Slashdot Mirror
Less Than a Minute to Hijack a MacBook's Wireless
Kadin2048 writes "As reported by Ars Technica and the Washington Post, two hackers have found an exploitable vulnerability in the wireless drivers used by Apple's MacBook. Machines are vulnerable if they have wireless enabled and are set to connect to any available wireless network, fairly close to their default state, and the exploit allows an attacker to gain "total access" -— apparently a remote root. Although the demo, performed via video at the BlackHat conference, takes aim at what one of the hackers calls the "Mac userbase aura of smugness on security," Windows users shouldn't get too smug themselves: according to the Post article, "the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS." Ultimately, it may be the attacks against embedded devices which are the most threatening, since those devices are the hardest to upgrade. Currently there have not been any reports of this vulnerability 'in the wild.'" According to this story at ITwire.com, they were able to exploit Linux and Windows machines, too. (Thanks to Josh Fink.)
And in the background we hear 1000 Mac users screaming in horror...
"Oh boy"
My reality has been shattered. Macintosh computers have been found to be less than perfect! Time to install WinXP.
- i'll get me coat! -
Also, christ, I'd say they're being pretty responsible about it.
[insert witty comment here]
In the video he uses a third party wireless card. Are other cards, such as the built-in card, similarly vulnerable?
If the flaws are in Apple's drivers, why did they need to plug a 3rd party card into the MacBook? What user would ever plug a 3rd party redundant wireless card into their computer? Presumably, if they could hack Apple's drivers they wouldn't need the other card. All this video shows is a 3rd party wireless card with crappy drivers.
Requests for testing have been sent to the guy in California who were rumoured to have gotten it running though.
"" How about taking the safety labels off everything, and let the stupidity-problem solve itself? """
Look for more information on the ISC Web site. Bottom line is this is not an OS issue, rather a "firmware/driver" issue.
It's not Centrino. Centrino is the name given to Intel's package of Motherboard chipset + wireless chipset + Processor. The new Apple machines don't use an Intel wireless card. They use Intel's chipset and Processor but not their wireless card. This does not make them Centrino machines.
To be specific the new Macbooks/pros use a Atheros 5006x. This is in comparison to the powerbooks that use a broadcom based card. So Apple doesn't use Centrino.
The actual video is here.
Read Brian Krebs' follow up
http://blog.washingtonpost.com/securityfix/2006/0
Apple 'leaned heavily' on the presenters to make them use a different card. The built in card *is* vulnerable.
check Security Fix:
... )
During the course of our interview, it came out that Apple had leaned on Maynor and Ellch pretty hard not to make this an issue about the Mac drivers -- mainly because Apple had not fixed the problem yet. Maynor acknowledged that he used a third-party wireless card in the demo so as not to draw attention to the flaw resident in Macbook drivers. But he also admitted that the same flaws were resident in the default Macbook wireless device drivers, and that those drivers were identically exploitable. And that is what I reported.
( Looks like Apple was wielding a big stick
Of course... just after I post this becomes available (new to me anyways). So it looks like it only being a third-party driver exploit was a red herring: the built-in chipset is venerable, and Apple is aware of it and already working with the vendor for a solution.
Windows users are always accusing Mac users of smugness, but there's nobody more smug than a Windows user observing that one (1) particular security vulnerability has been found for Macs. This strikes me as akin to someone with AIDS being smug because some previously healthy person has caught a cold.
The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
"How do you know exactly? Viruses, trojans, and rootkits should be undetectable."
With "undetectable rootkit detection software", duh....
Unless the rootkit has an "undetectable rootkit detection software" detector and tries to disable it, then you need "undetectable rootkit detection software detector detector software" to disable the rootkit's detector - no big deal..
"But this one goes to 11!"