re:Right...

[SuperAlgae]

... so all those people who write viruses for Windows ... do they get paid by machine or flat rate? Or is Windows just so easy to hack that it requires no "brains and knowledge"?

Not that I'm denying Mac fanaticism, but let's be realistic. This test was not meant to show that Macs are bulletproof-- no operating system is. It was meant to provide a counterpoint to a previous misleading article, which it did and did well.

Test Now Closed

[themadplasterer]

The test is now closed and there were no sucsessful security breaches. This proves what most of us already knew about Mac OS X .This is take directly from the site http://test.doit.wisc.edu/ Mac OS X Security Test Tue 7 March 2006 11:59 PM CST (8 March 2006 0559 GMT) The testing period is now closed. The response has been very strong, and the test has illustrated its point. Traffic to the host spiked at over 30 Mbps. Most of the traffic, aside from casual web visitors, was web exploit scripts, ssh dictionary attacks, and scanning tools such as Nessus. The machine was under intermittent DoS attack. During the two brief periods of denial of service, the host remained up. The test machine was a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, had two local accounts, and had ssh and http open with their default configurations. There were no successful access attempts of any kind, including during the 38 hour duration of the test period, nor have their been any claims of success. The host is still the same host and configuration used for the test. Some snippets from 7 March 2006: The site received almost a half a million requests via the web. There were over 4000 login attempts via ssh. The ipfw log grew at 40MB/hour and contains 6 million events logged. Several social engineering attempts were received, including one purporting to be from the government of Sweden, which apparently uses GMail. ;-) More test results and information will be published here at a future date.

Sour grapes

[Swift2001]

So, nobody COULD break in in 38 hours, let alone 30 minutes, and now what do our Mac haters say? Well, if it would have been for MONEY, then they could have broken in. Yeah, right. I am surprised, though, that they cut the test short and nobody complained. It was supposed to last until Friday. I suppose the bandwidth and the attempted DDos attacks might have made the network people a bit edgy.

Re:Sour grapes

[djkuhl]

The page now says that the traffic peaked over 30Mbps, which would piss off just about any network guy. I think UW-Madison is probably on spring break, but that bandwidth use on just one server is a massive load and probably interrupted the remaining traffic on the network.

I noticed that yesterday the page went from formatted and graphics, to just formatted, and then a stripped down minimalist page. I think the bandwidth is what ended the contest prematurely.

Re:This whole thing is bogus.

[Anonymous Coward]

Because we're talking about Intel boxes, and not PPC, which 99% of Macs are currently using, right?

Acutally, the eWeek article linked by emil is titled "Apple's Switch to Intel Could Allow OS X Exploits", so indeed they are talking about the Intel boxes and not the PPC.

It seems that you are the one who's wrong here, not Apple...

Mac OS challenge at UW-Madison

[Anonymous Coward]

The OS X "challenge" was not sanctioned by the UW-Madison. The test ended yesterday when the CIO learned of it. The machine will be taken off their network tonight.

Contest Over! Winner Announced

[bugnuts]

Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community.

The CIO of UW-Madison has managed to get test.doit.wisc.edu website defaced.

Last seen message from site

[djkuhl]

Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community. I knew this wouldn't get very far. 30Mbps load for one computer on a school network is too much.

Re:Contest Over! Winner Announced

[djkuhl]

Heh, beat me to it. Some reason your comment didn't appear in time, so I'm gonna get the redundant mod slap!

Your comment is much more funny anyway. Kudos.

Re:Our tax dollars at work

[Anonymous Coward]

See, the funny part is the CIO did find out about this, and she promptly pulled the plug. Dave Schroeder is nothing more than a mac fanatic wanker. He is as annoying on campus mailing lists as he is on slashdot.

Speaking of AUPS... I wonder why the University of Wisconsin is listed as the registrant for a few of his domains. ipodbatteryfaq intelapplefaq. At least they aren't hosted in the UW ip space, that is very much a no no.

Agreed!

[jscotta44]

Agreed! But as many people as I see that are Mac fanatics, I see just as many that are anti-Mac fanatics. It is that approach that lead to a very poorly researched and written article that, if I did not give the benefit of a doubt, would believe that it was intended to deliberately spread FUD about OS X.

Letter to UW-Madison's CIO

[Anonymous Coward]

Dear Mrs. Stunden,

        As you know, a test computer was setup at the web address of: http://test.doit.wisc.edu/ in order to research the security of the Mac OS X operating system.

I have read today on the technology news site http://www.slashdot.org/ that it has been abruptly shut down. When I visited the site, I received this message:

"Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community."

In regards to your decision to shut the site down, please understand that you have left an indelible mark on the IT community around the WORLD. Certainly this is a destructive blow to the reputation of your department and to UW-Madison.

You state on your professional bio, "UW-Madison is a 40,000-student research university committed to transformational change of the teaching and learning environment through the use of technology."

How can you and UW-Madison be "committed to transformational change of the teaching and learning environment through the use of technology" by terminating such a noble project? What ever happened to service to the technology community?

Go ahead, laugh at me, ignore me. You probably deleted this e-mail before even reading this far. I'm just a kid...a college student of Information Systems Management; however I am an example of our country's next generation of Leadership. I represent the new style of thinking and ethics.

My generation has no tolerance for people like you. Your leadership style is obsolete and people like you are getting replaced faster than you can say Sayonara. To us, Ethics and Community Service are the two most important values a university must have.

Can you give me one good reason not to write a letter to my Senators and Congressmen, asking to launch an investigation of what your department does with my tax dollars? Can you give me a good reason to not write a letter to UW-Madison's board asking for you to be terminated immediately because of your selfish and unethical behavior?

For someone who has been working in technology since "1959" haven't you learned by now to think about the consequences before you make a decision?

I recommend that you release an official statement and send it to http://www.slashdot.org/ for the sake of your own and UW-Madison's reputation.

most sincerely,
XYZ

Re:Letter to UW-Madison's CIO

[Anonymous Coward]

Um... here's the scenario:

1. Support monkey in the IT department of a major University sets up hacker challenge.
2. Without getting permission from anyone.
3. He refers to it on major IT sites as "academic" and plasters an official university logo on it, implying that he's a professor or academic, and has the University's blessing.
4. Every script-kiddy on the planet heads for the UW's network.
5. The CIO finds out.
6. The CIO shuts it down. A wise move.
7. The CIO apologizes to the community for shutting it down.
8. Idiot posts poorly thought-out "manifesto" on slashdot.

That about the size of it?

Windows Security Challenge!

[bananaendian]

> Would be nice to see something like this for all platforms.

Well, huh! Here's a challenge! I've got a Windows box which you can attack at IP 124.235.13... [silence]

PS: What's even funnier is I've actually got a W2K webserver/SSH/SFTP server running here but I dare not give the IP away at slashdot - if OSX has 'an unpublished vulnerability' I wonder how many Windows does... Which is double funny again since supposedly OSX weaknesses haven't been exposed cause of small user base whereas my only defence against horders of hackers here is to keep my website as unpopular as possible!

Re:Fink could have contributed to the original "ha

[Bazzalisk]

Nor did he say it was. What he said was that a computer with fink installed will likely also have the developer tools installed, since fink requires them in order to work properly.

Re:Our tax dollars at work

[soloes]

doh!
Guess it wasnt sanctioned enough.

Windows XP SP2 similar test?

[__aacfuw452]

A Windows-loyalist buddy of mine thinks a fresh install of XP SP2 would withstand a similar challenge as the one Schroeder set up for OS X. Comments? Anybody care to try?

blasted.

[Anonymous Coward]

blasted.

Too bad I guess that Schroeder's superiors rapped his knuckles and took down his playtoy. But one thing is certain: when - not if - the hackers finally broke through, it would only take them another twenty minutes to get root.

LMAO

Comment removed

[account_deleted]

Comment removed based on user account deletion

UPDATE on the contest

[EvilStein]

Just in case and of you dumb fuck "Macs suck" knuckle draggers are wondering, It's over. U of Wi pulled the plug.

38 hours and not one successful crack.

Mr "Mac OS X is so insecure" didn't even manage to get in.

http://www.technewsworld.com/story/49296.html

Re:Our tax dollars at work

[daveschroeder]

No, the "funny part" is that people were aware of it, but later, executive management viewed it as too much of a liability/exposure - this is probably so, from certain perspectives. You can read her thoughts on it here. I routinely do interviews for the press, and have been involved with projects that have received national exposure that aren't strictly UW-related, such as Grants.gov for Mac OS X, a package which Grants.gov and Northrop Grumman now officially distribute themselves.

And appleintelfaq.com and ipodbatteryfaq.com just picked up the default contact information I use on DirectNIC, where other domains I administer for UW are registered. Since they're hosted off campus, have nothing to do with the university, and don't use university DNS, there was never any issue with either domain. I've changed the contact information appropriately.

If you really are affiliated with the university and have something to say to me, why don't you stop by my office or email me instead of anonymously trolling me on slashdot? Thanks!