Slashdot Mirror
Mac Hack Contest Redux
narramissic writes "Remember the controversial Mac hacking contest from last year's CanSecWest conference? No? Here's a refresher: Conference organizers challenged attendees to hack into a Macintosh laptop, with the successful hacker winning the computer and a cash prize. Winner Dino Dai Zovi found a QuickTime bug that allowed him to run unauthorized software on the Mac once the computer's browser was directed to a specially crafted Web page. Well, the contest is back again this year, but with a twist, says Dragos Ruiu, the principal organizer of CanSecWest: 'We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.""
http://slashdot.org/firehose.pl?op=view&id=508230
preview button, my computer does't have any preview button
out of the box linux? Is there really such a thing? Ubuntu OEM, knoppix? That's a pretty wide range here.
THL phish sticks
> the successful hacker winning the computer and a cash prize I'm betting somebody's taking home a Windows machine.
I'd make sure that each was installed to default configuration. No tweaking allowed.
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms.
Just to make it "fair".
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
The 386 it was installed on?
Before the sea of "vista sucks" comments, I'm going to ask this question:
When vista inevitably goes first, who is going to want it? I assume it must be a good enough computer to actually run vista, so lets all take guesses at the OS loaded onto it after it's "pwnd".
The Vista computer won't get hacked because nobody will want to take it home!
Engineering is the art of compromise.
I think it's obvious the nonsense that'll come out of this. People will say, x OS is more insecure than y and z because it fell first/so quickly. Regardless of the skewed skill/effort that went into breaking it.
This "twist" is bullshit.
I would have said that the challenge pretty much amounts to saying "The next OS we find a vulnerability for is the weakest". In the long term it is a meaningless piece of data. If we hear about a new exploit for any OS tomorrow it means nothing, you have to look at long term trends to find a correct answer.
Slashdot: Proof that a million monkeys at a million typewriters can create a masterpiece
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms. Just to make it "fair".
When is the last time you left an OS in its default configuration?
A fair configuration is one in which all tested operating systems provide as identical as possible feature sets, including all the features the majority of people like to use. Like printer and file sharing, for example.
It's also not fair to include, for example, NoScript- that breaks a ton of websites out of the box until you whitelist sites. Likewise for not including Flash as part of the package. An even more relevant example: the necessary firewall rules to allow IM (and file transfers.)
Please help metamoderate.
We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.
What I'd be most interested in is a survey of contestants as to their platform experience, and how focused they intend to be on attacking the different platforms. That part could be wildly unscientific, but could be interesting if everyone answers openly.
Couple that with some good logs of network activity, to see how focused attacks are on the various systems.
For example, it could turn out that nobody goes for the supposed low hanging fruit, and everyone tries to target the Mac...or an OpenBSD box, if they bring one. Etc.
Please help metamoderate.
all the contestants attack each of the three systems with the winner given his choice of the systems.
Yes, but the skill and motivation to hack OSX is much higher. The person who can exploit OSX in a meaningful way would get a lot of prestige from the '*hat' community.
Besides, that involves a logical fallacy. Basically be your statement to be true, they must ahve the same architecture, developed by people od equal skill use the same project management style and the same QA.
The Kruger Dunning explains most post on
Even if it were the most secure, Vista would be first. I'm sure there are kits you can buy from shady groups in Eastern Europe or Russia that will do the trick immediately. If Vista doesn't already have the highest market share, it will at some point. So if you make hacking kits for organizations that make botnets you're gonna crack Vista first.
Who is operating each machine? I need their email addresses. I want to send them some programs, and my "hack" is that the programs will come with instructions to the operator: please execute this attachment.
My understanding is that for Windows, I just need to have the filename end with .exe. For MacOS, I need it to end with .dmg. For Linux, I need to train the user how to use chmod.
"Believe me!" -- Donald Trump
If I were to enter such a contest I would target OSX first, then Linux and Finally vista.
... acrobat, flash...etc provide great cross platform opportunity for successful attacks. It might actually be worth ones time to try for a common expliot and win all three :)
:)
OSX is first because apple has been hideing behind security by obscurity for too long. I have seen no evidence that suggests OSX gets it any more than Microsoft did.
Linux next because source code is avaliable... and while clever hits without source are sometimes easier you just might get lucky walking the ususal paths and find something exploitable.
MS has been more or less awake from the security perspective for years now and most of the expliot efforts have been targeted at this platform which raises the bar for discovery of new expliots because all the trivial vectors have already been probed. Following the same line windows expliots are simply worth more than OSX or Linux expliots. Good ones can be worth a room full of PCs if you can find the right buyer.
Applications such as browsers, media players, and various popular plugins
Besides a PC is a PC... you can always reformat the drive and install Solaris if you want
Quicktime comes with Firefox these days .. I've lost count of the number of times I've seen Quicktime crash Firefox.. every time I think "I bet that is exploitable", but, ya know, I'm too lazy to bother looking.
How we know is more important than what we know.
...and you damn well know it. You guys are deliberately baiting the language nazis - there's no way you could *still* be ignorant of what this phrase means.
Ummm. OSX is just NeXTstep v5 (or 6 by now?), and NeXTstep is a flavor of BSD.
Please turn in your geek card on the way out.
http://en.wikipedia.org/wiki/Image:Unix_history.en.svg
You obviously don't know very many humans then. Of course you are posting on /. so I suppose that's to be expected.
Violence is like duct tape. If it doesn't solve the problem, you didn't use enough.
I think all each team should have to hack all 3 computers, and the first team to do so gets to pick, and then the seconed picks the next one and then the thrid gets the last one. So that equal energy goes into hacking each unit, and each team will learn something about a system they probably didn't know, and isn't that what this whole thing is about, learing something.
Sig? What's that? Oh, 'signature'...and it's supposed to be witty? Right...
Actually, Vista may be the last standing. I'm not saying it's the most secure, but it's the most unknown. And if you were a Black Hat who had developed a route into Vista, I'm sure there are more profitable ways of exploiting your ingenuity.
I think we've pushed this "anyone can grow up to be president" thing too far.
Correct and informative post. Unfortunately your sig blew away any credibility you might have had.
Perhaps you mean a different thing than I do when you say "science."
It might be more fun to see which OS annoys the user enough to launch the CPU across the room.
I don't know about you but when I'm annoyed I don't have the patience to remove the case, CPU cooler and finally the damn chip itself just to throw it around.
Justice is the sheep getting arrested while an impartial judge declares the vote void.
At first I read that as "So many idiots who will just sit there with a hammer". Definitely the easiest way to crack a system...
Justice is the sheep getting arrested while an impartial judge declares the vote void.
I can just see this happening.. MC: Okay...the competition is ready to start... We have three computers, Vista, XP and Mac....crack it and it's yours.. Are you ready? On your marks, get set, g.......OKAY OKAY! Not funny...We have now XP and MAC available...the competition will start on my mark....On your marks, get set...go!!
This text has been written completely with recycled bits and bytes.
Diamons aren't rare, only the stupid really believe this - why do you think diamonds are rare, because they are marketed to you as such. Diamonds are carefully controlled, so they a huge amount don't flood the market, but that doesn't make them rare.
Yes, I too have lost count of the number of times I have seen the Quicktime Firefox jump over the lazy dog