Slashdot Mirror

← Back to Stories (view on slashdot.org)

MacBook Hacked In Contest Via Zero-Day Hole in Safari

Posted by Zonk on from the and-the-winner-is dept.

EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"

3 of 156 comments (clear)

  1. Re:So, if I reaf TFA correctly: by RalphBNumbers · · Score: 5, Informative

    As I understand it:

    The rules originally required getting a user shell on a macbook connected to a wireless router without any other access, or getting a root shell under the same conditions on a second macbook without using the same bug.
    The prize was the macbook(s) you hacked.

    But they decided not enough people were interested, so 3Com added a $10,000 bounty for a winning bug.

    But no one could crack it, so they set the machine up to visit malicious web pages submitted by email.

    Then someone found a bug in Safari, and successfully crafted a webpage to exploit it to get user shell access.

    --
    "The worst tyrannies were the ones where a governance required its own logic on every embedded node." - Vernor Vinge
  2. Read a better article than the one linked. by Anonymous Coward · · Score: 5, Informative

    The MacBook was actually only hacked because they lessened the rules and actually had someone open Safari and use a malicious website. No ports were closed nor was the firewall running.

  3. there are some weird things in Safari... by lixlpixel · · Score: 5, Informative

    Safari lets you include local files, for example...

    i told apple (and got a lame reply that it would be fixed eventually) month ago, yet it still works.

    see http://destabili.zation.eu/ for a quick harmless example that can check what applications you got installed.

    and then there is a way to crash Safari which exists for more than a year - again i had an email conversation where they wanted more info and crashreports - yet nothing was ever done about it.

    http://lixlpixel.org/safaricrash/ and follow the instructions - but make sure you don't have any important tabs open...