Slashdot Mirror
MacBook Wi-Fi Hijack Details Finally Released
Wick3d Gam3s writes "Hacker David Maynor attempted to put the strange tale of the Macbook Wifi hack to rest, and offered an apology for mistakes made. All this and a live demo of the takeover exploit was made at a Black Hat DC event yesterday. Maynor promised to release e-mail exchanges, crash/panic logs and exploit code in an effort to clear his tarnished name. Said Maynor: 'I screwed up a bit [at last year's Black Hat in Las Vegas]. I probably shouldn't have used an Apple machine in the video demo and I definitely should not have discussed it a journalist ahead of time ... I made mistakes, I screwed up. You can blame me for a lot of things but don't say we didn't find this and give all the information to Apple.'"
There were two demos:
One on 10.4.6 showing that it was vulnerable (crash achieved and remote code execution is possible).
The second demo showed no crash on 10.4.8 showing that the patches Apple released did indeed fix the problem he pointed to.
Frankly, I wouldn't even be surprised if he did some old-fashioned reverse-engineering of the patch to create the exploit for the older boxes.
And then used his time machine to go back in time to before the bug was patched and announce the exploit?
No, his original claim was a farce (hell, look at the video, there was only one wireless device available according to ifconfig). Apple then audited their code, found 3 bugs. He took one of the bugs mentioned, found out how to trigger it, triggered the crash and now claims he was right all along.
The problem is that what's happening now doesn't support his original claims. The original claims were he could hijack a MacBook in under 60 seconds and gain completely control of it. Now all he's getting is a crash with no control.
That is correct, the original video was faked... They prob were close but did not want to wait.7 11399295&hl=en
Here is a video I made debunking their proof: http://video.google.com/videoplay?docid=146818771
My guess is that they got a buffer overflow but had not yet found the correct location in memory to write their shellcode. They still have not...
Nature journal lied in Britannica vs Wikipedia Ask to retrac
I await the promised publishing of the email exchanges with Apple on his blog. If he shows that he actually did provide Apple with details on the exploit, then he might restore some credibility. As it stands, however, his demo yesterday sounds like more of the same obfuscation that has characterized this whole incident.
1) In the original demo, he gained command-line access to the target machine (using a third-party wireless card). The claim was made to Brian Krebs in the Washington Post that the built-in wireless was similarly vulnerable (which would be far more relevant, since all MacBooks have built-in wireless). Yesterday's demo showed a crash of the target machine. That's bad, but he still has not demonstrated a takeover of the MacBook using the built-in wireless after all this time.
2) The fact that Apple's patch addresses the flaw that caused the crashing does not prove that Maynor engaged in responsible disclosure. Apple has said that Maynor provided them with no code or other details about the exploit, and that they did their own investigation. The investigation, according to Apple, revealed a flaw, leading to the patch. The issue is NOT whether a flaw existed. All Maynor demonstrated was that Apple's security patch works, which is really not that enlightening.
Not taking any sides here, but here is what he has said about this (and other issues) from his blog
I thought you said it was a hijack yet you only showed a DoS.
Yup, I showed a crash. I didn't feel the need to do the do the entire hijack for two reasons: Apple already confirmed that this vulnerability leads to remote code execution (they said so in the advisory here). Everybody that was running a sniffer during my talk now has a copy of the DoS code. The demo had two parts. I showed the crash happening on a 10.4.6 machine since it didn't have any of the airport patches. I then rebooted into 10.4.8 and the crash no longer happened. I did this to prove that the Airport patches issued on Sept 21st, 2006 fixed the problem I was demoing. The only real change to airport code was the security fixes that were issued.
You just reversed the patches and found what you then showed on stage.
I find this to be a funny argument. If I have the skills to reverse the patches and do a binary difference analysis of them, why couldn't I use those same skills to find the bugs in the first place (they weren't hard to find). This argument also doesn't take into account the fact that I showed that the first crash of the exploit occurred on Jul 15th, 2006, or emails to Apple helping them build a wifi auditing box (A linux machine with madwifi patched with LORCON) and pointed them to a vulnerability that was fixed in their patches (a problem with overly long SSIDs). The picture below is from the day I bought the Macbook, July 15th 2006. This crash occurred because I was fuzzing other devices and the Macbook crashed before I got to run the initial setup.
"reality has a well-known liberal bias" - Steven Colbert
Why didn't he simply show a repeat of the same thing he demonstrated before--a takeover of the machine?
Because "a magician never repeats a trick."
"How to Do Nothing," kids activities, back in print!
So, let me get this straight
1) he finds a bug, but he can't quite manage to exploit it. He can crash the machine (and that's a bad thing) but it doesn't *necessarily* mean he can exploit it.
2) There's a big conference coming up, and he knows he'll get the headlines if he announces anything bad about Apple. That's just the way of the world. Dammit, he *still* can't find the exploit.
3) The deadline arrives, he can't exploit the machine, but he goes ahead and gives the demo (faking the evidence with a different machine), confident that he'll get there eventually.
4) He hides behind "legal issues" (even now, he won't reveal emails) to prevent himself from being exposed as the liar he appears to be.
This series of events is just about the worst thing a researcher can do. It's like an athlete taking steroids - there will be no forgiveness, no olive-branch will be offered; his reputation is irredeemably tarnished, because he lied for personal gain. We *need* to be able to trust people publishing exploits, and if this means his career is in ruins, I say "Hurrah!" The less people like this around in the business, the better.
I just want to also point out that I don't recall any lawyers being involved at any time in this dispute - neither party claimed lawyers were involved (he said Apple "leaned on" his employers, whatever that means, but lawyers were never mentioned.)
Apple claim he released insufficient technical details to them to help them in their investigation, so they had to go to the trouble of doing a full internal audit of a large source tree (and all the time, he's spreading disinformation and tarnishing their name). They find and fix some bugs, and now he's in an even worse position - his crash "exploit" won't work.
So, now, he releases the "details" - he's given up trying to exploit the original OS, and brushes that small point aside in the "details". He tries to save as much face as possible instead of admitting he was just plain wrong - he's basically covering his ass. Does anyone else think "details" ought to actually show the information he claimed to have (like being able to take control of a Mac in 60 seconds) ?
In science, there are two fundamental maxims
1) Don't falsify the data.
2) Extraordinary claims require extraordinary evidence. (*)
He failed, on both of these, as far as the world can tell.
(*) "Extraordinary" here means in the technical sense - the first exploit of any kind requires unequivocal proof. I don't care if it's OSX, Windows XP, or Linux - show the data. Prove the case. Don't wave your hands around and babble.
Simon.
Physicists get Hadrons!
No. That is a link to a story with a great lack of details and a number of still unsubstantiated claims.
There is still no public supporting evidence for his clams -- he hasn't even posted his personal correspondence with Apple yet, something he'd been free to do since day one.
Maybe he'll get around to it someday... who knows. But for now it's still just a lot of words with no support.
-30-
Theory and practice are two completely different things.
not in theory.