U of Wisconsin's Mac OS X Security Challenge

digitalsurgeon writes "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet

Comments

A Different Test

[Paradise Pete]

While I appreciate this test, and expect it to not be breached, it is simply not the same test. The original test was to see if a regular local user could elevate its privileges to admin. The fact that the "proof" was to be done by changing a web page is a red herring. The real story was that someone was (apparently) able to do that.

This test is of the web server, and of remote cracking without local access. Also, the explanation page says that the original article did not mention that local access was given. Well, perhaps they've updated the article, but it certainly says so now:

"Participants were given local client access to the target computer and invited to try their luck."

As I said, I appreciate this test, but I am also concerned about the apparent ability of an ordinary local user to gain admin status.

Re:A Different Test

[daveschroeder]

Yes, they updated the article.

And the whole point isn't that the test "isn't the same". This is how most Mac OS X machines will appear to outside entities on the internet. The original article - and definitely before it was updated - left people with the impression that a Mac OS X machine could be owned in 30 minutes just by being connected to the internet, without the user "doing" anything, and the subsequent coverage of this in most press proves it. None speak to the fact that a local account was given, or even explore the implications. What could have been a useful article was useless, vague sensationalism. I updated the bottom of the page this morning:

Update

The ZDnet article has been updated to include the sentence, "Participants were given local client access to the target computer and invited to try their luck." But might it not have been interesting to explore:

- What are the implications of local account access, and under what conditions might a computer be used in that way?

- How can such access normally be obtained? Do home users behind firewalls and with no ports open need to worry?
How can a vendor fix the claimed local privilege escalation vulnerabilities when they are not informed of the issue?

- What are the moral and ethical implications of knowing about allegedly severe vulnerabilities in products, like the "hacker" they interviewed, and actively choosing to NOT give the vendor an opportunity to fix the problem(s)?

- How might a Linux or BSD distribution, other commercial UNIXes, or Windows stand up to a similar challenge, where anyone who wishes is given local account access?

- A discussion about how since much of OS X is closed, this might make it more difficult for the community to discover - and report and fix - potential vulnerabilities in the closed pieces

...and things of that nature, instead of leaving people with the impression that any Mac OS X machine connected to the Internet can be taken over in 30 minutes?

Re:A Different Test

[Tim C]

Lots of hosting companies offer ssh access, not to mention that if an account exists on the machine with ssh access, it may be only a matter of time before someone manages to gain access to it.

Re:A Different Test

[Fnord666]

This is how most Mac OS X machines will appear to outside entities on the internet.

By default web sharing and SSH are not enabled in OSX. You would have to turn these options on explicitly after a normal OSX install.

Re:A Different Test

[99BottlesOfBeerInMyF]

The point of the original test was not to hack the machine from outside, but from inside.

True and it confirmed what most everyone already knew, a mediocre cracker can find a local escalation. There is no problem with the original test. There is a problem with the way the media misleadingly depicted the original test. This second test is designed to help debunk some of the FUD generated by the poor media coverage, by replicating the situation they misleading led readers to believe were the conditions of the first test.

Re:Hackorama Windows

[rabbit994]

I'm sure Microsoft has held competion to do so as well. Windows 2003 is pretty secure out of the box as well considering almost no services are in the ON state and it comes with a GUI firewall in SP1. Microsoft has a long way to go but you can't fault them for not trying.

Re:* yawn *

[plate_o_shrimp]

[quote]I'd rather have a nice manual ... on how to improve/lock down an OS X machine.[/quote] There's this..... http://www.nsa.gov/snac/downloads_macX.cfm

Re:the original post

[daveschroeder]

Yes, this is approved. But it's getting moved to its own /29 today...unfortunately, that didn't happen before slashdot got to it. ;-)

There is an identical clone of that Mac mini waiting to go on the new network, and our DNS TTL is currently set to 5 minutes, so when the cutover happens, it should be pretty transparent.

The IP

[zaguar]

The IP of the server under the test. Saves you a ping of the site.

128.104.16.150

Hint

[spike2131]

One of the user names is "das".... as in http://test.doit.wisc.edu/~das/

So run that against a dictionary and see if you can get in....

Re:Hackorama Windows

[IflyRC]

Windows 2003 Professional doesn't exist.

1) Windows XP Home

2) Windows XP Professional

3) Windows Server 2003

Your wish has been granted:

[daveschroeder]

Corsaire - Securing Mac OS X Tiger

NSA - Mac OS X Security Configuration Guide (not yet updated for Mac OS X 10.4)

Apple - Common Criteria configuration guide

And for the "average joe"?

- Keep your machine patched
- Don't randomly open ports for services you don't use
- Have a personal firewall/router
- Don't run software you don't trust

And this doesn't "prove" anything, except that the initial ZDnet article was totally vague and sensationalistic, making it seem to an average person reading that article that a Mac OS X box could just be "hacked" by being on the internet. That is wrong, and I'm showing that. Simple. It's all explained on http://test.doit.wisc.edu/

Re:Your wish has been granted:

[sqlrob]

1) Automatic update is on by default
2) Everything is closed by default
3) Not as important with (2) true
4) This is the big one you'll never get around. People are stupid

No, you're still wrong about the REAL problem

[xiphoris]

The real problem is that tests like this are garbage in the first place.

In fact, Bruce Schneier (a respected cryptographer, responsible for Blowfish) addressed the topic thoroughly almost 8 years ago in his column Crypto-Gram. Here's a relevant snippet:

You see them all the time: "Company X offers $1,000,000 to anyone who can break through their firewall/crack their algorithm/make a fraudulent transaction using their protocol/do whatever." These are cracking contests, and they're supposed to show how strong and secure the target of the contests are. The logic goes something like this: We offered a prize to break the target, and no one did. This means that the target is secure.

It doesn't.

Contests are a terrible way to demonstrate security. A product/system/protocol/algorithm that has survived a contest unbroken is not obviously more trustworthy than one that has not been the subject of a contest. The best products/systems/protocols/algorithms available today have not been the subjects of any contests, and probably never will be. Contests generally don't produce useful data. There are three basic reasons why this is so.

You can read the original here.

I'm a student at UW-Madison

[herrvinny]

The University isn't running this, it's being run by a guy in our technology department.

He has a Slashdot ID here.

Hope he succeeds in proving that Mac OS is bulletproof.

Re:This whole thing is bogus.

[aurum42]

You are incorrect--the release version of OS X for Intel does support the "NX" (no execute page protection mode, and by implication, PAE) feature, and has stack pages marked NX by default. Get your facts right before bloviating, troll. I believe, but am not sure, that the G5 equivalent is supported as well, but given the architecture+ABI differences, it's somewhat less vulnerable than x86 to stack smash style vulnerabilities.

Mac Mini Survives Slashdotting

[Anonymous Coward]

I love how the mac mini is surviving the slashdotting no probs. Sure its mostly text, but I've seen similar sites crumble in no time.

http://test.doit.wisc.edu/

Chris

Re:Prove it!

[Golias]

i think that after posting this story on slashdot, there's really little chance to do anything on the machine for today

The new RTFA: Before complaining of a site being slashdotted, check to see if it's actually... you know... slashdotted.

'cause it's not. It's chugging away nicely.

Go OS X, Apache, and hogging your university's network resources!

Re:This whole thing is bogus.

[aurum42]

Try again troll. See Apple's documentation

Intel processors include a bit that prevents code from being executed on the stack. On Intel-based Macintosh computers, this bit is always set to On.

You must work for that Eweek rag, you appear to follow the same brand of FUD-spreading methodology, involving outright lies...

Rereading the original ZDNet Article...

[podperson]

It appears that the original article has been changed since originally posted. It currently reads:

"On February 22, a Sweden-based Mac enthusiast set his Mac Mini as a server and invited hackers to break through the computer's security and gain root control, which would allow the attacker to take charge of the computer and delete files and folders or install applications.

"Participants were given local client access to the target computer and invited to try their luck."

Other related blog entries have noted the update.

Even so, the article fails to mention that this vulnerability relies on extra work on the part of the system administrator to create the accounts and open ssh.

Re:It's running Apache 1.3.33

[Anonymous Coward]

It's HTML silly. He put that in there because the site was slashdotted...it's not detecting the referenced URL.

Re:Doubtful...

[daveschroeder]

For the record, no, the passwords are not the same.

(And for those wondering, the NetID/username is the non-private part of our NetID credential.)

Also, I'd hope that one would also understand that going after other machines in that way is bad form, and doesn't speak to Mac OS X's security (or insecurity), but rather to the practice of having strong/different passwords across multiple secure systems.

Re:Original Test Was More Interesting

[LionMage]

BSD, Linux and even Windows already have patches for NX to contain buffer offerflows, where is Apple on this?

According to what I've been able to glean from Apple's developer resources (available at developer.apple.com), and from various articles about the new Intel-based Macs, the Macs with x86 processors all have chips that support the NX bit, and the NX bit is turned on by default. There is supposedly a work-around to allow you to compile a specific application without the NX bit set, so that the app can execute code on the stack (something that apparently some badly-written apps do). The "work-around" is a compiler flag. Certainly, few or no apps that you download or buy pre-packaged are going to have this bit turned off... unless you manage to download a trojan.

I don't recall whether or not the PowerPC ABI allows so-called stack trampolining (executing code on the stack). I know some compilers took advantage of the ability to execute code on the stack to implement certain language-level constructs, though at the moment I'm drawing a blank on the specific ones; regardless, you can implement such features without resorting to executing code on the stack.

I do recall, however, that the PowerPC ABI gives preference to argument passing through registers, whereas the x86 ABI requires passing arguments to functions on the stack (because the x86 has far fewer registers). This is one reason why PowerPC Macs are less vulnerable to buffer overflow / stack based exploits.

Re:Don't play this down

[Anthony]

I can't believe this comment is at -1. Apple have been slack with responding to local vulnerabilities. A former colleague spent a day and found 5 in OS X. reported them all to Apple and never heard from the company again.

Re:Still no comparison

[kaffiene]

The reality is that a user was able to elevate their permissions to root - that's a security concern and ought to be pointed out as a weakness. It would be a weakness if it happened on Windows or Linux, it doesn't become a non-issue because fan boys think that only web security is important.

The fact is *all* security gaps are important. If there's a network hack that can only get you a non-priviledged account, but you can then jack that up to root access using this local hole, then that hole was mighty significant. This whole "Mac has no security faults" meme is dangerously delusional. It's significantly more secure than Win32, but at least own up to faults (small as they may be) and get them fixed, don't bury your heads in the sand.

Contest Over! Winner Announced

[bugnuts]

Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community.

The CIO of UW-Madison has managed to get test.doit.wisc.edu website defaced.

UPDATE on the contest

[EvilStein]

Just in case and of you dumb fuck "Macs suck" knuckle draggers are wondering, It's over. U of Wi pulled the plug.

38 hours and not one successful crack.

Mr "Mac OS X is so insecure" didn't even manage to get in.

http://www.technewsworld.com/story/49296.html