MacBook Air hacked in less than 2 minutes

TranceAddict Forums (www.tranceaddict.com/forums)
- Canada - Toronto & Southern Ont.
-- MacBook Air hacked in less than 2 minutes

Posted by E2EK1EL on Mar-29-2008 18:05:

MacBook Air hacked in less than 2 minutes

MacBook Air hacked in less than 2 minutes

Posted on 29.03.2008 at 11:59 in Tech News by Martin
Mac OS X�s reputation for security was tarnished Thursday when a team of researchers from Independent Security Evaluators (ISE) managed to hack a MacBook Air in two minutes using a zero-day vulnerability in Apple�s Safari 3.1 Web browser. The ISE security researchers � Charlie Miller, Jake Honoroff, and Mark Daniel � were participating in the �PWN to OWN� competition at the CanSecWest security conference, which began Wednesday in Vancouver, British Columbia. �Pwn� is computer gaming slang for �own,� as in conquer. The �p� typo serves to heighten the humiliation of defeat by emphasizing that the loss came at the hands of a youth who can�t even spell or type correctly. The term has also come to be used in security circles.

Contest participants had their choice of trying to hack an Apple MacBook Air running OS X 10.5.2, a Sony Vaio VGN-TZ37CN running Ubuntu 7.10, or a Fujitsu U810 running Vista Ultimate SP1. During the first day, when attacks were limited to network attacks on the operating system, no one managed to compromise any of the systems. That changed Thursday when attacks on default client-side applications � Web browser, e-mail, IM � were allowed. The ISE team won $10,000 from security firm TippingPoint Technologies for compromising the MacBook Air. The undisclosed vulnerability in Safari 3.1 has been shown to Apple and no further information about it will be revealed until Apple can issue an update, TippingPoint said.

Source: CRN, InfoWeek

Posted by RobotHouse on Mar-29-2008 18:06:

buying a mac for regular home use is already a self "pwning"

Posted by chinamon on Mar-29-2008 18:27:

Re: MacBook Air hacked in less than 2 minutes

quote:
Originally posted by E2EK1EL
�Pwn� is computer gaming slang for �own,� as in conquer. The �p� typo serves to heighten the humiliation of defeat by emphasizing that the loss came at the hands of a youth who can�t even spell or type correctly.

i am laughing hysterically at this.

Posted by Cosmic Fur on Mar-29-2008 18:29:

Too much Apple news. How did the other OSs fare?

Posted by zokissima on Mar-29-2008 18:35:

Meh, the mass market will NEVER know of this, or of many other vulnerabilities within the mac OS releases of the last few years. Thus the POS will still remain fashionable, overpriced, and will continue to function at a mediocre level.

Posted by *~LiSa-LoO~* on Mar-29-2008 18:52:

I hate Macs, but I frickin' love the commercial for the MacBook Air

Posted by MarkT on Mar-29-2008 20:47:

Re: Re: MacBook Air hacked in less than 2 minutes

quote:
Originally posted by chinamon
i am laughing hysterically at this.

oh god, me too...that's fucking gold, LOL

Posted by mnemonic. on Mar-30-2008 00:08:

I hate my fucking mac.

Posted by Anton on Mar-30-2008 01:38:

quote:
Originally posted by Cosmic Fur
Too much Apple news. How did the other OSs fare?

Windows got hacked after the mac, the Linux one won. I think they used some kind of Flash exploit to "pwn" the Windows pc

Posted by Stilez on Mar-30-2008 01:58:

quote:
Description:
Juan Pablo Lopez Yacubian has discovered two vulnerabilities in Safari, which can be exploited by malicious people to conduct spoofing attacks or potentially compromise a user's system.

1) An error when downloading e.g. a .ZIP file with an overly long filename can be exploited to cause a memory corruption.

Successful exploitation may allow execution of arbitrary code.

2) An error in the handling of windows can be exploited to display arbitrary content while showing the URL of a trusted web site in the address bar.

The vulnerabilities are confirmed in version 3.1 for Windows. Other versions may also be affected.

Solution:
Do not browse untrusted web sites.

Provided and/or discovered by:
Juan Pablo Lopez Yacubian

SOURCE

Another quote:

quote:
The hack came during the Pwn2Own contest, which is being held at the CanSecWest conference in Vancouver. The competition took place in a conference room overlooking the city's Burrard Inlet, a harbor where pontoon planes took off and disappeared into black rain clouds shrouding nearby Grouse Mountain. A small round of applause broke out immediately after contest officials confirmed Miller's exploit was legit.

At time of writing, the Windows and Linux machines were still standing.

Under contest rules, Miller was forbidden from providing specifics of his hack. He said he chose Apple over the other machines because "I thought of the three it was the easiest". He said he didn't test the exploit on any other platform. As a Mac user, he added, he felt an incentive to exploit the system because he believes it will help make the platform stronger. Miller, who works for Independent Security Evaluators, received help from co-workers Jake Honoroff and Mark Daniel.

Posted by mnemonic. on Mar-30-2008 03:44:

quote:
Originally posted by zokissima
Meh, the mass market will NEVER know of this, or of many other vulnerabilities within the mac OS releases of the last few years. Thus the POS will still remain fashionable, overpriced, and will continue to function at a mediocre level.

unfortuneately thats true

Posted by Kytracid on Mar-30-2008 05:39:

MAC = The lazy man's PC

Posted by VERTiG0 on Mar-30-2008 07:16:

I played with one at Futureshop yesterday and was impressed by how thin it was, then I turned 180 degrees and saw a Compaq with better specs for $699.

I had a light chuckle.

Posted by VDub on Mar-30-2008 16:19:

Who was it that was playing at Guv on an ibook but had FUCK MAC in red duct tape all around the mac logo???