Slashdot Mirror
Last Year's CanSecWest Winner Repeats on Vista, Ubuntu Wins
DimitryGH followed up on the earlier news that the MacBook Air lost CanSecWest by noting that "Last year's winner of the CanSecWest hacking contest has won the Vista laptop in this year's competition. According to the sponsor TippingPoint's blog, Shane Macaulay used a new 0day exploit against Adobe Flash in order to secure his win. At the end of the day, the only laptop (of OS X, Vista, and Ubuntu) that remained unharmed was the one running Ubuntu. How's that for fueling religious platform wars?"
Shane Macaulay used a new 0day exploit against Adobe Flash in order to secure his win. At the end of the day, the only laptop (of OS X, Vista, and Ubuntu) that remained unharmed was the one running Ubuntu. How's that for fueling religious platform wars?"
It depends what kind of exploit that was.
A 0-day exploit in Flash. What does Flash do? It paints to the screen. It has no need to communicate with other applications or write anywhere on the system except perhaps in a single configuration file. Why is this software not bullet proof? The thing is only a couple hundred kbytes small, for heaven's sake!
it was Adobes fault, not Microsoft! Let's all switch to Silverlight and we will be OK!!!!
10 ?"Hello World" life was simple then
I don't see how a script kiddy running 0day exploits on a box is in any way related to the total end point security, or security of the OS. Seems all he did was take inventory of the box -- realize flash was vulnerable and exploited it. Could've happened to any OS -- Ubuntu included -- that provides its end users with insecure software. Seems like trivial marketing fluff -- setup to spur stupid religious wars.
Zeus sucks cock???? To quote Burgess Meridith...."BY THE GODS!!!"
Yeah, my karma sucks....but so do the mods.
So Linux is more secure than Windows? What else is new?
The creator of this post (Jacob Smith) hereby releases it, and all of his other posts, into the public domain.
that GNU/Linux is actually more than a competitor to MS in the niche hacker/power user arena. It is in fact quite usable and *CAN* replace Windows. (Car analogy) It's like seeing Kia in a road rally, sort of surprizing but after a couple of years competing people begin to just accept that they have the balls to keep it up and to compete.
Or perhaps it's more like a dedicated sports fan seeing his team make the playoffs after 40 years of ridicule ?
Support NYCountryLawyer RIAA vs People
...that we christen the unharmed laptop 'Cowboy Neal'
WARNING: Smartphones have side effects--most of them undocumented.
It comes with $20,000, $10,000, or $5,000, depending on what day you hacked it. The guy who cracked the Mac got $10,000 and the Vista machine came with $5,000 since it was cracked later. And you can always install *nix.
For some time now OS of personal computers does not reside in ROM and can be changed to a different one with ease. The miracles of technology!
The laptop isn't insecure, the attacks are taking place against the operating system (and in all three cases, against specific applications - none of the three were hackable without the user taking certain actions).
10 ?"Hello World" life was simple then
When you get it, you secure it. Sheesh, you should know that already. What is with your silly question? You do not want it, give it to me and I will secure it.
...so you can put Ubuntu on it?
They're all x86 laptops, so you can just install Ubuntu on whichever one you win.
Please send all your insecure belongings to me. It might be hard to move the house but if it's nice you can just send me the keys and the adress and I might move in. I'll take good care of your insecure car(s), bicycle(s) and computer(s).
You forgot the part where you link to a laptop that's secure. I'll be waiting right here.
If the person on the Vista laptop was running IE 7 with the default configuration (protected mode / UAC on), this should not have happened.
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
For a flash plugin to allow for a hacker to access personal files of the user it would not only have to have a buffer overflow (or some other exploit) in flash itself, but also take advantage of a privledge elevation exploit in Windows simultaneously.
I didn't see them specify in the article what browser than were using. Since they said it was an issue with flash, and not Windows, they couldn't have been using IE. My guess is that it was Firefox, since they said they loaded "popular" 3rd party apps.
Futhermore, the file in question must have been accessible to the user running Firefox (or whatever non-IE browser) since that would also require a privledge elevation in Windows.
So I'm not really sure how you can blame this on Vista or even Microsoft. If they had been using IE, it wouldn't have happened, regardless of the flaws in Flash. This says absolutely nothing about Vista security. The exact same thing would happen on every other OS. If you have an app with an exploit, and that app is running as User A, the hacker using that exploit has the same rights as User A.
I suppose one could argue that various defensive techniques like ASLR should have stopped this, but without knowing the details, that's impossible to say. A buffer overflow can just as easily be used to call APIs exposed by the exploited application as it can to call OS APIs, and since ASLR only applies to Windows APIs (indeed, many of these techniques only apply at the OS level), this wouldn't be a fair characterization either.
Indeed, I find it strange that they didn't mention mitigating factors. I realize they're trying to be responsible as far as reporting, but telling people that users running IE on Vista aren't affected isn't exactly giving anything away... aside from the fact that Vista did its job as best it could.
It's interesting that the 2 vulnerable attack vectors are from the 2 companies that have the largest Mac user-base. Apple (Safari) and Adobe (Flash).
Is there anything Ubuntu-specific about the results or can this be extrapolated to other distris?
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
Isn't it amazing that they couldn't exploit a Vista box with stock software, but they could do the Mac? It required them to install 3rd party software (Although extremely common 3rd party software, to be fair). Security through obscurity is dead.
... but it certainly confirms my strong aversion to putting anything Adobe on my machines. Seriously, who hasn't noticed how invasive and hoggish Adobe's stuff is? I cringe when I click a link to a PDF in a website, causing Adobe reader to launch inside the browser. It brings any machine to its knees as it consumes every available resource while rendering a simple document. And Adobe Elements (that's their "lightweight" photo product) takes the better part of a minute to start up on my dual core, 2GB box (non-RAIDed SATA drive). I guess it shouldn't surprise me that they have security problems as well ... slow software is usually sloppy software, and sloppy software is usually insecure software.
The more you regulate a company, the worse its products become.
So it was a Flash exploit.... which would mean that each of the machines would be vulnerable?
I don't know the details about the sploit so I don't know if it's OS specific even though it is Flash.
Order in which they were taken home:
First (ie. Most Desirable): MacBook
Second (ie. Somewhat Desirable): Vista
Unclaimed (ie. I'd rather not): Ubuntu
No-one? I hope you realise that you've just caused me an existential crisis!
What I wouldn't do for the ability to mod "-1, Plain Wrong"
The really fun thing about absolute statements is that one counter-example disproves them. I use Linux on desktop. See? You're wrong. :-)
Of course, so does my wife (who majored in fashion merchandising), and my 88 year old father, and the exchange student who stayed in my house last year, and roughly half of the thousand people at PyCon two weeks ago (just from snooping screens during the plenaries), and about 4% of the desktop users world-wide. True, that's small compared to Windows' 85% share and a bit below Mac's 8%, but it's certainly not "nobody".
And note that the market share leader Windows survived the Mac by a day (though, my friend the Mac-fan said that only proves the Mac was so much more desirable than the other two laptops - touché! :-)
Well, anyway, sorry to have fed the troll.
Because then you could put an OS on it that was secure!
Doesn't state you have to keep the OS that came with it.
Hey good for you, some of us work in industries where adobe products are the standard and running anything else will result in lost business.
- Toby
. And Adobe Elements (that's their "lightweight" photo product) takes the better part of a minute to start up on my dual core, 2GB box (non-RAIDed SATA drive). I guess it shouldn't surprise me that they have security problems as well .
Given that it takes about 10 seconds to launch Adobe Photoshop CS3 (that's their heavyweight" photo product) on my dual-core laptop with "non-RAIDed SATA" laptop drive), and PDFs don't bring my system to its knees...
...I'd say there's something wrong with your laptop (or the configurations/state of its operating system.)
Please help metamoderate.
I will hasten to point out the same holds true for Windows. Of course that doesn't necessarily mean it's great stuff -- just that it's managed to become a defacto standard.
The more you regulate a company, the worse its products become.
That's what so brilliant about linux. Evince ftw.
Really? So this must be some magical post I'm making ...
I agree, which is why I don't "do" Windows.
I use linux at home, and linux + bsd at work.
My sister switched to an iMac, and "once you go mac, you never go back."
People routinely remote into another linux box at work when they want to get "real" work done in a more powerful graphical environment like kde, or need to do stuff that Windows just can't do without a lot of work ...
Even web developers no longer need to keep a Windows box handy "for compatability testing" - IE 7 runs fine under linux.
"How's that for fueling religious platform wars?"
Wow. I guess the story posters here really *do* like all of the "X OS is sooooo better than Y OS" comment threads. =p Flame on, SD community. Flame on.
It is pitch black. You are likely to be eaten by a grue.
No-one uses Linux, and No-one is perfect. So we should try to follow in No-one's footsteps.
I haven't found the 3rd-party list yet, but was Flash also installed on the Ubuntu laptop?
Dewey, what part of this looks like authorities should be involved?
What if Tetris was invented by Nazis?
I gave up using Adobe Reader a while back, after finding Foxit Reader, which despite a few small annoyances, is about a million times faster at startup and rendering. It has no browser plugin, but in this day and age I see that as a good thing (you *do* remember the Acrobat javascript vulnerability from last year, don't you? :)
xpdf? Hey, at least it's easy on the PC!
At the same time, I've not seen it go beyond about 150MB of memory, and more commonly manages a third of that. Startup time was rubbish a couple of years ago when it'd sit there loading about 20 different plugins for no particular reason, but that's not been a problem for a while now.
This is a troll because it's true? The winner took home the lappy they cracked. I'm guessing it went in order of resale and/or pure value. Sometimes "Desirability" and "value" are the same. If it's a troll from the "I'd rather not", fine, but I still don't think that negates the overall value of the comment.
Then why do you use it? For PDF reading theres Sumatra or Foxit. There are many photo editing suites. If you just use Elements then the Gimp should be plenty. And Flash is useless. So for your purposes, why bother with Adobe software at all?
Give me Classic Slashdot or give me death!
Most of the stuff on
I've been a little suspicious of this contest simply because of the different hardware prizes. It is possible that a hacker's motivation for the contest is driven by the nice hardware of the machine, and *not* the OS running on it. In other words, of course they're going to try to hack the nicest machines, and every system has holes (regardless of record), so it isn't necessarily news that "nicest machine was hacked first".
Not that it's easy to level this particular playing field, but you could argue that at least the Vista and Ubuntu machines can run on exactly the same type of laptop. Maybe even "3 MacBooks running VMware" would still be considered fair for testing the built-in strengths of all 3 operating systems. The idea is to take away the hardware incentive, so the results are more interesting.
"Microsoft killed my company, I hold a personal grudge. I don't use Microsoft products and neither should you."-JWZ
You harbor the same good tastes, Sir, and cheers to you too, aswell as to the original poster.
A horse can't be sick, you know, even if he wants to.
It's not useless. It just shows that things are improving at the OS level. I'm not surprised by this.. XP SP2 was a pretty substantial step in this direction, and OS X has made substantial strides as well (not that anybody's noticing). Seems like Vista did in fact improve in this area as well. So yes, if you're talking about the kernel and the stock OS, it's getting harder to compare security, because they are all much more secure than they ever were before.
So the game has changed. The contest rules here have also changed, to reflect the new game. They built in the day-3 rule changes so that more exploits would be possible, to keep the contest interesting, knowing in advance that hacking the stock OS would be pretty hard.
It's not just the stock OS security that matters, it's the security of the entire stack, and the software ecosystem it lives in. Give Microsoft and Apple credit for improving their cores, but you can still say Ubuntu has a better stack and ecosystem, and point to the same reasons why: open source, community testing, heterogeneity.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
and it's not only people using linux at home, we use it in our company too. some people were not very enthusiastic with the move, but everything works better now and maintenance costs are A LOT lower. no wonder that governments and large enterprises around the world are switching to linux
Ho-hum....
"no one uses Linux on the desktop"
BZZZT! Wrong. I have proof that at least one person uses Linux on the desktop. Unless maybe I am a figment of your fertile imagination.
Same 2 guys win by cracking the same platforms they won on last year.
I'd wager they each have a handy arsenal of "zero day" exploits ready for next year's competition already.
Good call. I remember Google trying to do some VLC-based thing to portably embed videos, but eventually giving up and going with Flash for Google Video. Then they realized they were just playing catch-up with YouTube and did the logical thing.
Which makes it even more disappointing that Ogg Theora didn't make it into the HTML5 spec. There still isn't a good, portable way to do video in a browser without relying on plugins.
But No-one trespassed into my house and broke my mom's favorite vase! Surely you don't want us all to break into houses and break stuff!
Computers allow humans to make mistakes at the fastest speeds known, with the possible exception of tequila and handguns
It took me the better part of an hour to read through all that, and I was only reading because you mentioned beer at the beginning. Who cares!! Where's my Heineken!!!! This kind of discussion always goes better with beer. At least you can throw your bottle on the ground and have it break to make your point seem to matter. Apple. Crash Different!
jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
Hey man,
.NET is GREAT!
I suggest you download FoxIt Reader (PDF), and set that as your default program for PDFs. Super fast loading.
Alternately, you can also run Adobe Acrobat 5 (OldApps.com)
I have yet to encounter a PDF I couldn't open with Acrobat 5.
[funny, that after installing Acrobat 5, Adobe actually says "Thanks!"
These days, the SOBs just get pissed off at you for not installing the latest Roomba USB WoodChuck Monitoring System Tray Icon. Assholes]
As to Elements, I am about 3% into graphics (not my thing), but for that, Paint
I know, I know... its from M$. Still, great program.
Watch this Heartland Institute video
I bet it was No-one's sibling Not-me or He-did-it that broke the vase and framed No-one.
I know, I know... its from M$. Still, great program. It's not from microsoft, it's an open-source program that's supposed to recreate (and greatly improve) paint.
For some time now OS of personal computers does not reside in ROM and can be changed to a different one with ease.
But that's what makes them so insecure... I think that the best way to secure your machine is to put the OS, and your documents on some kind of... plug-in cartridge, if you will.
What?
Why would you want a laptop that you know is insecure?
You can put your weed in there
What?
I know, I know... its from M$. No it's not. It's from Rick Brewster, of dotPDN, LLC.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Well not really, but in most bars if you order a pint of Guinness or any other beer you actually end up with a 12oz glass. It's nice to actually run across a bar that serves actual pints. I've had friends argue that I'm wrong about them being poured a 12oz beer from the tap until I tell them to order a bottle of beer and pour it in the glass. Another trick bars like to do is pour shots into a big shot glass. People are impressed until they realize that the bottom and sides of the shot glass are so thick that they are getting a shorter pour than a 'real' shot glass. As for me, I'll take a bottle of La Fin du Monde if I can't get a pint of Guinness.
"The details emerging from the CanSecWest security contest fill out a story that is bigger than the simple "Mac Shot First" headlines convey. This was not a contest where three systems were placed in an equal foot race and the Mac simply lost due to being a slower runner.
"The CanSecWest contest featured a number of security researchers, each with different backgrounds, motivations, and levels of expertise working to exploit flaws in the three systems running Mac OS X, Windows Vista, and Ubuntu Linux. However, rather than being a level contest to expose the flaws in the three systems, it was really a contest highlighting the knowledge and abilities of the researchers, each of whom targeted the platform of their choice."
10 Things to Remember About CanSecWest and Software Vulnerabilities
Macaulay was the guy who took home the Vista laptop.
So, he confirms that it was not a specific Vista vuln, but a generic Flash vuln. To bypass the extra security of IE7 on Vista (protected mode) the vuln have to be in the broker process (a.k.a. the flash "helper" process).
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
I note that Windows and Mac can run firefox too. The ONLY reason that ubuntu won is because it can't run Safari, or IE.
My kid's pretend Leap-frog computer also can't run a browser or even connect to the internet. Clearly it is much safer than ubuntu.
Some drink at the fountain of knowledge. Others just gargle.
And note that the market share leader Windows survived the Mac by a day (though, my friend the Mac-fan said that only proves the Mac was so much more desirable than the other two laptops - touché! :-)
;-)
Clearly, then, next year they should eliminate that factor by running the three different OSs on the same hardware. I believe the only platform they could legally use would be Macs.
To a Lisp hacker, XML is S-expressions in drag.
Yeah the Mac is the most desirable and should therefore get the most attention. That said it probably does not surprise anyone that it was accessed through a Safari vulnerability, Safari just isn't good enough.
It's good to see that Vista isn't all bad (just like seeing the statistic that Nvidia drivers caused 28% of all Vista crashes).
Personally I prefer the other two OSs anyway (and don't use Safari). MacOS is nice and Ubuntu is reliable, if a little rough around the edges.
Recently after my mother had her umpteenth problem with windows I offered her another solution.
I didn't tell her it was an alternative OS, didn't include any technical jargon at all. I just said im going to try something different this time.
First comment i got was "it's different", but then I heard a satisfying "but quite usable".
She has not had a single problem since.
the linux community welcomes one of its older users : )
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
It was a Macbook Air, so no, it didn't.
As a user of MSVS2005 I have to run as admin on my Vistax64 workstation (and yes, my programs have to have admin rights too).
/trustlevel:0x#### "C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
/showtrustlevels to find out your lowest level, in my case it's "Basic User").
I prefer FireFox to IE7 (mostly because of on-screen search).
Sure, I don't like to run FF in admin mode, so I have changed all my links to firefox to
runas.exe
On my PC "Basic User" trustlevel is the lowest level (use runas
In this mode on my PC FF can not write anything outside of my home folder or chowned folders, e.g. it can't write to root (I can, as Admin).
I believe IE7's privilege is still lower then the above method.
But hey, every little helps!
My subject line says it all, but I'll repeat it again: yet another reason not to run flash. This is why on my 64-bit Kubuntu machine I don't have flash installed on anything other than a 32-bit version of Firefox which I only load when there's sites I absolutely have to use Flash for (like some manufacturer websites such as Linksys). Otherwise I browse with 64-bit, flashless Konqueror.
I remember sigs. Oh, a simpler time!
He was trying both the Ubuntu system and the Vista system at the same time. The Ubuntu system stood. Could be because flash runs in less privileged space on Ubuntu than on Vista.
1) MacBook air was the most insecure and therefore got broken the quickest
:)
2) Everyone wanted the laptop running Vista Ultimate and therefore was a bigger target and everyone tried hard to get in
3) No one was interested in having an Unbuntu based laptop
LOL
Uh-oh, you've linked to roughly drafted - the least credible & most poorly thought through blog around.
I can't be bothered refuting each of the ten points in the article, I'll just do the first:
1. Exploits discovered for the Mac have little other value outside of contests like CanSecWest.
This is complete horse-crap. Zero day exploits for mac have a good deal of value - there may not be many mac users, but a zombied mac is typically far more useful than a zombied windows install due to the unix-like nature of the O/S.
Please don't link to roughly drafted in future. That blog is an embarrassment.
There are shills on slashdot. Apparently, I'm one of them.
Foxit reader, bloody fast PDF reader on windows, great for internet usage since it starts up so fast.
Wrong. It is the other way around. Flash runs in a less privileged space on Vista. Please check your facts instead of just assuming. On Vista, IE and all plugins (ActiveX) runs as a low privileged user account which do not have access to write anywhere except for a secluded cache. On Ubuntu FF and all of its plugins runs under the user account which launched Firefox; which means *you*. If anything, Ubuntu is *less* secure in this regard. If you read the article I linked to at The Register you will note that the winner said that he would have been able to pull this off on any of the operating systems. Ubuntu (nor OS/X) is in no way immune to this attack. Now, how did he pull it off? Because Adobe/Macromedia in their wisdom decided they needed escalated privileges (I really don't know for what reason) for some tasks. Because the plugin cannot break out by itself they designed a "broker process" which runs as the currently logged on user. This process talks to the browser plugin and performs privileged tasks on behalf of the plugin. The vuln this guy found was in this broker process. Adobe is the culprit here. Flash is a POS, securitywise. Check secunia, virtually *all* of the vulns have been "critical" and virtually *all* of them has been multi platform.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
which runs at elevated levels or something.
...
macromedia (now adobe) not willing to play by the rules.
Whether the rules are appropriate or not is another discussion
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Ouch. My head hurts.
But, possibly so, depending on what else runs as nobody on your system.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I think there was something in the rules about not using known exploits.
Which sort of bugs me, because it means they basically found the exploit some time ago and sat on it.
Also, I'd like to see the first day repeated with known exploits allowed.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
:-/
--
they want me to say something
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
heh.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
har.
And you get mod points for this.
I assume you've read about the helper app at this point?
Walled gardens, indeed. Like I said yesterday, they are a "good" place for date rape, if you are into that kind of thing. And for being spied on by your date's little brother or the butler or random passersby.
(No, Linux is only a little more effective in the present iteration, not significantly.)
I have to say, though, I'm wondering if it was the helper app, because that ought to have been considered a known vulnerability.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
What are you saying?
You want to depend on somehow magically detecting admin operations?
Are you saying that my Fedora box doesn't prompt me for the root password when I try to start up the logical volume manager as a non-root user? Or the Mac doesn't prompt me for an admin username/password when I try to update the OS or write to a directory I don't have permissions for (even if I'm running as an admin user)?
(Well, I'd sure like the Fedora box to prompt me for an admin password instead of root. Maybe in FC 9.)
Am I misunderstanding you?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
What version of IE runs on NT3?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Anyone know why CIO is reporting that Java was the cause of the problem, not Flash http://www.cio.com/article/324313/With_Vista_Breached_Linux_Unbeaten_in_Hacking_Contest?
http://www.mhall119.com
Its common knowledge that Linux is more secure than most other operating systems. If you are a normal user on Windows, you have no rights. Its pointless. But on Linux, you can be a normal user and still do a lot of stuff.
First, it is tough to check the Vista facts as; 1) I don't have a copy, and 2) Microsoft doesn't document the inner workings of security.
If you read the article I linked to at The Register you will note that the winner said that he would have been able to pull this off on any of the operating systems.
I did read it. And I have a 12 inch cock. I said it, so it must be true. I am not saying Ubuntu is the be-all end-all of security. Just that it stood while Vista fell.
If you are running Windows get Foxit Reader. It's as fast as Notepad. If you are on Linux, xpdf it very fast too.