Slashdot Mirror
Safari/MacBook First To Fall At Pwn2Own 2011
recoiledsnake writes "A team of security researchers from the French pen-testing firm VUPEN successfully exploited a zero-day flaw in Apple's Safari browser to win this year's Pwn2Own hacker challenge. The hijacked machine was running a fully patched version of Mac OS X (64-bit). Bekrar's winning exploit did not even crash the browser after exploitation. Within five seconds of surfing to the rigged site, he successfully launched the calculator app and wrote a file on the disk without crashing the browser. Apple has just released Safari 5.0.4 and iOS 4.3 a few minutes before the Pwn2Own contest in an attempt to save face (a last minute patch for Chrome was also released) but failed."
It's called "Pwn2Own": the hackers win the machines they hack.
Everyone wants Macs. They hack them first. The other computers come down minutes later.
...First
Pwn2own is clearly bias, because the security researchers are obviously going to try harder to pwn the machine they want to own.
(Not the mac)
it will also be the first patched...
Why was Chrome allowed to be updated but other browsers not? What did Google do to deserve such special treatment?
How does one pronounce 'pwn' in French?
Firefox and Linux are under represented in pwn2own as usual.
I'm not complacent, just saying it's nice.
I'm a Mac user and fortunately not a mindless one (honest, promise!). That Apple has been extremely lucky in not being overrun in exploited machines has more to do with the normal target area for exploiters being windows due to marketshare, but Macs have a big enough marketshare these days to make it worthwhile for crackers. I'm pretty sure that the time will come when Macs will be running dubious AV products like most Windows people do.
No one knows. Up until now the French have never had reason to use the word. You can't pwn someone and surrender at the same time.
From TFA:
He said the creation of a reliable exploit was “much more difficult” than finding the vulnerability.
“There are many WebKit vulnerabilities. You can run a fuzzer and get lots of good results. But it’s much more difficult to exploit it on x64 and to make your exploit very reliable,” he said.
If the vulnerabilities are so easy to find, why doesn't Apple just use a fuzzer itself and fix the vulnerabilities?
The groundwork they did will be most sought-after.
insecurity asks the wrong question irritation gives the wrong answer
Well you get to keep the computer that you hack and no offence but I'd rather get a MBA rather than a cheapo windows/linux machine. Plus they did say that the exploit was not at all easy to develop. Oh and did you notice the new Safari update released yesterday ...
We've had a few Macs (Macs that were administered by the person, not by IT) at work owned. In one case it was pure user stupidity, a world writable FTP. They couldn't see what was wrong though because "Macs can't get hacked!" In another case it was a virus that seemed to use the speech synthesizer to read ads. Was really funny.
It is rare, compared to Windows, but growing. The real problem is, as I mentioned, the "But Macs are safe!" people. They really do think that running a Mac absolves them from any security responsibility. I think there are going to be some nasty awakenings and users will have to accept that no matter what you do, you need to have good security practices. A virus scanner is a good idea as well, since it can help catch things if you slip up (and we all slip up).
I am not surprised at all that the Mac/Safari would collapse. Apple has boasted for years that it was more secure than PCs since they never get malware...or viruses, oh wait, never mind.
Given the financial incentives involved here (for example, the guy who gave up an almost certain $15,000 because he reported a bug to Google rather than keep it under wraps until he could clean up at Pwn2Own, how many bugs on all of the major platforms are kept "secret" to be used in contests like this?
I understand the nature of the event is to demonstrate the issues of security and code vulnerability, but sitting on exploits is surely counterproductive here?
http://en.wikipedia.org/wiki/Pwn2own
Am I the only one who thinks that it's strange for a firm that tests pens to hire security experts and participate in this competition?
It is the universe that makes fun of us all.
The most interesting and disappointing thing about Pwn2Own for me was that all the recent development of sand-boxing in browsers suggested that they were going to herald in a new era of browser security.
In actual fact it turns out that, thanks sloppy implementations, they aren't very good at their job.
Avantslash - View Slashdot cleanly on your mobile phone.
Well that headline is misleading at best I'd say. I suggest reading pwn2own day one: Safari, IE8 fall, Chrome unchallenged in which it states that both Safari and IE fell at the first attempt, clearly it was a matter of nothing more than the ordering. Apologies for disturbing all the anti-apple ranting but both systems are weak.
Please feel free to resume posting uninformed comments now.
Sitting on some damaging knowledge until you are paid to reveal it is plain extortion. Why there isn't law which allows the "winner" of these sorts of contest to be immediately arrested is beyond me. Fortunately, the way our government is going, it'll only be a matter of time until such people are dealt with.
There is no other way of putting it. When you get served, you get served. and apple, has got served. much better for apple and its fans to take lessons from it, accepting the result, to better their stuff, than to try to spin and defend it.
Read radical news here
If the flaw is in Webkit, wouldn't that mean that any browser, including a webkit-backed Epiphany on Linux, would also easily fall?
I feel a disturbance in the Force, as if a million Apple users suddenly cried out in terror, and were pwn3d.
Seven puppies were harmed during the making of this post.
Every year headlines claim platforms "pwned" in seconds but it's misleading and sensationalist.
The exploits are researched and practiced over days or weeks, rehearsed and simply repeated on the day. Yes it's bad, yes it demonstrates insecurity but the headlines imply that some guy just sits down at a fresh machine, sight unseen, decides to have a go at hacking it and within seconds it's done.
Of course the exploits take seconds to run - they are running them on computers - they are fast.
I'm sure they get faster every year.
Sadly it's Slashdot summary have a tendency to be sensationalist, misleading and sometimes even wrong. For comparison, consider Ars Technica's headline: "pwn2own day one: Safari, IE8 fall, Chrome unchallenged" — it's neutral and contains more information.
So what I take it that the exploit is in WebKit (along with many others). They did mention it was quite hard to build the root kit for x64.
So does this mean it is a cross platform exploit?
Any word on when apple will patch it?
It says the Macs were the first to fall. This is because they were the first part of the competition. It appears to imply that all OS were being hacked at the same time.
According to this link: Why Pwn2Own doesn't target linux (linked in another post), Pwn2Own only targets systems running MS Windows 7. If that is the case then this must have been Safari running on Win7, not OS/X.
I accept that OS/X likely has security holes - the same hole that permitted this exploit might work in the OS/X version of Safari as well after all - but I don't want to read endless MS Fanboi posts about how pathetic OS/X is, if the exploited system was running MS Windows 7
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
According to this more article, the version used by all browsers had been frozen from several weeks back so neither Safari nor IE were the latest.
TippingPoint's Peter Vreugdenhil said the browsers were "frozen" two weeks before today's tip-off with the then-current versions of Safari, Google's Chrome 9, Microsoft's IE8 and Mozilla's Firefox 3.6, to give researchers a stationary target.
While Apple did release a patch just minutes before the contest, it was not used and the release may not be related to the contest. The patch fixed some vulnerabilities but not the one that appeared to have been used. Also IE fell to the first attack. I'm not clear on the details of the contest but it appear that it is turn based.
Vupen, which was waiting in the wings in case Fewer failed, did not get a chance to try its luck against IE8.
It appears that Safari was selected or picked first to be tried.
Well, there's spam egg sausage and spam, that's not got much spam in it.
1) If you are a security researcher, do you want to win/pwn the MacBook Air or some random brand Winders notebook? To me, the Mac is the bigger/more fun target in an event like this.
2) From TFA: *He said the creation of a reliable exploit was “much more difficult” than finding the vulnerability.'*
Yes, Macs are not safe, but the crack was also not trivial. Something tells me they didn't come up with it on the spot.
3) From TFA: *Bekrar said VUPEN plans to hit Internet Explorer 8 on 64-bit Windows 7 (SP1) later in the contest.*
Well, we can see where they focused first.
4) 'Mac goes down first' is a much cooler headline than 'Sec. team puts all their effort into cracking Mac first, Will try Windows next'
Que Deus te de em dobro o que me desejas
[May God give you double that which you wish for me]
The exploited system wasn't running Windows 7, it was running Snow Leopard. See the official blog for more info: http://dvlabs.tippingpoint.com/blog/2011/02/02/pwn2own-2011
Pretty good is actually pretty bad.
This is only news because of all the "Macs are safer" bullshit we are continually bombarded with, especially by Apple. Now Apple sycophants are whining because they are getting a dose of what Windows people hear all the time.
With the importance of data bases to the computer industry I fail to understand why nothing other than web browsers and the desktop were the target. Seems to me a more important vector for the core troubles on the net is how most large data transactions really take place. If I were a crook and was into hacking this is where the real cash could be made. Holding a banking transaction data base hostage and putting the squeeze on internet money flow would seem to be the real goal of organised crime hackers.
Therefore you need much more than just getting access to Joe Users desktop to become a successful Black Hat. After you steal the user info then you need a way to trick the data base that Joe User must access to do transactions. What the bad guys have to do is a two step hack not just a simple browser exploit! You can bet that there are some really bad dudes already operating at this level...chances are that the commercial crime going on today is already way ahead of these guys. Seeing that some cyber crime can almost be considered a state sponsored enterprise in Eastern Europe and elsewhere.
I see conflicting reports. The linked article says they exploited the fully patched Safari, while the Arstechnica article from a week ago quotes Charlie Miller as saying:
Still, Miller thinks that a change in the rules from past Pwn2Own contests will keep any last-minute patch from spoiling his chances for another victory. "Back in the old days when I won, you had to hit the latest and greatest, even if the patch came out that day," he told Ars. "For the first time, as long as the vulnerability is still present on the day of the competition, the actual device being exploited was locked in a week or so ago."
Was anyone at the conference or involved and actually know whether or not the Safari and Chrome patches were applied to the machines or if they were, indeed, running software as it was two weeks ago?
Here are Charlie Miller and Dino Dai Zovi's responses to the very question of which is more secure, Windows 7 or Mac OS X. These are Apple security researchers. It is the second question in the interview:
http://www.h-online.com/security/features/Hackers-versus-Apple-1202598.html
The summary: Mac is only safer from browser attacks than Windows because there is less malware written for it. That is, security through obscurity. But Mac is less safe from targeted attacks.
I am always surprised to hear people claim that somehow Mac is magically more secure. It does nothing but reveal their ignorance.
1. Are you disgusted by what you see as undaunted loyalty to a brand, or because you feel he is misrepresenting the facts?
2. Either way, I agree the frustration inherent in these kinds of debates. I find that these contests are a bit like the weird pulling locomotives 20 years with your teeth. It is a big event with all sorts of interest, but it doesn't have the decisive conclusion of a real sporting event.
Personally, my favourites are jousting and duellling, as there is little interpretation to make of the outcome.
3. Maybe there is a way in which these sorts of contests can be made a bit more rigorous, at least in the interpretation of results. The way it is currently is a bit like a bowling tournament or an awards show where everybody gets a prize for something and everybody feels a bit humiliated.
It might involve raising the stakes [ ie. each vendor has to submit a VP who will be sacrificed if their product loses ]; or a pre-established agreement on the interpretation of the outcome.
Hey, maybe there is something to this:
http://tech.slashdot.org/story/11/03/06/2142233/Disarm-Internet-Trolls-Gently
Low, low editorial values and sensational headlines to get page impressions. It should be no surprise that this headline was accepted and not fixed by the so-called editors.
Connected to vax.recon.cx. Escape character is '^]'. SSH-1.5-1.2.30 - Anyone have x2 offsets for vax?
Apple's platform fell within 5 seconds. Period. Deal with it.
This does not surprise me as Safari is the poorest of all the browsers. There are a few "nice" features, but overall the experience is lacking. I think Safari is largely crippled to support iOS implementations, but overall I just cannot use Safari as many websites that I frequent just do not work properly on Safari. I typically uninstall and ignore all Safari updates. I would rather use a beta of IE 9 then Safari, and that says a lot (although I will use Chrome any chance I have).
While this might be a damaging claim, I doubt this will have any impact on the typical Mac user.
Peter Bright just retells what others wrote already and he attempts to put his own "spin" on it, which isn't worth much considering he's a dropout from his collegiate comp. science degree attempts.
I reported a local privilege escalation exploit in the Darwin x86-32/64 kernel about eight months ago and they still haven't released a patch yet. What's stupid is that fixing it is an obvious single line to change in the code.
Even if they used the sandboxing API, I'm sure it wouldn't be too hard to find a bug like mine to get root access.
As an aside, if this exploit weren't specific to x86, I would've given the exploit to the iPhone jailbreak hackers instead of Apple.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
See subject-line above, & can ANYONE tell us all reading here WHY Opera's not represented this year @ all?
"Firefox and Linux are under represented in pwn2own as usual." - by sakdoctor (1087155) on Thursday March 10, @05:41AM (#35441026) Homepage
Per YOUR VERY POINT? I don't even SEE Opera being targetted @ this year's "pwn2own" contest @ all/whatsoever!
(Thanks-In-Advance!)
APK
P.S.=> I just found it rather "odd" is all... &, is it because of the folks @ Opera not being willing to be in this "hack/crack" contest of webbrowsers... or, was it the "pwn2own" folks being unable to find any holes in Opera 11.x @ all?? apk
The poster just above you seems to disagree with you.
The chatter is great, but no one seems to be answering the question of whether or not the exploit would work on the now current version of Safari - 5.04? I don't really care if it was released a few minutes before the contest. Does it prevent the exploit?
Whats this. An exploit found in precious unhackable apple products? Like i have always said, the only reason there arent widespread malware,exploits on macs are simply because no one wanted to make them. When someone WANTS to find exploits in anything they will.
Yes. I'm sure dissing pose2own was foremost in Apple's thinking when planning its release schedule.
ITS ALREADY PWNED:
"Why Pwn2Own doesn't target Linux" - by Anonymous Coward on Thursday March 10, @05:46AM (#35441054)
Yes, Penguins: Linux is ALREADY "pwn'd" is why, so THE HACKER/CRACKER TYPES OUT THERE DON'T HAVE TO!
See here:
---
Router-rooting malware pwns Linux-based network devices - Bad for your ELF:
http://www.theregister.co.uk/2011/03/10/router_rooting_malware/
---
LOL!
APK
P.S.=> "HOT OFF THE PRESSES" today, 03/10/2011... apk
I concur with this statement, Safari is just as bad as IE.
Calling someone a "hater" only means you can not rationally rebut their argument.
Google put forth an extra $20k incentive to whoever cracked Chrome (in addition to the $15k given by the competition). So given your logic, that would be the first to go. With that kind of money, you could buy many Macs. (Money can be exchanged for goods and services.)
It must have been a Windows PC, running IE, made to look like iOS/Safari. We all know that Apples products don't contain vulnerabilities, whereas Microsoft's PCs can be hacked anytime after POST.
More money, more problems huh Steve...