Slashdot Mirror
Less Than a Minute to Hijack a MacBook's Wireless
Kadin2048 writes "As reported by Ars Technica and the Washington Post, two hackers have found an exploitable vulnerability in the wireless drivers used by Apple's MacBook. Machines are vulnerable if they have wireless enabled and are set to connect to any available wireless network, fairly close to their default state, and the exploit allows an attacker to gain "total access" -— apparently a remote root. Although the demo, performed via video at the BlackHat conference, takes aim at what one of the hackers calls the "Mac userbase aura of smugness on security," Windows users shouldn't get too smug themselves: according to the Post article, "the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS." Ultimately, it may be the attacks against embedded devices which are the most threatening, since those devices are the hardest to upgrade. Currently there have not been any reports of this vulnerability 'in the wild.'" According to this story at ITwire.com, they were able to exploit Linux and Windows machines, too. (Thanks to Josh Fink.)
Also, christ, I'd say they're being pretty responsible about it.
[insert witty comment here]
Look for more information on the ISC Web site. Bottom line is this is not an OS issue, rather a "firmware/driver" issue.
It's not Centrino. Centrino is the name given to Intel's package of Motherboard chipset + wireless chipset + Processor. The new Apple machines don't use an Intel wireless card. They use Intel's chipset and Processor but not their wireless card. This does not make them Centrino machines.
To be specific the new Macbooks/pros use a Atheros 5006x. This is in comparison to the powerbooks that use a broadcom based card. So Apple doesn't use Centrino.
The actual video is here.
Read Brian Krebs' follow up
http://blog.washingtonpost.com/securityfix/2006/0
Apple 'leaned heavily' on the presenters to make them use a different card. The built in card *is* vulnerable.
check Security Fix:
... )
During the course of our interview, it came out that Apple had leaned on Maynor and Ellch pretty hard not to make this an issue about the Mac drivers -- mainly because Apple had not fixed the problem yet. Maynor acknowledged that he used a third-party wireless card in the demo so as not to draw attention to the flaw resident in Macbook drivers. But he also admitted that the same flaws were resident in the default Macbook wireless device drivers, and that those drivers were identically exploitable. And that is what I reported.
( Looks like Apple was wielding a big stick
Of course... just after I post this becomes available (new to me anyways). So it looks like it only being a third-party driver exploit was a red herring: the built-in chipset is venerable, and Apple is aware of it and already working with the vendor for a solution.
Next?