The MacBook Air went first; a tiny Fujitsu laptop running Vista was hacked on the last day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated as conference organizers ended a three-way computer hacking challenge Friday at the CanSecWest conference.
Earlier this week, contest sponsors had put three laptops up for grabs to anyone who could hack into one of the systems and run their own software. A US$20,000 cash prize sweetened the deal, but the payout was halved each day as contest rules were relaxed and it became easier to penetrate the computers.
On day two, Independent Security Evaluators' Charlie Miller took the Mac after hitting it with a still-undisclosed exploit that targeted the Safari Web browser. After about two minutes work, Thursday, Miller took home $10,000, courtesy of 3Com's TippingPoint division, in addition to his new laptop.
It took two days of work, but Shane Macaulay, finally cracked the Vista box on Friday, with a little help from his friends.
Macaulay, who was a co-winner of last year's hacking contest, needed a few hacking tricks courtesy of VMware researcher Alexander Sotirov to make his bug work. That's because Macaulay hadn't been expecting to attack the Service Pack 1 version of Vista, which comes with additional security measures. He also got a little help from co-worker Derek Callaway.
Under contest rules, Macaulay and Miller aren't allowed to divulge specific details about their bugs until they are patched, but Macaulay said the flaw that he exploited was a cross-platform bug that took advantage of Java to circumvent Vista's security.
"The flaw is in something else, but the inherent nature of Java allowed us to get around the protections that Microsoft had in place," he said in an interview shortly after he claimed his prize Friday. "This could affect Linux or Mac OS X."
Macaulay said he chose to work on Vista because he had done contract work for Microsoft in the past and was more familiar with its products.
Although several attendees tried to crack the Linux box, nobody could pull it off, said Terri Forslof, a manager of security response with TippingPoint. "I was surprised that it didn't go," she said.
Some of the show's 400 attendees had found bugs in the Linux operating system, she said, but many of them didn't want to put the work into developing the exploit code that would be required to win the contest.
Earlier, Miller said that he chose to hack the Mac because he thought it would be easiest target. Vista hacker Macaulay didn't dispute that assertion: "I think it might be," he said.
cliffs: mac owned in 2 min, vista in 2 days, linux never.
Miller said that he chose to hack the Mac because he thought it would be easiest target.
Few writing viruses != It can't be infected
Few hacking the OS != It can't be hacked
Apple is going to reap what they sowed with their pompous advertising. I'd be worried if I were their lawyers. Apple certainly has strongly implied to outright claimed an invulnerability that simply doesn't exist. That sets them up for a big class action one day.
Wow, I'm surprised by this. All the people who use Mac's claim that they don't need to worry about viruses and hackers. Well, I guess this proves them wrong. Top hackers agreed that the Mac was the easiest to hack over Vista. That is a huge shocker.
However, with the millions of OS X users out there over the last 8 years, there is still not a single file-infecting virus. There were a couple malwares but they weren't determined to be a threat. More like an one-trick pony to show that it can be done.
Now... how many file-infecting viruses are there for Windows XP alone?
There you go. The hackers will go after majority.
Even if OS X is lacking strong security features, it's still safer to use than to use a PC for the average Joe because they are in the minority. Even though I own a PC and a Mac, I never get any viruses. However, I can't say the same for the uneducated average Joe.
Surprised they couldn't crack the linux box, there's tons of root susceptibilities, just none of them last very long with the community work done on it. All you have to do is stay current on the bug lists and you'll find all kinds of vulnerabilities that linux has.
There's no way Vista is more secure (although it's probably not less secure) than OS X. It's just that Vista SP1 hasn't been out there all that long... it's more unfamiliarity than any real security.
There's no way Vista is more secure (although it's probably not less secure) than OS X. It's just that Vista SP1 hasn't been out there all that long... it's more unfamiliarity than any real security.
All major OS' are very vulnerable end of story.
lol you sound kinda pissed, just accept it, no need for people to cling to companies.
There's no way Vista is more secure (although it's probably not less secure) than OS X. It's just that Vista SP1 hasn't been out there all that long... it's more unfamiliarity than any real security.
All major OS' are very vulnerable end of story.
That's why you take the precautions you can, and unless you have to be active 24 hours a day, shut the computer off when you're done. The longer you are on, the more likely somebody will ping you and try to tag you. Imagine all the footprints you leave all over the net.
"Some of the show's 400 attendees had found bugs in the Linux operating system, she said, but many of them didn't want to put the work into developing the exploit code that would be required to win the contest."
Sounds like somewhat of a stupid way to test the system. You had different people attacking, to gauge how to get in it. To really test it, it would be one team or one person trying to crack all three systems.
And the the OSX defenders, because you haven't heard of attacks on OSX does not mean it does not happen.
lol you sound kinda pissed, just accept it, no need for people to cling to companies.
Hahahahha... I've probably been running Linux almost as long as you've been alive and I've never owned a Mac. This isn't about brand superiority... what annoys me is that somehow people see this as a accurate assessment of how vulnerable an OS is.
All countries
Argentina
Austria
Belgium
Brazil
Bulgaria
Chile
China
Colombia
Cyprus
Czech Republic
Estonia
Denmark
Finland
Greece
Hong Kong
Hungary
Iceland
Indonesia
Ireland
Israel
India
Latvia
Lithuania
Malaysia
New Zealand
Norway
Philippines
Poland
Portugal
Romania
Russia
Singapore
South Africa
South Korea
Sweden
Switzerland
Taiwan
Thailand
Turkey
Ukraine
United Arab Emirates
Hacking contest: Linux unscathed, MacBook and Vista hacked
Linear Mode
