Hacking contest: Linux unscathed, MacBook and Vista hacked

[xtop]

http://www.pcworld.com/article/id,14...1/article.html

The MacBook Air went first; a tiny Fujitsu laptop running Vista was hacked on the last day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated as conference organizers ended a three-way computer hacking challenge Friday at the CanSecWest conference.

Earlier this week, contest sponsors had put three laptops up for grabs to anyone who could hack into one of the systems and run their own software. A US$20,000 cash prize sweetened the deal, but the payout was halved each day as contest rules were relaxed and it became easier to penetrate the computers.

On day two, Independent Security Evaluators' Charlie Miller took the Mac after hitting it with a still-undisclosed exploit that targeted the Safari Web browser. After about two minutes work, Thursday, Miller took home $10,000, courtesy of 3Com's TippingPoint division, in addition to his new laptop.

It took two days of work, but Shane Macaulay, finally cracked the Vista box on Friday, with a little help from his friends.

Macaulay, who was a co-winner of last year's hacking contest, needed a few hacking tricks courtesy of VMware researcher Alexander Sotirov to make his bug work. That's because Macaulay hadn't been expecting to attack the Service Pack 1 version of Vista, which comes with additional security measures. He also got a little help from co-worker Derek Callaway.

Under contest rules, Macaulay and Miller aren't allowed to divulge specific details about their bugs until they are patched, but Macaulay said the flaw that he exploited was a cross-platform bug that took advantage of Java to circumvent Vista's security.

"The flaw is in something else, but the inherent nature of Java allowed us to get around the protections that Microsoft had in place," he said in an interview shortly after he claimed his prize Friday. "This could affect Linux or Mac OS X."

Macaulay said he chose to work on Vista because he had done contract work for Microsoft in the past and was more familiar with its products.

Although several attendees tried to crack the Linux box, nobody could pull it off, said Terri Forslof, a manager of security response with TippingPoint. "I was surprised that it didn't go," she said.

Some of the show's 400 attendees had found bugs in the Linux operating system, she said, but many of them didn't want to put the work into developing the exploit code that would be required to win the contest.

Earlier, Miller said that he chose to hack the Mac because he thought it would be easiest target. Vista hacker Macaulay didn't dispute that assertion: "I think it might be," he said.

cliffs: mac owned in 2 min, vista in 2 days, linux never.

[dialog_gvf]

Miller said that he chose to hack the Mac because he thought it would be easiest target.

Few writing viruses != It can't be infected
Few hacking the OS != It can't be hacked

Apple is going to reap what they sowed with their pompous advertising. I'd be worried if I were their lawyers. Apple certainly has strongly implied to outright claimed an invulnerability that simply doesn't exist. That sets them up for a big class action one day.

Gary

[actionhank]

Yay Linux!

What distribution they were trying to hack?

[xtop]

Originally Posted by actionhank

Yay Linux!

What distribution they were trying to hack?

i was wondering the same thing

[Rabidhunter]

Wow, I'm surprised by this. All the people who use Mac's claim that they don't need to worry about viruses and hackers. Well, I guess this proves them wrong. Top hackers agreed that the Mac was the easiest to hack over Vista. That is a huge shocker.

[Banjo]

However, with the millions of OS X users out there over the last 8 years, there is still not a single file-infecting virus. There were a couple malwares but they weren't determined to be a threat. More like an one-trick pony to show that it can be done.

Now... how many file-infecting viruses are there for Windows XP alone?

There you go. The hackers will go after majority.

Even if OS X is lacking strong security features, it's still safer to use than to use a PC for the average Joe because they are in the minority. Even though I own a PC and a Mac, I never get any viruses. However, I can't say the same for the uneducated average Joe.

[Marquoz]

Surprised they couldn't crack the linux box, there's tons of root susceptibilities, just none of them last very long with the community work done on it. All you have to do is stay current on the bug lists and you'll find all kinds of vulnerabilities that linux has.