Slashdot Mirror
Mac Hack Contest Redux
narramissic writes "Remember the controversial Mac hacking contest from last year's CanSecWest conference? No? Here's a refresher: Conference organizers challenged attendees to hack into a Macintosh laptop, with the successful hacker winning the computer and a cash prize. Winner Dino Dai Zovi found a QuickTime bug that allowed him to run unauthorized software on the Mac once the computer's browser was directed to a specially crafted Web page. Well, the contest is back again this year, but with a twist, says Dragos Ruiu, the principal organizer of CanSecWest: 'We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.""
http://slashdot.org/firehose.pl?op=view&id=508230
preview button, my computer does't have any preview button
out of the box linux? Is there really such a thing? Ubuntu OEM, knoppix? That's a pretty wide range here.
THL phish sticks
> the successful hacker winning the computer and a cash prize I'm betting somebody's taking home a Windows machine.
I'd make sure that each was installed to default configuration. No tweaking allowed.
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms.
Just to make it "fair".
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The 386 it was installed on?
See, things like this are great when in all in good fun. It's good for the mind and is a wonderful example of human creativity.
Like I always say, "anything made by a human can be broken by a human".
Before the sea of "vista sucks" comments, I'm going to ask this question:
When vista inevitably goes first, who is going to want it? I assume it must be a good enough computer to actually run vista, so lets all take guesses at the OS loaded onto it after it's "pwnd".
The Vista computer won't get hacked because nobody will want to take it home!
Engineering is the art of compromise.
Aww come on, placing Vista in this contest is obviously unfair to OS X and Linux; the latter two don't stand a chance at beating Vista for first place.
:(
Won't somebody please think of the Vista?
The problem with the "let's see which OS cracks first" approach is that Microsoft, Apple or maybe even Novell would bribe participants to focus their efforts on their competitor's OS.
I think it's obvious the nonsense that'll come out of this. People will say, x OS is more insecure than y and z because it fell first/so quickly. Regardless of the skewed skill/effort that went into breaking it.
This "twist" is bullshit.
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms. Just to make it "fair".
When is the last time you left an OS in its default configuration?
A fair configuration is one in which all tested operating systems provide as identical as possible feature sets, including all the features the majority of people like to use. Like printer and file sharing, for example.
It's also not fair to include, for example, NoScript- that breaks a ton of websites out of the box until you whitelist sites. Likewise for not including Flash as part of the package. An even more relevant example: the necessary firewall rules to allow IM (and file transfers.)
Please help metamoderate.
I feel so bad for that subnet. So many idiots who will just sit there and hammer it endlessly hoping that some magical 'hacking' will occur.
We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.
What I'd be most interested in is a survey of contestants as to their platform experience, and how focused they intend to be on attacking the different platforms. That part could be wildly unscientific, but could be interesting if everyone answers openly.
Couple that with some good logs of network activity, to see how focused attacks are on the various systems.
For example, it could turn out that nobody goes for the supposed low hanging fruit, and everyone tries to target the Mac...or an OpenBSD box, if they bring one. Etc.
Please help metamoderate.
This hardly seems like a fair test, for what the results are implied to indicate.
/. , but oh well.
I'll predict that Vista goes down first, because there are more Windows programmers out there than Mac/*nix. Time-to-first-hack isn't a valid measure of OS robustness.
That probably won't be a popular statement here on
"National Security is the chief cause of national insecurity." - Celine's First Law
all the contestants attack each of the three systems with the winner given his choice of the systems.
The IPs of the machines are given out, but not what OS is on the boxes. (Identifying the windows box is pretty easy though, RPC etc).
Obligatory blog plug: http://www.caseybanner.ca/
That comes on OS X by default but to make Windows equal in potential flaws you have to install it on Windows too. Stuff like that gets complicated fairly fast. Quicktime shares code between OS X and Windows and most of the recent flaws regarding rtsp were the same result on either platform which was DOS or potential execution of arbitrary code.
Even if it were the most secure, Vista would be first. I'm sure there are kits you can buy from shady groups in Eastern Europe or Russia that will do the trick immediately. If Vista doesn't already have the highest market share, it will at some point. So if you make hacking kits for organizations that make botnets you're gonna crack Vista first.
What about *BSD? This contest is grossly unfair unless a *BSD is included!
Hehe. Let's see them try to pwn that one.
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
Who is operating each machine? I need their email addresses. I want to send them some programs, and my "hack" is that the programs will come with instructions to the operator: please execute this attachment.
My understanding is that for Windows, I just need to have the filename end with .exe. For MacOS, I need it to end with .dmg. For Linux, I need to train the user how to use chmod.
"Believe me!" -- Donald Trump
that they won't use a Debian stable netinstall with properly configured iptables and choose to deploy Fedora instead ?
If I were to enter such a contest I would target OSX first, then Linux and Finally vista.
... acrobat, flash...etc provide great cross platform opportunity for successful attacks. It might actually be worth ones time to try for a common expliot and win all three :)
:)
OSX is first because apple has been hideing behind security by obscurity for too long. I have seen no evidence that suggests OSX gets it any more than Microsoft did.
Linux next because source code is avaliable... and while clever hits without source are sometimes easier you just might get lucky walking the ususal paths and find something exploitable.
MS has been more or less awake from the security perspective for years now and most of the expliot efforts have been targeted at this platform which raises the bar for discovery of new expliots because all the trivial vectors have already been probed. Following the same line windows expliots are simply worth more than OSX or Linux expliots. Good ones can be worth a room full of PCs if you can find the right buyer.
Applications such as browsers, media players, and various popular plugins
Besides a PC is a PC... you can always reformat the drive and install Solaris if you want
...and you damn well know it. You guys are deliberately baiting the language nazis - there's no way you could *still* be ignorant of what this phrase means.
Someone should pull a Kobayashi Maru and hack all the competing hacker's machines so they can win the prize.
I hope they'll go with Gentoo. It is uncrackable. When the hackers attack they can't do anything to it because the system is busy compiling itself.
I think all each team should have to hack all 3 computers, and the first team to do so gets to pick, and then the seconed picks the next one and then the thrid gets the last one. So that equal energy goes into hacking each unit, and each team will learn something about a system they probably didn't know, and isn't that what this whole thing is about, learing something.
They should probably turn off the Windows machine, just to make it fair and all...
this doesn't measure the security of the OS
/*
it measures the stupidity of the user
your program can be a one liner on any of the machines.
just a freaking script that says "delete *.*"
or you coudl see who has passwordless sudo and go sudo rm
and that will do on any *nix pretty much
again we are testing the OS not the STUPID USER AT THE WHEEL
"Jazz isn't dead, it just smells funny" ~Frank Zappa
EdelFactor
While they may help reveal specific information about vulnerabilities, which is good, they don't provide much useful information about the security of the systems being attacked.
two windows laptops plus a cash prize.
What'll Vegas open the odds at?
I saw the headline and got all excited....
Sam! If you will let me be,
I will try them.
You will see.
As a long time OS X admin, OS X will -unfortunately- probably go down really hard this time 'round.
After all, LI_US has already passed judgement on it.
Sig this!
You could be real bastard and put OpenBSD on a top or the range $10k machine and watch as people spend hours pulling their hair out.
Oh boy! That will be fun.
All the Windows fans will be trying to hack Linux, trying to prove that it is worse. All the Linux and OSX fans will be trying to hack Windows for the same reason.
It will be one big mud slinging campaign.
I can just see this happening.. MC: Okay...the competition is ready to start... We have three computers, Vista, XP and Mac....crack it and it's yours.. Are you ready? On your marks, get set, g.......OKAY OKAY! Not funny...We have now XP and MAC available...the competition will start on my mark....On your marks, get set...go!!
This text has been written completely with recycled bits and bytes.
As Wesley Snipes says, always bet on Mac.
Although actually, I think Teh Lunix will definitely give Mac a run for the money. They are both shining beacons of security through obscurity.
I don't know about any of you, but I don't think my linux box is very secure at all. Let me know if you can hack it: http://127.0.0.1/
You can't determine the security of an OS, any OS, by this kind of limited one-off testing. REAL testing is systematic and time consuming, and involves completely the opposite rationale. Conventioal testing involves attacking a single target until it breaks, this "test" involves attacking a bunch of different systems and seeing which fails "first". This doesn't really evaluate "security" because the critical factor is THE ORDER IN WHICH THE EXPLOITS WERE TRIED. If the attacker just happens to hit the right exploit on his first attempt, he would hack that box "faster". Along the same lines, # of exploits doesn't really mean shit either. What matters is HOW SEVERE the exploits are.
I'd argue that the Linux box is likely to fall first, simply because the attackers are most familiar with hacking Linux boxes. The limited permissions structure of Linux means that if an attack succeeds, you very likely have root as opposed to Windows attacks which may just expose the service. A lot of the weaknesses in Windows and MacOS are application-specific, if you don't have those apps installed you don't have the vulnerabilities. Since Linux, by default, is likely to have a lot more apps installed it's likely to have more vulnerabilities as well.
with out of the box ubuntu you just have to press esc on boot and grub will give you root access...
they should give the computers to people for a week to use and test the resaulting setup (with any luck vista will be infected by then anyway)
by nature linux machines are not used as "out of the box", the are tweaked -- quite often for the better
by contrast windows machines have limewire etc installed
maybe everyone has to hack the machines that everyone else is using and last one standing wins
QuickTime is malware in and of itself as far as I'm concerned. Every time I've ever installed it on Windows, it's buggy and something manages to go wrong. That and it tends to take over every file association it possibly can regardless of what it's told to do. Then when I go to uninstall it, I can never seem to get it all off the system.
Why, if not because?
I don't want to start a holy war here, but what is the deal with you Vista fanatics? I have recently upgraded from a 1GHz PC with 1GB of RAM and Windows XP to a new quad core 3.5GHz with 4GB of RAM and Windows Vista to help me at my freelance gig where I needed to copy a 17 Meg file from my home network to a desktop folder. On Vista it took about 20 minutes. At home, on my old iBook running OSX, which by all standards should be a lot slower than this PC, the same operation would take about a minute. If that.
In addition, during this file transfer, my sound will not work. And everything else has ground to a halt. Even IE is straining to keep up as I type this.
Vista addicts, flame me if you'd like, but I'd rather hear some intelligent reasons why anyone would choose to use Vista over other faster, cheaper, more stable systems.