Johnny Cache Breaks Silence On Wi-Fi Exploit

Joe Barr writes, "Johnny Cache — aka Jon Ellch — is chafing under the cone of silence placed over him and co-presenter Dave Maynor about the Wi-Fi exploit they presented at Black Hat and DEFCON last month. So he has finally broken his silence on NewsForge in hopes of ending the personal attacks coming from what he implies is a smear campaign started by Apple." (Newsforge and Slashdot are both owned by OSTG.)

Johhny Cache writes, "If you're going to post a news story that is a rehash of my post to a mailing list, I would much prefer it if people actaully just read the post in its entirety."

Comments

So..?

[ericdano]

So, is he going to take Daringfireball's challenge or not? I think his whole thing has tarnished him, and he won't recover.

Re:So..?

[Who235]

Maybe he doesn't want one, seeing as how they're so easy to exploit. . .

Re:So..?

[Anonymous Coward]

And some huge legal costs.

I mean, MacBooks are overpriced, but not that overpriced.

Re:So..?

[Thrip]

So, if I put on my blog that I challenge George Bush to provide some proof of [pick anything that's ever come out of his mouth], at a mall of his choosing, and I'll give him a free laptop if he does it, and he never shows up, that proves ... what exactly?

I'm sure John Gruber's blog is extremely important to John Gruber, but if some guys who are clearly dealing with a mountain of legal issues right now choose not to meet him at the mall, you can't take that as evidence of anything -- except that Gruber's pretty clever at diverting attention to himself.

Re:So..?

[mellon]

The way these things work is that when someone hacks your hardware, you get an injunction to stop them from talking about it. If they talk about it, they go to jail for contempt of court. If you were to RTFA, you might get the very strong impression that he's under an injunction of this type.

It's always fun to look for bad guys in situations like this, but both Apple and Mr. "Cache" here are wearing white hats. You want both of them to be doing what they're doing, and it's lame to make it into a flame war. You want Mr. Cache breaking drivers, because then they get fixed, and your Mac doesn't get 0wned when you're down at Starbucks watching YouTube videos.

And you want Apple to try to dissuade him from publishing his hack, because you want them to fix it before every random hacker figures it out, and the sooner he publishes, the sooner the black hats will have an exploit. So if Apple doesn't get him to stop talking, maybe your Mac will get 0wned down at *$$.

But you still want Apple to be paranoid about the information getting out, so that they release the bug fix quickly, not slowly. And so what he's done with this article is useful, because he's basically said how the hack works, and now presumably the black hats are working on trying to duplicate the hack. And Apple knows this, and so the patch release will probably come sooner. And so your laptop won't get 0wned at *$$. W00t!

What I don't see here is bluster. This isn't high school. People don't get up on stage at defcon and claim to have hacked something they didn't really hack. The reason they do these hacks is to improve security, not to count coup. You owe the guy your thanks, not your hopes that his reputation is ruined.

Re:So..?

[schon]

You aren't even making a good argument, and bringing in a strawman (IE: Bush) isn't going to help you.

He's making a great argument - I'd say that the fact that you don't know what a strawman is stopping you from understanding it.

Re:So..?

[Reverberant]

The way these things work is that when someone hacks your hardware, you get an injunction to stop them from talking about it. If they talk about it, they go to jail for contempt of court. If you were to RTFA, you might get the very strong impression that he's under an injunction of this type.

Instead of letting us infer the facts, why not just say "because of a court order, we can't talk about it"? It happens all the time.

If there is a hack, I want to know. I'm not looking for details, I just want the answer to Jon Gruber's question: "Have Maynor and Ellch found a vulnerability that affects MacBooks using Apple's built-in cards and drivers?"

If the answer is "yes" or "no" just say so! If they're under a gag order, just say "We're under a gag order." Asking us to read between the lines isn't cutting it.

Not to mention that the ad-homs aren't helping his credibility...

Re:So..?

[Sancho]

How is he backtracking? The newsforge article you quoted even points out that it was a video. They could have tried a dozen times before they got it right, but once they get it right, it happens in under a minute. Now if that's the exploit, it's not really a great one or a particularly big deal--yet. But if his suspicions are true and the exploit can be made more precise, then it /could/ be a problem.

Also, the point of the Blackhat/Defcon talk was actually not about proving Macs are vulnerable--it was about proving that /drivers/ are vulnerable. They chose a Mac because they were tired of all the "Macs are secure" bullshit, and thus the huge media backlash has really distorted the original message: that with wireless getting longer and longer range, it's going to be easier and easier to root insecure drivers without even necessarily being connected to a network.

Re:So..?

[Rocketship Underpant]

The difference is that John Gruber is probably the most-read and most respected Mac technology pundit and blogger out there. His challenge is a high-profile one, certain to get the attention of the "journalists" and hoaxsters who started this whole thing. Heck, just look at how many Slashdotters here know about his challenge.

Re:So..?

[gruber]

Did you read the relevant articles? The challenge didn't allow for more than one attempt, that I could see, whereas here's Johnny (heh) saying that it could take multiple attempts to exploit the race condition correctly [...]

I updated the stipulations to allow for an entire hour to delete the file on the desktop. If they want more time than that, I'd be willing to extend it.

This guy really is full of himself

[Mononoke]

He also went on to explain that while the debate was centered in the Mac blogger community, it made no sense to discuss it because most of them wouldn't understand the explanation if he gave it,

Most of any community is not going to understand it, including this community. He comes across as nothing more than an attention-whoring little hacker with an axe to grind against Apple.

Re:This guy really is full of himself

[Anonymous Coward]

Ah, much like the slashdot community with Microsoft

The only difference is most of us don't need a rigged demo to break into a Windows machine...

Re:This guy really is full of himself

[MrResistor]

So what if he is? If his hack works, it works. Period.

An attack on his personality doesn't invalidate that.

Article text

[Anonymous Coward]

Johnny Cache breaks silence on Apple Wi-Fi exploit

Monday September 04, 2006 (01:07 PM GMT)

By: Joe Barr

Jon Ellch -- aka Johnny Cache -- was one of the presenters of the now infamous "faux disclosure" at Black Hat and DEFCON last month. Ellch and co-presenter Dave Maynor have gone silent since then, fueling speculation that the entire presentation may have been a hoax. Ellch finally broke the silence in an email to the Daily Dave security mailing list over the weekend, and one thing is clear: he is chafing under the cone of silence which has been placed over the two of them.

Ellch explains their silence since the presentations in his email by saying:

        Secureworks absolutely insists on being exceedingly responsible and doesn't want to release any details about anything until Apple issues a patch. Whether or not this position was taken after a special ops team of lawyers parachuted in out of a black helicopter is up for speculation.

He also went on to explain that while the debate was centered in the Mac blogger community, it made no sense to discuss it because most of them wouldn't understand the explanation if he gave it, adding, "Since this conversation has moved into a venue of people who can actually grasp the details of this, I'm ready to start saying something."

Ellch then breaks down the elements of the vulnerability and possible exploits, but in the context of Intel drivers rather than Apple's, asking and then answering the obvious question of why he did so when he wrote: "Why am I switching the subject from Apple's bug to Intel's? Because it's patched, and Secureworks has no influence over what I say regarding this one."

He buttressed his explanation of how he crashed the Intel Centrino driver by creating a race condition by flooding it with UDP packets and disassociation requests with links to dumps of crashes he caused using this technique.

Ellch notes that a crash caused this way doesn't guarantee a successful exploit, saying "If you're lucky, your UDP packet will end up on the stack. If you're less lucky, a beacon packet from a nearby network will end up on the stack. In the case where I successfully overwrote eip (Extended Instruction Pointer), the UDP packet was 1400 bytes."

He also responded to criticisms that he and Maynor have simply been "playing the media" instead of reporting an actual vulnerability and exploit, saying:

        You know, of all the comments I see, the ones that 'we played the media' make the least sense. Have you ever seen me in the news before? No. Have I ever talked to a reporter before? No. Am I doing a very good job of winning this PR smear campaign lynn fox ignited? No. If I was so deft at manipulating the media, would I be explaining myself on dailydave praying that a few technically competent people will actually get it?

I contacted Ellch by email after reading his post and asked if he was claiming Apple is the cause of their silence. He replied:

        Let's just say its pretty obvious I'm not happy about being silent. So much so that i'm releasing non-apple bugs to convince people that we do in fact know what we're talking about.

Re:Article text

[rbannon]

I still don't see him coming clean on this one. Or maybe, like he says, people like me won't understand it anyway.

In any case, I think he's really not being forthcoming with respect to what the hack entails, and maybe that's due to Apple's aggressive lawyers. In any case I'd like to see more details.

Re:Article text

[cHiphead]

my guess would be its another NSA exploit built into wireless cards. It'd make sense. Plus his reference to black helicopters in a seemingly innocent but suspect way.

*engage nutjob conspiracy theories*

Cheers. ;)

"Implies" my fanny. He says it right out.

[Shayde]

If that's just an 'implication', I'll eat my hat. It's pretty obvious that his going silent is the result of Apple putting the thumbscrews to him. He states that the ONLY reason he's saying something now is because he's talking about Intels drivers, not Apples. It's blatantly obvious that Apple's lawyers have come down on him like a ton of bricks, forcing him to be quiet until they get a patch out. This way no one can report about the 'insecurity' of the OSX platform - there are no exploits, see? As long as you're patched and up to date!

Re:"Implies" my fanny. He says it right out.

[rbannon]

If that's true, I think Microsoft should hire away Apple's lawyers.

Black helicopters? Even in metaphor?

[Sunburnt]

The classic defense of the madman or the liar: "What I say is true, but terrible, unspeakable things would happen were I to prove my assertion. You'll just have to take my inability to prove my assertion as evidence of its validity."

What a schmuck.

Re:"Implies" my fanny. He says it right out.

[Mononoke]

So Apple is supposed to patch someone else's drivers for a wi-fi card that would never be used with a Mac?

Apple probably looked at these guys and laughed.

Next thing you know, these guys will be "discovering" cold fusion.

It took all of 2 paragraphs to go ad hominem...

[jpellino]

And insult the intelligence of Mac users.
That's the way to prove your point.
As someone said, show this on a "bog standard" Mac from and I'll pay attention.

Re:It took all of 2 paragraphs to go ad hominem...

[nathanh]

And insult the intelligence of Mac users.

Most Mac users insult their own intelligence.

I have a Mac and it's great. Unfortunately the majority of Mac users are an embarrassment. I sometimes cringe when I read the comments on Mac blogs - the Mac users make Linux fans look humble and Windows users look intelligent.

I work in the IT security industry and I'm perfectly willing to accept that this exploit is for real. The pattern of events is not abnormal: the exploit will be demonstrated at a conference but because of NDA the details remain under wraps until the manufacturer releases a patch. I've seen delays of 12-18 months before details are released for Windows exploits, despite seeing the exploit demonstrated in person at blackhat conferences. A delay of a few weeks for an Apple exploit doesn't even raise my eyebrows.

The only difference here is that Apple users are so goddamn fanatical that they'll rabidly attack anybody who says their platform is any less than perfect. They don't know the security field, they don't understand the technical discussion - those quotes Johnny provided of clueless Mac users were riotous - yet they feel qualified to give opinion. I used to work with this guy who was brilliant at finding and exploiting security holes. He took a G3 Mac running stock standard OSX and proceeded to demonstrate exploit after exploit; not based on his OSX skill but purely on his knowledge of the underlying free software. I was at a blackhat conference where they demonstrated a local privilege escalation exploit that existed all the way up to Tiger - they had told Apple about it years previously but it wasn't until they broke their NDA and went public that Apple fixed the fault. The same presentation at that conference demonstrated an OSX kernel exploit that still exists today.

Mac users are in for a rude shock. They've told each other their platform is secure. The rumor mills repeated the "OSX is secure" mantra. But the mantra has no foundation in reality. Most Mac users do not run AV, do not shutdown services, and run with wide-open wifi and bluetooth settings. They have an undeserved complacency regarding security and it will lead to a fall.

Re:It took all of 2 paragraphs to go ad hominem...

[kithrup]

The only difference here is that Apple users are so goddamn fanatical that they'll rabidly attack anybody who says their platform is any less than perfect.

That may be the case... but in the circles I hang out in, the big question has been "Is this real?" Having them demonstrate using a hardware combination that is extremely unlikely to be encountered in the practicality -- that uses non-vendor drivers! -- while they imply (and nothing more) worse... is not very compelling.

Mac users are in for a rude shock.

No doubt. But how does what continues to reek of being a false alarm help in any way? Right now, this whole incident has conveyed nothing but a sense of, "Well, they had an axe to grind, so they used some other vendor's code, and then lied about how Mac OS X was insecure."

It very well may be the case that the Apple driver is vulnerable. But they've honestly done everything they possibly can to convince the multitudes that it isn't.

And that is a huge disservice to the community they claim they are trying to help.

And speaking from a technical aspect, here is the question I asked before: if the Apple driver is vulnerable... how do they get a network-connected shell from the kernel? It is not easy -- at the very least, it would involve having a process be created, from the kernel. And that is a significant amount of code, as you could tell by looking how the first process is created during boot.

(Again, I am trying to give them the benefit of the doubt, that the vulnerability is real. But they're doing what they can to imply otherwise.)

Re:It took all of 2 paragraphs to go ad hominem...

[99BottlesOfBeerInMyF]

I work in the IT security industry and I'm perfectly willing to accept that this exploit is for real. The pattern of events is not abnormal: the exploit will be demonstrated at a conference but because of NDA the details remain under wraps until the manufacturer releases a patch.

I am a mac user and work in security as well. Let me show the ways in which this "exploit" is unusual and dubious:

• They did not demo the exploit, but instead showed a mockup of what the exploit would do were they to run it.
• They claimed to be working with Apple to fix it, but Apple publicly stated they'd never heard of these guys or seen the supposed exploit.
• They have not submitted their exploit to review by any credible third party that anyone knows of.
• They have hinted that they are under legal pressure, but have not actually said so, or shown any evidence that is the case.

I used to work with this guy who was brilliant at finding and exploiting security holes. He took a G3 Mac running stock standard OSX and proceeded to demonstrate exploit after exploit; not based on his OSX skill but purely on his knowledge of the underlying free software.

There are a number of people who can easily find local escalations on OS X, using knowledge of the BSDs. There are some people who can remotely hack OS X boxes using unpublished exploits. OS X is not some super-secure solution. It is in the same boat as your average Linux distro. It is fairly secure against automated attacks which is what the average user is worried about.

I was at a blackhat conference where they demonstrated a local privilege escalation exploit that existed all the way up to Tiger - they had told Apple about it years previously but it wasn't until they broke their NDA and went public that Apple fixed the fault. The same presentation at that conference demonstrated an OSX kernel exploit that still exists today.

Citations please.

Mac users are in for a rude shock. They've told each other their platform is secure.

Secure means different things to different people. By comparison to Windows, which is all the average user knows, OS X is a fortress. The message that "OS X is secure" is a drastic oversimplification, but it is a clear message and a beneficial one. The more users that switch away from the security nightmare that is Windows, the better for the security of the general population. Now you could try to tell the average person that OS X is sorta secure, but not perfect and it is better than Windows but worse than this OpenBSD thing that can't run any mainstream software they need. In doing so you'd be more accurate. You'd also probably convince a lot of people that it doesn't matter if they are running OS X or Windows and thus contribute to making the general population less secure.

As for this particular exploit, the verdict is still out. Maybe it is the real deal that has a reasonable chance of being a usable remote exploit. To characterize this as a normal vulnerability, is very misleading. There is a reasonable concern in the security industry that these people either were wrong, overstated their case, or were outright trying to be deceptive. There is also the possibility that Apple is completely lying, but that is rather unlikely. They have a pretty good track record of fixing exploitable vulnerabilities the community brings to them and of working well with the security community. They are one of the few companies that provides credit for discovery in their security patches. As time goes on and we learn more and more about this, I have more and more doubts that this particular exploit is on the level.

Honestly weird

[jackjeff]

I watched that video. He says it's smth in the driver... and then shows a Mac also says it would work on a PC. Then, all Intel mac laptops have WIFI now, but he choses to use an external WIFI PC-Card, huh.. sorry Express Card. I know Apple are not angels, but I just can't help be suspicious about it:
- how can a driver have the same bug on windows and macos x?
- why use this stupid external card? what are the chances it did have the same chipset as the internal one?
- and odds are the bug is a buffer overrun... does it take a SO LONG for apple to fix a stupid memory overrun?

That story won't finish well foro someone. The smoke screen is too thick. Either:
- This guy did overrate some minor problem in a misleading way for Apple laptops. Oh.. a third party driver with a bug. Or it's Apple driver with only a thirdparty card. In that case, he's discredited in the domain of security for the rest of his life.
- Apple did really pressure him (as he tends to hint). They're then not only legal jackasses (we know that already) but also incompetent to fix a bug (and that suprises me). In that case the company he's discredited in the domain of security for a while, and they can quit the "virus ads.. mac is secure" for a while.

Future will tell.

Re:Honestly weird

[Inoshiro]

"- how can a driver have the same bug on windows and macos x?"

Quite simply; the Intel card is, in both cases, doing things like UDP and TCP offload from the main system. This means the card and driver together have an internal state in software to manage it, and (due to the asynchronus nature of networking) you can get the hardware and driver software's core into a situation where they don't agree on the state.

The small glue layer that deals with the OS hooks is a static translation layer that wouldn't be involved. The SB Live! and Audigy drivers in Linux are the same driver as the Windows Creative driver (well, they were about 6 years ago when they contributed the code). nVidia uses the same driver code on all platforms as well. For anyone who's written a driver, this is easy to understand.

"- why use this stupid external card? what are the chances it did have the same chipset as the internal one?"

He uses it because it's a timing race, and because it's easier to demonstrate with 2 cards in the system. With a 4000 microsecond delay, this means it's likely taking a bit longer for the OS to service the interrupts between the two cards; enough that the driver bug can show itself. There are likely other ways to tickle this bug that don't require multiple cards, but then you'd have to have something running on the OS. Still, If you setup a machine to throw packets around, you could make an intermittent crash bug appear on an OS -- that's not cool.

"- and odds are the bug is a buffer overrun... does it take a SO LONG for apple to fix a stupid memory overrun?"

A stupid memory overrun? Man, you haven't programmed ever, have you? A timing related bug in device driver code is probably the second hardest bug you'll ever encounter to debug (the first would be the core of the OS itself). Concurrent programming is difficult.

It's responses like these that show why this person had been light on detail. Most people lack the technical background in OS design to understand this issue.

Re:Honestly weird

[MrResistor]

- how can a driver have the same bug on windows and macos x?

Perhaps both drivers are derivd from the same codebase? Or perhaps the developers of both drivers made the same faulty assumtion that leads to this bug?

- This guy did overrate some minor problem in a misleading way for Apple laptops. Oh.. a third party driver with a bug. Or it's Apple driver with only a thirdparty card. In that case, he's discredited in the domain of security for the rest of his life.

What if the third-party driver is behaving exactly as it's supposed to, per the API, and the problem is actually in the OS itself? I mean, seriously: how else does a network card exploit crash the system?

- and odds are the bug is a buffer overrun... does it take a SO LONG for apple to fix a stupid memory overrun?

You really have no idea what you're talking about, do you?

Re:Honestly weird

[Doctor_Jest]

Then he should post the details for those of us who understand what he's talking about, and leave the other people to wallow in their own ignorance.

Deliberately withholding information because of some nebulous "threat" that has never been proven smacks of misdirection and just more "shell-game" antics by some folks who have a personal beef with Apple.

I don't really care if they hate Apple's userbase with all the bile of Hell... if they're serious about this and are not just faking the results to be pissy children, then come out with it. Otherwise, they just need to STFU.

Claiming that he won't reveal details because "no one understands" sounds like HE doesn't understand most likely.

How is it "obvious" ?

[Infonaut]

It's blatantly obvious that Apple's lawyers have come down on him like a ton of bricks

If Apple's lawyers wrote a nastygram to these guys, don't you think we'd have seen it by now? The first thing anyone in a public situation like this does when they get pressure from the big players is to publicize the legal threats.

At the moment all we have is the word of someone who cast aspersions at Mac users, disingenuously claimed that he was exploiting Apple security flaws, and now claims (not so subtly) that Apple's lawyers are the reason he can't come clean.

Re:How is it "obvious" ?

[Cysgod]

When I published my OS X remote root (link-local remote root for the pedantic), a poorly chosen use for DHCP, Apple had advance notice of when I was going to release it, numerous avenues to attempt contact and I didn't hear one peep from Apple Legal. That this guy was suddenly chilled and can't produce evidence of it other than making vague insinuations just sounds hoakey to me.

If he doesn't feel okay about releasing details until they've patched the driver that's one thing. But insinuating that the big bad lawyers have silenced you is quite another. The only circumstance I can think of where they could actually be legitimately silenced is: they are/were being paid to do pen testing for Apple, they submitted this bug, they blabbed about it at a conference when they were under a contractual NDA, they're now claiming they didn't say enough violate the NDA and are remaining mum until the rest of the details go public.

Given the nature of this scenario (i.e. that they'd have to have violated an NDA to wind up where they are insinuating they are now), I'm not overwhelmed with trust for the researchers who are positing this security hole's existence. On the other hand, I was led on and on by Apple waiting for them to release a patch for my earlier security issue that had a similar attack vector and security impact to this posited new security hole. If these researchers are actually waiting, we may all have to sit around for a good long while before the proof is actually shown.

This dilemma is more evidence of why full disclosure is a good idea.

Re:"Implies" my fanny. He says it right out.

[Anonymous Coward]

So Apple is supposed to patch someone else's drivers for a wi-fi card that would never be used with a Mac?
Apple probably looked at these guys and laughed. </blockquote>

Silly rabbit! What the author is inplying, very transparently, is that they found an exploit in the Apple driver that is very similiar to the one in Intel's driver.

Due to his NDA with his company he can't say what he might know about Apple's driver, but he can certainly point out a similar bug and exploit with a similar Intel driver and let you infer what you will... namely that a very similar bug exists in the Apple driver.

Now, whether that's true or not... that's another story.

Apple threw dirt at him?

[Infonaut]

before they only threw dirt to make him look unreliable

Point me to the link where Apple threw dirt at him.

There are plenty of bloggers who did the research on their own and asked the right kind of questions, but I've never seen anything from Apple attacking him. Maybe you're referring to Apple pointing out that he used a third party USB device and didn't disclose any info to Apple about the exploit? I wouldn't exactly call that throwing dirt.

Re:Apple threw dirt at him?

[Hercules Peanut]

I think you're exacty right.

The worst thing about the dirt throwing smear campaign concept is that they (he?) fired first with the "Mac user base aura of smugness on security." comment. Sorry folks, that couldn't be taken as flattery by anyone. In fact, given Apple's lawyers, you might not be surprised if they considered that the proverial throwing down of the gauntlett. It was a poor choice of words in any event and could in no way be expected to endear them to Apple.

I can hear it now: (Entering Johny Cache dream sequence)

Lynn Fox: Hey Steve, these hackers just announced an exploit and demoed it on one of our new Macbooks. They thought we would appreciate it because of our current Mac user base aura of smugness on security.

Steve jobs: Wow! That's great. Hey Lynn, how about calling the legal department and having them issue a letter of congratulations on my behalf to these very helpful young men.

Lynn Fox: I'll take care of it immediately. Would you like for me to acknowledge our failure as a company on Macworld too?

Steve Jobs: Sure Lynn, that would be swell. Oh, we might want to contact one of our programmers to see if there is any possibility of fixing this.

Lynn Fox: Good idea Steve.

Steve Jobs: Maybe we should give these guys a grant.

Lyn Fox: I'm sure our guys in legal will take care of that too.

Steve Jobs: I have a really good feeling about this.

Re:"Implies" my fanny. He says it right out.

[bnenning]

It's blatantly obvious that Apple's lawyers have come down on him like a ton of bricks

Perhaps to you. To others, it's "blatantly obvious" that he has some weird issue with Apple and enjoys spreading FUD. His "clarification" provides no support either way.

He states that the ONLY reason he's saying something now is because he's talking about Intels drivers, not Apples

Or maybe that's all he actually has an exploit for. I don't know, and neither do you.

Re:Really Now!

[Mononoke]

Really now, can anybody come up with a good reason for him to fake something like this?

He's playing the "bash Apple" game, and enjoying the publicity? Notice his comment about Mac bloggers "not understanding" his explanations. He just wants to bash Apple, and nothing more. Probably had an employment application ignored or something. Who knows what his true motive is behind this. He sure makes it obvious that it's more about hating Apple than actually helping the security community. If Apple were actually threatening him, he'd have a registered letter or two from real lawyers he'd be happy to share with us.

Re:something funny is going on here

[Mononoke]

smears, cones and chafing? sounds just like apple

Or a hot date.

Re:something funny is going on here

[gardyloo]

smears, cones and chafing? sounds just like apple

      Funny. I was thinking of Madonna in the 80's.

Re:"Implies" my fanny. He says it right out.

[Dun Malg]

So THAT's why Apple's oh-so-vicious lawyers let them GO AHEAD AND USE A MAC IN THE FUCKING DEMO. Riiiiiiighhht. Puleeeze.

Last I checked, lawyers generally have fuck-all authority to prohibit your use of hardware that you own, genius.

So don't demo on a Mac!

[Cid Highwind]

At BlackHat Johnny Cache claimed this alleged exploit is not platform-specific, he only picked a Macbook for the demo to piss off Apple fanboys. If that's so, and the exploit really works, why not demonstrate rooting Linux or Windows or if you really want to stir up security trolls on slashdot, NetBSD?

Is the exploit real? Who knows, I've seen video of someone cracking a Mac through a wireless driver. Then again I've also seen video of a virus written on a Mac taking down a fleet of invading alien spaceships...

It's not tech details, it's proving it works

[eggboard]

Ellch misdirects attention very clearly. The "Mac bloggers," which include a lot of non-Mac bloggers, have generally said, look, if what Ellch and Maynor showed Brian Krebs is true, then just demonstrate the real Apple exploit without revealing details.

The article above states, "He also went on to explain that while the debate was centered in the Mac blogger community, it made no sense to discuss it because most of them wouldn't understand the explanation if he gave it, adding, "Since this conversation has moved into a venue of people who can actually grasp the details of this, I'm ready to start saying something." "

Thanks for the condescension! It's not necessary. I will note that no one sensible, including myself (over at wifinetnews.com) has asked for the code. Rather, we've asked for Maynor and Ellch to either state that they mislead Brian Krebs, that Apple lied when they stated the company wasn't presented with credible evidence, or that they have material that Krebs saw and Apple hadn't seen yet.

John Gruber did a face-off, not asking for the code, but asking for a simple demonstration with a $1,099 plus sales tax prize.

How does Gruber not understand the technical details when he isn't asking for them? He's asking for a black-box showdown.

Right or wrong, that's a lousy bet to take

[wethion]

What kind of a idiot would you have to be to take that challenge? There is no *way* I would take that bet, whether I knew I was right or not. If they lose, DF wins 2x: 1) DF gets a free macbook 2) DF gets notoriety for calling a bluff. They lose 2x: 1) they cough up significant cash 2) they are humiliated before their peers. Should they win, they win 2X: 1) a free macbook ( psst.. there are 2 of them) 2) they are vindicated However DFireball /still/ wins by gaining recognition for making the challenge. Sorry, only a moron whose balls ruled their brains would take that bet, and that's not a way to bet and win.

Re:Right or wrong, that's a lousy bet to take

[Cid Highwind]

The problem with that assessment is that the DaringFireball guy has *already* won. He gets ad impressions from gazillions of slashdotters and diggers visiting his blog, he gets to look like a hero to his readers for standing up to the mean anti-mac bile spewing hacker, and he gets to make Johnny Cache look like a blowhard with code that only works on one flaky USB adapter (if it works at all), all while knowing that his $1000 is reasonably safe for the reasons you already listed.

Re:Right or wrong, that's a lousy bet to take

[wootest]

The ads from the network Daring Fireball is using are paid by a flat fee, so Gruber has no vested interest in getting "impressions" (of which I think he already gets plenty). Claiming that it's a whoring move for ad moolah (if that's what you did) is wrong - the alternative would be a long drawn-out back-and-forth, and I have a feeling we'd all bore of that very quickly, because we're already in midst of such a circus. That said, for your reasons, I wouldn't want to be Johnny Cache right now, but I can't say he didn't set this one up himself either.

It's all so obvious

[lullabud]

At least, that's the message I'm getting from this thread. Everything about this episode is obvious. Each contradicting story is just, like, so totally obvious.

Mac Jihad...

[bigtallmofo]

The analogy is actually pretty apt. You have a group of people that basically run the world - "The West" (in this case, non-Apple users) and a downtrodden ragtag group of extremely proud people convinced that their way is better - "The Islamist Fascists" (in this case, Apple users).

It's very common for them to lash out at everyone because of their true feelings of inferiority and lack of understanding as to why everyone doesn't see the world like they do.

Case in point - I'll be modded -9 Troll in about 30 seconds as every Mac user with mod points steps on their own mother to mod be down.

Re:Mac Jihad...

[aonic]

If I had mod points, I would mod you down. Not only do you demonstrate a complete disdain for whoever you think is "inferior," you show a complete lack of understanding for the issues in the middle east.

There is no "inferiority complex" in the middle east. They aren't emo kids running around threatening to slit their wrists. It just so happens that their standards of living are ridiculously low compared to the standards of living of "the west," not directly due to us, but partially. If you grew up there, you'd be looking for someone to blame, and their government provides "the great satan" as a convenient scapegoat. Further proving their point, "the great satan's puppet in the region," (aka israel) has just rampaged through lebanon, destroying civilian targets like bridges, hospitals, and airports, further degrading their quality of life. it's lack of understanding of the kind that you have just demonstrated that has brought us into the current situation in iraq and afghanistan, as well as the US unspoken nod to israel to rampage across the middle east.

this in no way relevant to the situations of mac users, who just happen to have a different OS preference. your above statement would be like saying that whenever an african american person acts stereotypically black (whatever you might define that as) they are acting out of a feeling of self-inferiority.

think about it.

Re:My question is...

[wootest]

Yes, they probably will.

It's the thorough lack of details and crummy reporting mixed with derogatory comments that makes it hard to discern if there is an exploit to speak of at all. I know I'd have nothing to worry about if the guys would have presented their exploit neutrally (without shit-flinging Mac users for "being smug"), been detailed in exactly what the target of the attack is (they can do that without revealing details on the exact nature of the exploit) and told us that they're working with Apple to resolve it (because I don't believe for a second that Apple would tell them to put a sock in it rather than work to fix the issue). You know, the way these things are done professionally. But perhaps it's too easy to cast blame, especially since a number of reporters aside from Ellch and his collaborator have been reporting different facts.

Re:My question is...

[BKWatch]

Well, what really set the stuff ablaze was the "cigarette in the eye" comment. What puzzles me is I can't find where that came from. In Brian Krebs's first article, he says: http://blog.washingtonpost.com/securityfix/2006/08 /hijacking_a_macbook_in_60_seco.html ""We're not picking specifically on Macs here, but if you watch those 'Get a Mac' commercials enough, it eventually makes you want to stab one of those users in the eye with a lit cigarette or something," Maynor said. "The main problem here is that device drivers are a funny mix of stuff put together by hardware and software developers, and these guys are often under the gun to produce the code that will power products that the manufacturer is often in a hurry to get to market." Now everyone else who quoted that was just referring to Kreb's article. Did anyone actually hear (besides Krebs) Maynor make this statement? Why did only Krebs report it? Did he make that quote up? Maynor is appartenly a Mac user himself.

Re:Macjihad

[OmnipotentEntity]

Umm... something having a bug isn't an incredible claim. Sure, it's not a good thing but it happens to everyone. It's nothing to be ashamed about. Just get the bastard fixed and stop dicking about.

This isn't about a perpetual motion machine or an entropy reducing device, or even P vs. NP or Riemann's Hypothesis. This is code. This isn't world changing. Bugs happen, then they get fixed. If they want to stay silent to dodge liability let them. If there is a bug it'll be patched, if there isn't they'll fade into obscurity.

Re:"Implies" my fanny. He says it right out.

[WaltFrench]

> It's blatantly obvious that Apple's lawyers have
> come down on him like a ton of bricks, forcing
> him to be quiet until they get a patch out.

The least likely answer, actually. From the various info, this is not even an exploit of Apple hardware or software. What's to patch?

Any Apple lawyers parachuting from black helicopters (a rather calm, reasoned metaphor, wouldn't you say?) are probably telling him that claims about *Apple OSX* insecurity that are false would be defamation. While Americans are welcome to spout their opinions, false claims of fact can be found to be libel and he could be subject enforecement of damages.

If indeed that were Apple's response, I'd keep my fat trap shut before I found out that I'd stuck not just my foot, but most of my anatomy down it. Uncomfortable.

Apple has done nothing

[YesIAmAScript]

They keep stating Apple is pressuring them, but Apple says they have not contacted Apple with any info.

They state they won't say anything until Apple patches the problem? It would speed up the process of getting it patched if they would tell Apple about it!

From what I can tell, they are pretending Apple is pressuring them because it makes them look more important.

Addtional note, what is this stuff about Intel's drivers? Apple doesn't use Intel's chipset, they use an Atheros or Broadcam WiFi chipset. Additionally, what good is getting your packet on the stack? Apple uses the NX bit, so you can't get code on the stack to execute.

Exploit is in the centrino driver

[mveloso]

The exploit is in the centrino driver. Everyone assumes that the Mac airport driver is based on Intel reference code, but it may not be. If it was, you would think that they would have talked about that more.

Note that for this exploit to work, the network needs to be active (ie: both cards need to be joined to a base station). Why? Because you can't send UDP packets to something with no IP address...unless they're blasting WiFi cards directly, which seems unlikely.

Re:I can make my Mac crash too!

[csirac]

Hint to everyone: OSes do weird things

Hint to everyone: RTFA for yourself and ignore uninformed slashdot comments masquerading as authoritative ones.

as install two wireless cards

He speculates that triggering the race condition with a single NIC is possible, two NICs makes it easier. He was just telling the community what he found, and that steps should be taken by the vendors to fix it (and they did, if you read his message). Just because he couldn't trigger it with a single NIC, doesn't mean 1) We should ignore the issue 2) someone else can't

and a netcat listener.

The exploit would work on a machine that has any sort of UDP listener running on the interface being attacked. Netcat is merely useful for demonstration purposes, otherwise we'd have people concerned that e.g. a bug in Skype (if that UDP service was targeted instead) is the real vector for the exploit rather than the Intel NIC driver.

I'm sure Apple will fix it asap.

And if you had read his message, you'd see that 1) Apple has patched it already, 2) it's an Intel bug, not Apple's.

Checking driver security

[Space cowboy]

I don't know about even if it is a bad driver, it's still the OS's fault for letting the driver take the whole system down, so it's still the OS writer's problem

Consider a video-card driver. That's blasting several hundred megabytes of data across the bus at any one time (say you're playing a full-screen MPEG4 with no gfx-card support for decode). Would you want the OS to validate and check every one of those transactions ? Whoops, there goes the frame-rate. Still, slow-motion is fun...

Or a SCSI-driver, connected to a high-end RAID. Again, we're transferring hundreds of megabytes/second. Your throughput just dropped "through" the floor... Hope that wasn't crucial.

Or, a network driver in a department server, serving several fibre-channel connections. Again, throughput is the victim.

My point is that sometimes you need the driver to be performing at its optimum. You can make the argument that an exploit could bring the whole machine down, and that people lose more time/work/money that way, but that's a hard argument to make, when the video-artists in the post-production suite can't transfer their video over the gigabit network fast enough any more and the clients are walking out the door...

I can see what you're saying - that the OS ought not be vulnerable to bad drivers, but to insist on verification as part of each driver transaction with the OS is broken-by-design, IMHO. Perhaps it just needs more R&D before pushing it out the door, and pen-testing ought to be part of that R&D. I very much suspect at the moment, that any driver that adheres to a spec will be sold as "working"...

Simon

Re:Hacking...

[ryanr]

What are you going to point EIP to?

All kinds of fun places.

Not code on the stack since OS X uses the NX bit on the stack by default

So, is NX support enabled on kernel pages?

Some code in a buffer? How do you find the address of the buffer? How do you inject the code into the buffer in the first place?

Right, so you want to know some basic buffer overflow exploitation techniques. I think I've got a book somewhere that some friends and I wrote, it covers that...

Cache doesn't really say anything

[LKM]

It should be noted that Cache still didn't come out and say whether Macs with Apple's AirPort cards are vulnerable. Gruber Specifically asks him about this on the list, and he doesn't answer it. He does say that he expects a patch from Apple, which clearly implies that AirPort cards are vulnerable, but he doesn't say it, instead claiming that Apple is legally threatening him and running a "PR smear campaign" against him - again without giving any specifics.

This whole episode is just insane. If Macs are vulnerable out of the box, why not say so (especially if you're "waiting for an patch from Apple")? If they aren't, why implying that they are?

It's entirely possible that Macs are vulnerable. Macs aren't magically secure and save from bugs. The issue with this whole thing isn't that Mac users believe that Macs can't possibly be hacked. The issue is that the people who ostensibly found the security problem don't seem to be capable of telling us what the heck they actually found and whether Macs are vulnerable, instead making vague accusations and implying stuff without giving any specifics or even a demonstration.