Slashdot Mirror
Less Than a Minute to Hijack a MacBook's Wireless
Kadin2048 writes "As reported by Ars Technica and the Washington Post, two hackers have found an exploitable vulnerability in the wireless drivers used by Apple's MacBook. Machines are vulnerable if they have wireless enabled and are set to connect to any available wireless network, fairly close to their default state, and the exploit allows an attacker to gain "total access" -— apparently a remote root. Although the demo, performed via video at the BlackHat conference, takes aim at what one of the hackers calls the "Mac userbase aura of smugness on security," Windows users shouldn't get too smug themselves: according to the Post article, "the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS." Ultimately, it may be the attacks against embedded devices which are the most threatening, since those devices are the hardest to upgrade. Currently there have not been any reports of this vulnerability 'in the wild.'" According to this story at ITwire.com, they were able to exploit Linux and Windows machines, too. (Thanks to Josh Fink.)
This exploit is OS independent. How is this in any way indicative of Mac user smugness? Are they so smug that they made Windows and Linux boxes explotable too?
Even more disturbing, IMO, is the suggestion in the article that Microsoft will become the ultimate arbiter of device driver safety in Vista, by preventing device drivers from being loaded that they haven't checked out and approved.... because we all know that Microsoft are the experts when it comes to detecting and correcting software vulnerabilities.
If the flaws are in Apple's drivers, why did they need to plug a 3rd party card into the MacBook? What user would ever plug a 3rd party redundant wireless card into their computer? Presumably, if they could hack Apple's drivers they wouldn't need the other card. All this video shows is a 3rd party wireless card with crappy drivers.
Well, this argument, being used toward Linux users or Mac users, has to stop. We all know that there has been flaws in linux kernel, Mac OS X and windows XP. They are known, thay are published and for most of them corrected. We all know there are more, waiting to be discovered.
BUT, and you'll notice this is a capital 'but', I have never seen a worm propagate across linux computers (I don't know for macs, I'm not a user of these). I mean, in the 98 era, windows computers were plagued with these. In the pre-SP1 era too. I have never seen a *single* self-propagating thingie for linux. The first one to do such a feat would get a lot of credit in the "scene" (if such a thing still exists). I, for one, believe that the security design of the OS is not stranger to this clean record.
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
My God people do some research. These guys used a 3rd party card because they don't want to reveal what hardware is vulnerable. As for operating systems, the one (and only) reason they chose to use a Mac was for shock value. Windows and Linux are both vulnerable, though if there are any exploits you can bet good money they'll be on Windows and not Mac OSX or Linux.
This is disgusting. No matter how many stories you run about Mac OSX and how it "really isn't secure" two facts will remain:
1) It's more secure than Windows. There are both less flaws and less exploits. It doesn't matter why, it's still true and, most likely, it will remain true for a long time to come. It's difficult to prove which has less flaws because neither is open source, but I think all of you, no matter how devoted to Microsoft you are, know deep down what would happen if both systems went open source tomorrow. It's very easy to prove which has less exploits, and it makes no difference whether that's because of less flaws, a different user base, a smaller user base, or some combination of the three because the net effect is a safer OS. Even if you disagree with the statement that OS X has less flaws on the basis that you believe it is secretly harboring more crappy code than Windows my second argument still holds.
2) There are almost never any malicious programs of any kind spread among Mac OS X users, unless you count people sharing copies of Windows XP to be installed with BootCamp. This may change in the future, but I doubt it.
Haiku for you!
You may notice that one of the guys was in CS grad school. He's presenting results at a conference. His academic credibility is on the line.
Not actually demonstrating your methods while presenting them at a conference is pretty common in other disciplines where it's really hard to lug around an X-ray diffractometer or the New Guinea Urungwi tribe. In CS it's different, but I think the risk of interception is a pretty good excuse.
Any sufficiently advanced libertarian utopia is indistinguishable from government.
Kids: PC's are owned through Windows. This is a fact. Own a PC, get hacked, this is the way it is.
Macs are so secure that A STORY about a third party wireless carded being hacked gets national-level coverage.
The PC owners rejoicing over the Mac's equivalence to their vulnerable platforms are being ridiculous. The quantifiable risk ratio between operating a Windows laptop and a MacBook is practically infinite, as there are no known virii for MacBooks, no known owning of MacBooks, no known security risks in operating a MacBook. At this point, hackers are well aware of a large installed userbase for Apple products, and certainly would attack them. If they could. Obviously they can't.
Silly people. Don't forget to run your virus and spyware checkers today. And back up your data, you never know when the bad guys will nail your hard drive in new and exciting ways through yet another buffer overflow in Windows.