Slashdot Mirror
MacBook Hacked In Contest Via Zero-Day Hole in Safari
EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"
that's it! I'm switching back to Windows!
Shop as usual. And avoid panic buying.
The machine couldn't be hacked, so they relaxed the rules so it could be? I wish they'd been more explicit as to what 'relaxing the rules' meant. But maybe that would've spoiled the story.
I am a believer of momentum and curves.
Safari's rendering engine is based on KHTML. So is Konqueror affected by this flaw as well?
The MacBook was actually only hacked because they lessened the rules and actually had someone open Safari and use a malicious website. No ports were closed nor was the firewall running.
I'm a Mac user and as such I'm not claiming invincibility although the "Unix" like foundation makes me more secure its still the end user's responsibility to not run as admin or God forbid root. Not to mention using a good firewall or correctly configuring the one that's already built in is vital and just practicing caution on the web. That aside I just don't think this is entirely honest, I wish they would disclose all the variables involved to include all settings used. But as others here have said considering Apples foresight using open source means the between Apple and the Konqueror devs this will be quickly addressed. But my gut feeling here is that something stinks in Denmark!
Die First, Then Quit
I wish they would say if the user that safari was running under was admin or regular. If it was admin then this is even less of a hack than it already is. Also I wonder if they disabled the safari feature to automatically "open safe files after downloading". That option puts a lot of trust in other programs not to have holes. indeed it's not really safe at all. Only stupid people or people that don't do stupid things leave it on.
Bottom line no remote hacks.
Some drink at the fountain of knowledge. Others just gargle.
Normally we make fun of Slashdot editors for not being able to spell simple English terms familiar to a mass audience correctly. They loose there audience when they do that. Usually they can get their terms of art correct. Not this time. (Not a sentence)
Guys, it's spelled "0day", and it has been since before you l33ch3d Karateka on a catfur. Do have some sense of perspective. (Question mark?)
See me.I mean - I can only assume this was a 'white hat' hackers conference, given there was actual publicity given and a public bounty and such. But then things like these pop up?
Makes me think.. black hat, white hat.. what's the difference these days? I thought a white hat hacker was the 'good guy' (albeit still a hacker).. the kind of person who hacks for fun / curiosity.. the kind of person who notifies the developer of the bug or, at least, just makes the bug known to the world at no charge. Not the kind of person who hacks, then scours the 'security conferences' for a bounty, and when that bounty is lower than what they could get off of actual 'bad guys', complain that the bounty is too low. To me, that just sounds like the person is a black hat, but dons a white hat on top in an attempt to fool us into thinking they're white hat.
As a longtime Mac user and a fan of Apple products in general, I'd like to congratulate the winner of this contest. Too many Mac users now seem lost in willful ignorance of the fact that tasteful, thoughtful design alone doesn't render a system bulletproof. Thus, I applaud any honest efforts to increase the public awareness that yes, shit-happening potential exists, even on a Mac.
(I said honest efforts. That guy who claimed the AirPort hack is still a raging tool.)
Another point to emphasize—and which, curiously, seems always to be overlooked on Slashdot—is that an uninvited guest doesn't need root to ruin your day. As long as he or she can rm -rf ~, or better yet, yank all your most intimate personal documents and send them flying across the internets, root's just gravy. So let's not pretend this Safari vuln is harmless.
Really though, how on earth are you supposed to guard against attack through vectors not yet publicly known, without either (a) suffering a crippled functionality, or (b) being badgered into clicking "Continue" out of habit? The best approach I've seen is the one adopted by Google's anti-phishing plugin (and for those of us who can't stand Firefox, Leopard can't come soon enough). It's intuitive, unobtrusive, and cuts straight to the heart of the problem: making sure you're visiting the wholesome, trustworthy site you think you're visiting.
But even with the Google phish alarm installed, if you make one little mistake—if you step out of line for just a second—you could be hosed. Or what if someone figures out how to inject an attack on a "safe" bulletin board? You're hosed. Hell, maybe someday Google blows it like a Taco Bell restaurant inspector. Hosed.
So can it even be done, this cake thing, with the eating? Or is our best hope to just pray to Jobs the Mac never becomes mainstream enough to attract attention from the big-league black hats?
Make Slashdot readable! See journal.
Safari lets you include local files, for example...
i told apple (and got a lame reply that it would be fixed eventually) month ago, yet it still works.
see http://destabili.zation.eu/ for a quick harmless example that can check what applications you got installed.
and then there is a way to crash Safari which exists for more than a year - again i had an email conversation where they wanted more info and crashreports - yet nothing was ever done about it.
http://lixlpixel.org/safaricrash/ and follow the instructions - but make sure you don't have any important tabs open...
How was the machine configured relative to an off-the-shelf OSX installation?
While I understand that for the purposes of the contest it might have been necessary to reduce those protections, I think that before something becomes "news" we should know what the real risk is.
Does this hack require the user to manually disable protections the OS ships with, or manually enable services that default to off? The article seems light on detail.
In other words, nobody was able to remotely hack the machine, so they allowed for local exploits, which someone used in a Safari URL.
Expect Apple-haters and other FUDmeisters to completely ignore the difference, like InfoWorld did yesterday in their breathless headline about "remotely breaking in."
"Sufferin' succotash."
I'm not exactly sure what the default settings are like, because honestly it's been years since I've used a Mac that was in its out-of-the-box, default state, but the way I have it right now, the only warning I get is when I'm about to open an application that's never been run before.
This, IMO, is a Good Thing. It's only a half a second delay when I really do want it to launch a new application, and it's a nice heads-up that the computer is doing something that I've never done with it before. More than once I've hit "Cancel" and decided to take a second look at exactly what's going on, which in my mind means that the dialog is useful.
If a dialog pops up, and you never, ever click anything but 'yes,' then it's a stupid warning, and you're right to say that it's just ass-covering on the part of the OS manufacturer. However, if you find yourself using both options, then it's probably a good thing to have it there.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."