Slashdot Mirror
U of Wisconsin's Mac OS X Security Challenge
digitalsurgeon writes "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet
Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes?
So guys, what do you say? Should we all mabye prove ZDNet wrong by not breaking into that computer?
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
A competition to crack a win 2k3pro server isn't a competition, that's a free-for-all.
Winning a 'hack my windows box' competition is like getting 'first post' on slashdot. It's not hard, you just have to be quick.
...if the little Mac Mini melts from a good /.'ing?
I hacked in, and in 22 minutes changed one of the pixels from #FFFFFF to #F0F8FF, but it is very hard to tell.
In fact, nobody even noticed.
He who knows best knows how little he knows. - Thomas Jefferson
and noone calls dupe?
/ 1446207
:-s
http://apple.slashdot.org/article.pl?sid=06/03/06
That.. must be a record.
incidentally the original post seems to reflect a more updated view
Until you posted this tidbit on slashdot.
The process is pretty simple, "It's too expensive to compromise the Hardware, but the Humanware; That's cheap, and easy. First your dog/pet/loved is shoot, dead, in front of you. The next comes easier. The gun is pointed at you, and you are given 2 minutes to change the web page to some off topic theme. If you are given an extra 5 minutes, you'll learn Photoshop so that you can put an image of you doing it to a male Shetland pony in front of the members of the supreme court, all looking down on you and smiling in that knowing fashion." The D.O.D. Security Instructor that said this to me didn't even bat an eye; That's the chilling part.
They've removed the biggest security hole in an OS X system: The Mac User. The Mac User will set "fluffy" as their password, and attempt to install any interesting-looking screensaver that gets e-mailed to them. Not that any other OS would do much better in the face of such adversity. But it's funny that they would use a test like this to "demonstrate the security" of a desktop OS.
include $sig;
1;
I think it's done, It now says "Welcome Slashdot" with a link to this page.
sudo mod me up
If we can look at this as if it were an experiment, then when someone publishes a result others try to repeat it under the same conditions. They don't conduct a different test with different conditions in order to disprove the original.
Science never enters the picture here, this is a religious debate.
The best education consists in immunizing people against systematic attempts at education. - Paul Feyerabend
While you're right on the "das", it's doubtful that a dictionary crack would fix it. Since "das" is also his U of Wisc NetID (ref. the e-mail address at the bottom of the page), it's more likely that the password is the same as his U of Wisc password.
So... Anyone up for breaking into the U of Wisc password database?
DAS is dead!
Long live Vindows!
Here is a sample log: /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - 72.33.255.254 pawn yo! /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org /Default.htm - 200 Mozilla/4.0+(compatible) Referrer - slashdot.org
....
2006-03-07 08:21:24 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:25 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:26 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:27 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:28 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:29 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:30 66.35.250.150 - 72.33.255.254 80 GET
2006-03-07 08:21:31 66.35.250.150 - 72.33.255.254 80 GET
"Never underestimate the power of the Slashdot!"
No, no, no. The password is "boot".
If you don't know where you are going, you will wind up somewhere else.
No No No... it's 127.0.0.1
/obligatory
Hack away...