Slashdot Mirror
Last Year's CanSecWest Winner Repeats on Vista, Ubuntu Wins
DimitryGH followed up on the earlier news that the MacBook Air lost CanSecWest by noting that "Last year's winner of the CanSecWest hacking contest has won the Vista laptop in this year's competition. According to the sponsor TippingPoint's blog, Shane Macaulay used a new 0day exploit against Adobe Flash in order to secure his win. At the end of the day, the only laptop (of OS X, Vista, and Ubuntu) that remained unharmed was the one running Ubuntu. How's that for fueling religious platform wars?"
A 0-day exploit in Flash. What does Flash do? It paints to the screen. It has no need to communicate with other applications or write anywhere on the system except perhaps in a single configuration file. Why is this software not bullet proof? The thing is only a couple hundred kbytes small, for heaven's sake!
it was Adobes fault, not Microsoft! Let's all switch to Silverlight and we will be OK!!!!
10 ?"Hello World" life was simple then
I don't see how a script kiddy running 0day exploits on a box is in any way related to the total end point security, or security of the OS. Seems all he did was take inventory of the box -- realize flash was vulnerable and exploited it. Could've happened to any OS -- Ubuntu included -- that provides its end users with insecure software. Seems like trivial marketing fluff -- setup to spur stupid religious wars.
...that we christen the unharmed laptop 'Cowboy Neal'
WARNING: Smartphones have side effects--most of them undocumented.
It comes with $20,000, $10,000, or $5,000, depending on what day you hacked it. The guy who cracked the Mac got $10,000 and the Vista machine came with $5,000 since it was cracked later. And you can always install *nix.
For some time now OS of personal computers does not reside in ROM and can be changed to a different one with ease. The miracles of technology!
10 ?"Hello World" life was simple then
If the person on the Vista laptop was running IE 7 with the default configuration (protected mode / UAC on), this should not have happened.
Flash, like all other plugins, run within the security context of the low-rights user used by protected mode. Even if the flash plugin had an obvious buffer overflow or other exploit, it would only be able to access the data accessible by that low rights user, NOT the user running IE. That's the point of protected mode.
For a flash plugin to allow for a hacker to access personal files of the user it would not only have to have a buffer overflow (or some other exploit) in flash itself, but also take advantage of a privledge elevation exploit in Windows simultaneously.
I didn't see them specify in the article what browser than were using. Since they said it was an issue with flash, and not Windows, they couldn't have been using IE. My guess is that it was Firefox, since they said they loaded "popular" 3rd party apps.
Futhermore, the file in question must have been accessible to the user running Firefox (or whatever non-IE browser) since that would also require a privledge elevation in Windows.
So I'm not really sure how you can blame this on Vista or even Microsoft. If they had been using IE, it wouldn't have happened, regardless of the flaws in Flash. This says absolutely nothing about Vista security. The exact same thing would happen on every other OS. If you have an app with an exploit, and that app is running as User A, the hacker using that exploit has the same rights as User A.
I suppose one could argue that various defensive techniques like ASLR should have stopped this, but without knowing the details, that's impossible to say. A buffer overflow can just as easily be used to call APIs exposed by the exploited application as it can to call OS APIs, and since ASLR only applies to Windows APIs (indeed, many of these techniques only apply at the OS level), this wouldn't be a fair characterization either.
Indeed, I find it strange that they didn't mention mitigating factors. I realize they're trying to be responsible as far as reporting, but telling people that users running IE on Vista aren't affected isn't exactly giving anything away... aside from the fact that Vista did its job as best it could.
... but it certainly confirms my strong aversion to putting anything Adobe on my machines. Seriously, who hasn't noticed how invasive and hoggish Adobe's stuff is? I cringe when I click a link to a PDF in a website, causing Adobe reader to launch inside the browser. It brings any machine to its knees as it consumes every available resource while rendering a simple document. And Adobe Elements (that's their "lightweight" photo product) takes the better part of a minute to start up on my dual core, 2GB box (non-RAIDed SATA drive). I guess it shouldn't surprise me that they have security problems as well ... slow software is usually sloppy software, and sloppy software is usually insecure software.
The more you regulate a company, the worse its products become.
Are you comparing GNU/Linux to Kia? Kia?!? KIA?!? If I see you on the road I'll be slamming into you with my Ubuntu Yugo, so watch out!
The really fun thing about absolute statements is that one counter-example disproves them. I use Linux on desktop. See? You're wrong. :-)
Of course, so does my wife (who majored in fashion merchandising), and my 88 year old father, and the exchange student who stayed in my house last year, and roughly half of the thousand people at PyCon two weeks ago (just from snooping screens during the plenaries), and about 4% of the desktop users world-wide. True, that's small compared to Windows' 85% share and a bit below Mac's 8%, but it's certainly not "nobody".
And note that the market share leader Windows survived the Mac by a day (though, my friend the Mac-fan said that only proves the Mac was so much more desirable than the other two laptops - touché! :-)
Well, anyway, sorry to have fed the troll.
I realize this is slashdot, so for those who didn't read TFA the contest was to in a 30 minute attack slot, read the contents of a specific file, in a specific folder. each day different exploits could be tested, but only popular software that is normally installed counted.
day one were pure network attacks nobody got in on day one. day 2 was email and url based attacks. only the mac got won on day 2. on day 3 you could add non default but popular software from a list (couldn't find the list anywhere on the net, sigh) and adobe flash was vulnerable, so the vista machine got taken.
Ubuntu held up for all 3 days, but because only popular and default software could be added, this could bring a false sense of security. there are many ways to 'design' a supposedly open source software package on say, sourceforge.net but to have a compromised binary that was made with slightly altered source code... to get a trojan on a linux system. repositories tend to be fairly well monitored, but there have been times where applications that are trojans have gotten into widely used repositories. as far as i can tell, sourceforge has no real method for testing if software contains trojans or not, so it's purely up to the community that uses sourceforge to report bad software, etc. i imagine that freshmeat is the same, and many many linux users use sourceforge or freshmeat to find specific linux applications they need or want...
maybe there aren't enough linux users yet to make this a huge issue, but with Microsoft's brand image going south (kinda the way IBMs did in the 90s) linux is sure to be finding more and more people who would rather deal with OSS than with bill gates.
https://www.gnu.org/philosophy/free-sw.html
A couple things to note of interest:
1. The contest did not require someone to 'own' the box to win. They just had to read the contents of some specific file somewhere in the OS. Unfortunately, they didnt publish where that file was, or what the file-system ACLs on it were.
2. The guy who took down the Vista box claimed in the article that it would only take them a few more hours of work to make the Flash vuln effective on OSX and Linux as well.