Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Apple

How Apple Orchestrated Attack On Researchers 389

Posted by kdawson from the no-way-to-win-friends dept.
An anonymous reader sends us to George Ou's blog on ZDNet for a tale of how Apple's PR director reportedly orchestrated a smear campaign against security researchers David Maynor and Jon Ellch last summer. Ou has been sitting on this story ever since and is only now at liberty to tell it. He posits that the Month of Apple Bugs was a direct result of Apple's bad behavior in the Maynor-Ellch affair. From the blog: "Apple continued to claim that there were no vulnerabilities in Mac OS X but came a month later and patched their Wireless Drivers (presumably for vulnerabilities that didn't actually exist). Apple patched these 'non-existent vulnerabilities' but then refused to give any credit to David Maynor and Jon Ellch. Since Apple was going to take research, not give proper attribution, and smear security researchers, the security research community responded to Apple's behavior with the MoAB (Month of Apple Bugs) and released a flood of zero-day exploits without giving Apple any notification. The end result is that Apple was forced to patch 62 vulnerabilities in just the first three months of 2007 including last week's megapatch of 45 vulnerabilities."
This discussion has been archived. No new comments can be posted.

How Apple Orchestrated Attack On Researchers More

How Apple Orchestrated Attack On Researchers

Comments Filter:

  • So I don't get it... (Score:5, Interesting)

    by CatOne ( 655161 ) on Tuesday March 20, 2007 @09:58PM (#18424521)
    All this "smear campaign" stuff... talking about how Apple really hammered him on the clarification of whether it was a 3rd party driver. And George gets indignant that Apple asked this to be done.

    Yes, you could see in the video that they used a 3rd party driver. However, was it really CLEAR that the exploit only existed for the 3rd party driver? Maynor and Ellch certainly did NOT dwell on this -- they in fact spent more time saying they enjoyed doing this because Mac users were "smug."

    And, gullible as the press is, the press most certainly did NOT report "3rd party flaw exposes OS X security hole!" It was more along the lines of "OMGMACCRACKOVERWIRELESS!" It was days before it was clear, and even then it was necessary to specifically explain this to people. Sure, the video showed this, but the fact of the matter is that most people, including the press, did not UNDERSTAND this fact... and this was clearly obvious from the reaction to the matter in the first place.

    And what I also don't get is... what are you really showing if you use a 3rd party wireless driver to hack a MacBook which has BUILT-IN wireless? Sure, you can do it, but is that a realistic scenario? I mean, I could compromise someone's system if I stole it and they didn't have disk encryption turned on as well... is that a hack?

    • Re:So I don't get it... (Score:5, Insightful)

      by Jeff DeMaagd ( 2015 ) on Tuesday March 20, 2007 @10:15PM (#18424645) Homepage Journal
      It's not necessarily implausible. How about better wireless? Wireless-n is faster and has longer range, but is not available to the original Core Duo models. Upgrading the built-in wireless is possible, but not easy. One can consider an add-on.

      But the quality of third party device drivers isn't really something you can blame Apple for, at least I don't think so. I don't blame Microsoft or Linus if nVidia fubars a driver, I blame the company whose name is on the driver.

      • Re: (Score:3, Insightful)

        by Bretai ( 2646 )
        I think George Ou brings up 3rd party drivers as a distraction and because it's an easier position to defend. Unfortunately for him, this isn't about 3rd party drivers for two reasons. First, David Maynor has admitted that the presentation given to Brian Krebs, before the "Hijack a Mac in 60 Seconds" piece that started it all, did not use a 3rd party wireless card. Secondly, he hasn't released the 3rd party exploit either!!

        Maynor is responsible for the media attention, and Apple's response. Of course, all o

    • Re:So I don't get it... (Score:5, Informative)

      by fyngyrz ( 762201 ) * on Tuesday March 20, 2007 @10:20PM (#18424675) Homepage Journal

      Well, I guess it's moot right now, since Apple broke it's wireless support thoroughly with the 2007-002 update [apple.com] back at the beginning of March, and has remained silent about addressing the problem since then. I've been back to wired connections for weeks now.

      It is somewhat problematic to try to hack a connection that won't connect. :-)

      I suppose eventually they'll fix this; the silence is a little disturbing, though. It seems... poorly thought out.

      • Since my wireless connections, on my dual G5 and my TiBook work just fine ..

        Although a quick check at Mac Fix It does discuss the problem: http://www.macfixit.com/article.php?story=20070318 234944267 [macfixit.com]

        Curious

        SteveM

        • Re: (Score:2)

          by fyngyrz ( 762201 ) *

          The problem I am talking about first reared its head in the 2007-002 update, not the .9 update (though I have little doubt that it exists there as well.)

      • Well, I guess it's moot right now, since Apple broke it's wireless support thoroughly with the 2007-002 update [apple.com] back at the beginning of March, and has remained silent about addressing the problem since then. I've been back to wired connections for weeks now.

        Hmmm. I'm posting right now from my MBP connected to my wireless router. No problems here. I did not experience any lack of wireless network connectivity even though I was diligent in installing all updates as they came out.

    • Re:So I don't get it... (Score:5, Insightful)

      by xzvf ( 924443 ) on Tuesday March 20, 2007 @10:24PM (#18424719)
      The bottom line here is not that OSX is a secure operating system (it is to a great extent). We should look at this article as an example of how closed source and protectionist behavior is detremental. Apple makes a good product and I own some of their hardware, but I prefer to have open systems based on open standards whenever possible. Or maybe I should say transparent. Most SEC rules for public companies are designed to allow investors to see the company's financial behavior. Many interested eyes means an honest market (despite occasional dishonest behavior we trust the market with our 401Ks, if we didn't we'd have gold bars under our mattress). Apple's secretive nature and marketing spin is in many ways a bad thing for consumers in the long run. Do you really trust Apple to always provide a solid OS, your music and video, and phone service without some checks and balances? I would prefer true freedom. That's not to say Apple hasn't earned some level of trust, but if we can't verify, how long will that last?

      • Re: (Score:3, Interesting)

        by The_Wilschon ( 782534 )
        OTOH, just to play the devil's advocate, you might say that the closed nature of Apple allows them more freedom to innovate with new modes of operation. If there were more transparency in Apple and its competitors, then certain things that Apple might do would be considered trustworthy. If they tried to branch out into new territory business-model and software-management-model wise, then we would be able to see that, and since most people don't trust change, they would lose market- and mind-share. With a

    • Re:So I don't get it... (Score:4, Interesting)

      by civilizedINTENSITY ( 45686 ) on Tuesday March 20, 2007 @10:45PM (#18424859)
      "However, was it really CLEAR that the exploit only existed for the 3rd party driver?"

      But it should not have been *clear*, since the exploit did exist for Apple drivers as well as the 3rd party. It was only because Apple leaned on them to show the exploit with 3rd party drivers that it was done that way. So they cooperated with Apple, and got hosed for it.

      • Re: (Score:3, Insightful)

        by CatOne ( 655161 )
        Is this documented somewhere or is this more stuff that George Ou is "hinting at?"

        Would love to see some actual details on this, if it's true.

        • Re:So I don't get it... (Score:4, Informative)

          by civilizedINTENSITY ( 45686 ) on Wednesday March 21, 2007 @02:15AM (#18425955)
          At the risk of being redundant (posting this to other similar replies): Does the Washington Post count? Security Fix Brian Krebs on Computer Security "Indeed, as I reported earlier, in his hotel room on the eve of that presentation, Maynor showed me a live demo of him exploiting the built-in Macbook drivers to break into the machine from another laptop -- without a third party card plugged in." Try the first URL in the article and search for Washington Post, then follow the links to the story.

  • Shooting fish in a barrel (Score:4, Insightful)

    by 93 Escort Wagon ( 326346 ) on Tuesday March 20, 2007 @09:59PM (#18424525)
    It doesn't seem like Apple needed to do much to make those guys look bad - they did a darn good job of it all by themselves [slashdot.org].

    • Re:Shooting fish in a barrel (Score:4, Insightful)

      by Overly Critical Guy ( 663429 ) on Wednesday March 21, 2007 @12:24AM (#18425487)
      George Ou's been beating this never-ending drum for page hits. Here's a response. [macalope.com]

      To address the summary:

      Apple continued to claim that there were no vulnerabilities in Mac OS X but came a month later and patched their Wireless Drivers (presumably for vulnerabilities that didn't actually exist).

      They said in the notes that they did a security audit with no input from the researchers and patched what they discovered.

      Apple patched these 'non-existent vulnerabilities' but then refused to give any credit to David Maynor and Jon Ellch.

      Why should they have?

    • Re:Shooting fish in a barrel (Score:5, Insightful)

      by catwh0re ( 540371 ) on Wednesday March 21, 2007 @12:39AM (#18425559)
      While I congratulate slashdot on trying to post the story from the "other side". The researchers, for the most part, did all the smearing on their own behalf. The whole affair basically started with a digg article which read "Hijacking a Macbook in 60 seconds or less." This sensational headlining story was slowly diluted over time to a remote exploit on a 3rd party card. The authors claimed it could be done with the built in card, but claimed that Apple had pressured them not to demonstrate this.

      No one believed this story about Apple pressuring the security researchers for 2 reasons. No security company would actually let their name be dragged through the dirt by the internet community for the sake of saving face for another company especially Apple. Secondly their story changed by the day and requests to see an exploit/method/code release were constantly denied. The only demonstration was highly dubious as it was presented as a video.

      Since the fiasco came about Apple did then commission an external company to look for bugs in their airport drivers, while some bugs were found they were unrelated to the publicised "macbook remote exploit" (the security researchers gave such little information anyway.)

      Then finally once all the patches were out by Apple, the security researchers piped up again claiming that the exploits they discovered were the ones that Apple had patched. (When in all reality they probably just examined the old and new drivers and looked for the differences.)

      Suggestions that Apple users are blind, security unaware dummies is what caused most of the outrage. Going out claiming that the Apple user base believe they are impervious to spyware/viruses/etc. is an invitation for negative feedback. It has very little to do with "Attacking the mac-zealots precious platform"... after all much of the operating system is open source darwin, a BSD implementation.

      As for the followup month-of-apple-bugs and other negative security feedback, those are most definitely not solely rooted by this sole affair. Ou is merely trying to spin them this way to provide some kind of grass-roots response to his purported conspiracy.

  • i didn't know that. (Score:5, Funny)

    by User 956 ( 568564 ) on Tuesday March 20, 2007 @09:59PM (#18424527) Homepage
    An anonymous reader sends us to George Ou's blog on ZDNet for a tale of how Apple's PR director reportedly orchestrated a smear campaign against security researchers David Maynor and Jon Ellch last summer.

    Karl Rove is Apple's PR director?

  • More commentary here (Score:4, Informative)

    by Anonymous Coward on Tuesday March 20, 2007 @09:59PM (#18424529)
    Geez, don't leave out Matasano's response [matasano.com]. George Ou is a tool.

  • George Ou? (Score:5, Informative)

    by vought ( 160908 ) on Tuesday March 20, 2007 @10:00PM (#18424535)
    Is this the same guy who doesn't know Gerbils from Goebbels [macalope.com]?

    This all sounds a little fantastic to be true. Most folks at Apple I know don't have time for an agenda. And speaking of agendas, George Ou's definitely got a hard-on [zdnet.com] for Apple.

  • Doesn't quite wash (Score:5, Insightful)

    by djupedal ( 584558 ) on Tuesday March 20, 2007 @10:02PM (#18424549)
    Right, since ZDNet is such a long time Apple/Mac news and information source - and let's just overlook the phishing code embedded in the MoAB web page(s).

    I doubt the real truth has actually surfaced just yet, and it may be a long time, if ever, that it does.

    • Re: (Score:2)

      by webword ( 82711 )
      Exactly.

      What's the real story? Also, who has the resources and inclination to continue?

    • Re: (Score:3, Informative)

      by Ilgaz ( 86384 )
      For OS X outsiders and people watching only "MOAB are nice guys trying to help" sites, MOAB actually tried and succeeded to DOS OS X default browser Safari on their day 29 error page.

      It would be a bit understandable if they displayed that malformed jp2 to .apple.com IPs but they didn't. They attacked unsuspecting end user trying to inform himself/herself which is completely unacceptable. If you remember Safari is a tabbed browser, a huge chance of information loss was there too.

  • Go Figure! (Score:4, Insightful)

    by PO1FL ( 1074923 ) on Tuesday March 20, 2007 @10:04PM (#18424569) Homepage
    Face it, any OS that widely-used (read: "popular") enough is going to be subjected to bug exploitation. Even Linux has bugs http://www.wired.com/news/linux/0,1411,66022,00.ht ml [wired.com] although, _WAY_ less than M$. In an open source OS the bugs get fixed, IMO, faster and more reliably than your weekly M$ patch. The point is, ITS GOING TO HAPPEN!

    • Re: (Score:3, Interesting)

      by Ilgaz ( 86384 )
      Some of these "researchers" think Apple community consists of "maccies" who thinks their system is super secure by default.

      Those people are minority.

      There are very popular and sometimes expensive security products on Mac which consists of Application filtering firewalls, antiviruses (yes, check download numbers) and many more. Of course there are some snake oil sellers (Not Intego, I don't agree) who tries to exploit the user interest and ship zero function crap. Sadly, they are popular too.

      There are some a

  • I don't quite buy it. (Score:5, Insightful)

    by Kadin2048 ( 468275 ) <slashdot...kadin@@@xoxy...net> on Tuesday March 20, 2007 @10:05PM (#18424575) Homepage Journal
    I'll accept that the MoAB was definitely a result of the furor and press over the wireless vulnerability. But I'm not sure that I believe the smear campaign / character assassination part. Honestly, Apple really didn't need to bother; those guys' original presentation was so sketchy that they practically invited criticism themselves. First they'd say one thing (that it affected all Macs) but then they demo'ed it with a totally different hardware setup, with no good explanation as to why, producing countervailing views as to whether all Macs were really that insecure in their default state, etc. There's no way you can spin the way the vulnerability was announced as a well-managed affair. The whole thing stank from the beginning.

    At any rate, though, I don't think it's really any surprise that large parts of Apple still bow to the notion that "if there's a bug in the code, and nobody outside of the company knows about it, is it really a bug?" somehow warrants a 'yes' answer. So as a Mac user, I'm not really unhappy at all that MoAB happened, for whatever reason. I'd rather have stuff out in the open, and patched quickly, than some sort of quasi-secret (because, let's face it, if more than one person knows about it, it's not a secret anymore) unpatched vulnerability. I like Apple's gear but that doesn't mean I don't think they need to get a swift kick in the ass every once in a while to stay on top of things.

    • At any rate, though, I don't think it's really any surprise that large parts of Apple still bow to the notion that "if there's a bug in the code, and nobody outside of the company knows about it, is it really a bug?" somehow warrants a 'yes' answer.

      Should read: At any rate, though, I don't think it's really any surprise that large parts of Apple still bow to the notion that "if there's a bug in the code, and nobody outside of the company knows about it, is it really a bug?" somehow warrants a 'no' answer.

      In

  • Ou appears to be a liar (Score:5, Informative)

    by samkass ( 174571 ) on Tuesday March 20, 2007 @10:06PM (#18424583) Homepage Journal
    From one of the folks accused of conspiring with Apple:

    http://www.tuaw.com/2007/03/20/clarification-on-th e-macbook-wi-fi-hack-conspiracy/ [tuaw.com]

    "While I'm flattered at the possibility of Apple even talking to me, the truth of the matter is that the company pretty much ignores TUAW, and most other Apple-related blogs, entirely. Honestly: Fox and I never exchanged so much as a "mwahaha" over email, or any other form of correspondence for that matter. I've never been contacted by anyone from Apple regarding anything besides the fact that one of my older PowerBook's warranties was about to expire, and that AppleCare would be a great way to stay within their graces."

    • Re:Ou appears to be a liar (Score:5, Insightful)

      by PhoenixK7 ( 244984 ) on Tuesday March 20, 2007 @10:35PM (#18424799)
      Honestly, this whole post of his seems to me to be incredibly stupid. All he's saying here is that Apple tried to force them to clarify that the were using a 3rd party card, and they were. Where does all this "smear" crap come from. The more released about this whole thing, the more it becomes clear that the original "researchers" where being somewhat unclear in their disclosures, and that Apple simply wanted them to clear it up. I SERIOUSLY doubt that Apple called up TUAW and said something to the effect of "We've got a situation here, we need to discredit these guys.." It just doesn't make any sense. All that's clear here is that the "researchers" made an error in not disclosing all the facts of their hack. They used a Mac to make it appear that Mac OS X was just as vulnerable as any other operating system, and didn't come up with an exploit for actual Apple hardware and drivers. Hell, they still haven't even identified the maker of the card. The WHOLE presentation, boils down to being about as effective as making their own hardware device and drivers and finding and writing in a flaw to exploit. We still have no clue if this was a pre-discovered flaw in that card's driver. Additionally, the recent presentation displaying a crash of the same MacBook running 10.4.6 only demonstrates that they may have done the same thing with Apple's older drivers. They figured out the flaw Apple patched and then worked out an exploit for it.

      Stop posting anything about these guys, they don't deserve the publicity, and all this crap about smearing and breaking Apple's hardware is both moot and full of willful misinterpretation. These guys are attention seekers and no more.
      • Well except that the exploit worked for Mac HW too. The email sent by Apple with notice to be placed on the web site didn't say, "Note: we said it was a third party driver", which would have been true, they did. Rather it was to force them to say, "...is reliant the use of a third party driver. In short, the answer is yes. The MacBook is not inherently vulnerable to the attack, and I never said that it was." Which is *not* true, and indeed is a lie. That is the core of the problem. Apple wanted them to

        • Re: (Score:3, Insightful)

          by SteveM ( 11242 )

          Well except that the exploit worked for Mac HW too.

          Do you have any proof of this, other than Maynor-Ellch claims? An actual instance of the exploit working on Mac HW? Because I've not seen any.

          And George Ou doesn't count.

          SteveM

  • Microsoft bugs? (Score:4, Insightful)

    by Damek ( 515688 ) <adam@@@damek...org> on Tuesday March 20, 2007 @10:10PM (#18424617) Homepage
    Does Microsoft give free PR to "security researchers" every time it patches a bug? How about various linux software projects, do they crow openly about those who find bugs in their software? Or do they just patch the bugs?

    Everything I've read about this suggests the "security professionals" are looking for fame and Apple doesn't care. I don't either. As long as bugs get patched, and Apple seems to have done so in a timely fashion, at least as much as Microsoft and other software companies do.

  • You can smear shit.... (Score:5, Insightful)

    by Senjutsu ( 614542 ) on Tuesday March 20, 2007 @10:12PM (#18424637)
    but it doesn't make it look any worse. How do you hurt the image of a pair of morons who already do an incredible job of making themselves look like asshats?

    MOAB as "revenge"? A number of "Apple's" bugs as listed in MOAB were in third-party software (VLC on day 2 for fuck's sake!), the same as their original hyperbolic wireless exploit shenanigans. And then they go and use an exploit on the site, and act like petulant children in their communication with others through the site, all the while crying foul that they aren't being treated like serious security professionals.

    • Re: (Score:2)

      by LoRdTAW ( 99712 )
      Apparently the MOAB [wikipedia.org] is quite useful for revenge.

  • What a continuing cry for attention (Score:5, Informative)

    by NMerriam ( 15122 ) <NMerriam@artboy.org> on Tuesday March 20, 2007 @10:17PM (#18424651) Homepage
    This is not "news" by any stretch of the imagination. Ou is only now "at liberty" to discuss the matter? I remember quite clearly while the whole wireless driver brouhaha was happening that he and the researchers were claiming Apple was running a "smear campaign" against them -- a campaign that everyone else in the security community and press was somehow unaware of, given how massive Ou claims it to have been.

    Apple never claimed there were no flaws in their drivers, I don't know how many more times this can possibly be stated to Ou, if it is necessary to use shorter words with fewer syllables or what. Apple's only statement on the whole matter was that Maynor never provided any specific information to Apple as to what this specific security hole was supposed to be. He jumped up and down and waved his arms and told Apple they needed to fix it real soon, but neither he nor Ou nor anyone else has provided any kind of documentation indicating he gave any actual, useful information to Apple about this security vulnerability. He just made vague pronouncements about wireless security and then expected Apple to read his mind, as far as all the available evidence can prove.

    Yes, Apple released patches for network drivers after this whole announcement was made -- they released patches for network drivers before then, too!

    Ou continues to be either grossly deceived, completely inept at actually investigating and reporting, or so caught up in his ego that he can't recognize he's been played like a piano.

    This is not a case of Apple hiding their heads in the sand, running a smear campaign, or fanbois refusing to accept that something could be less than perfect.

    Provide some actual evidence and people will listen to your fearmongering, but it's been a year already since this "huge vulnerability" was disclosed and the most we've seen is a computer crash!
    • Actually Apple tried to force the researchers to state that there were no holes in Apple drivers. Seems wrong to me.
    • The Washington Post seems to disagree with your version of history: "Update on the Apple Macbook Claims

      Apple today issued a statement strongly refuting claims put forth by researchers at SecureWorks that Apple's Macbook computer contains a wireless-security flaw that could let attackers hijack the machines remotely. "

      • Re:What a continuing cry for attention (Score:4, Interesting)

        by NMerriam ( 15122 ) <NMerriam@artboy.org> on Wednesday March 21, 2007 @05:25AM (#18426647) Homepage
        That's what the Post blog (the other place that misrepresented the story too much initially to risk backing down) says, but not what Apple actually said at the time. If you read the statement by Apple, they refute that Maynor has provided them with any evidence of a flaw in their network drivers, which he stated he had but they didn't bother to fix it. They never claimed there were no flaws at all, that would be a ridiculous statement for ANY company to make about anything, they just said that they had no idea what flaw Maynor was talking about.

        That's why this is such a ridiculous drama -- all Maynor or anyone else has to do to show Apple is a bunch of liars is provide the documentation trail they sent to Apple that they supposedly ignored. A year later, they still haven't provided even that, much less any evidence of the flaw itself.

    • Ou continues to be either grossly deceived, completely inept at actually investigating and reporting, or so caught up in his ego that he can't recognize he's been played like a piano.

      And an asshat to boot.

      SteveM

  • March is 'month of slow news days' on slashdot. (Score:5, Funny)

    by tinkertim ( 918832 ) * on Tuesday March 20, 2007 @10:26PM (#18424731)
    Everyone else gets to name a month. Dammit I want one too.

  • Reasonable question... (Score:4, Insightful)

    by jpellino ( 202698 ) on Tuesday March 20, 2007 @10:35PM (#18424795)
    Do Maynor, Ellch, KF and LMH in fact speak for " the security community"?

    Played or not, Maynor and Ellch came out swinging at Mac users and attacked them on attitude's sake alone.

    Last summer, KF was blogging about what a great, rapid job Apple did on its patches, and by January, he's got them on a spit in the public square, and baiting Apple and its users.

    Is this to be the public face of the security community?

    What I got from the original video, taken on its face, is that the MacBook was not vulnerable, that the exploit was for some 3rd party vendor's stuff, but they were going to use the MacBook just to cheese off Apple users, whose attitudes they perceived as lousy. Human memory being what it is, like Orson Welles' The War Of The Worlds radio broadcast, they had to realize after watching the remaining lion's share of the video that people would mostly retain the image of a MacBook getting pwned.

    Beyond the mechanicals, my other impression was that if they were going to demo an important vulnerability and chose to wrap it in several layers of personal feelings for a specific bunch of people, they might be skilled, but they're still unprofessional.

    I'm not sure if George is trying to paint them as choirboys or simply C his own A.

  • Skeptical (Score:5, Insightful)

    by Colitis ( 8283 ) <jj DOT walker AT outlook DOT co DOT nz> on Tuesday March 20, 2007 @10:37PM (#18424813)
    Apple continued to claim that there were no vulnerabilities in Mac OS X but came a month later and patched their Wireless Drivers (presumably for vulnerabilities that didn't actually exist).

    I believe they actually claimed they hadn't had the vulnerability in question demonstrated to them. The fact that they later patched *a* vulnerability in wireless drivers doesn't necessarily prove anything. If it does, then as an Apple basher, my future plan will be:

    a) announce that I've found a vulnerability in in $OSX_FEATURE.
    b) ignore requests for details, proof, etc
    c) be universally regarded as an idiot
    d) Wait until someone else finds a vulnerability in $OSX_FEATURE and Apple patches it.
    e) trumpet from the rooftops that I said there was a vulnerability in $OSX_FEATURE months ago and OMG! Apple denied it and look, they've just fixed it and I was right all along!
    f) Smugly watch the sensationalist articles about how Apple bullied me.

    • Re: (Score:3, Informative)

      by civilizedINTENSITY ( 45686 )
      Washington Post: "Apple's Fox said that prior to the Black Hat demo, SecureWorks did contact Apple about a wireless flaw in FreeBSD, the open-source code upon which Apple's OS X operating system is based. In January, FreeBSD released a patch to fix the problem, which according to the accompanying advisory, related to a flaw in the way FreeBSD systems scanned for wireless networks that could be exploited to allow attackers to take complete control over the targeted machine."

  • Apple exploit code (Score:4, Insightful)

    by lancejjj ( 924211 ) on Tuesday March 20, 2007 @10:39PM (#18424825) Homepage
    From the article:

    [The blogger Wu] specifically asked Maynor and Ellch if they were using Apple's Wi-Fi hardware in their official Black Hat demonstration. They clearly said that no Apple Wi-Fi product was used for the exploit.
    Finally the truth comes out - Maynor's Wi-Fi vulnerability demonstration had nothing to do with Apple's Wi-Fi products. He was just using the Apple platform for presentation impact. Otherwise it would have been an even more boring talk than it was (at least for us technical guys). Ah.... ...um, didn't we learn about this trick a few months ago? Is this another SlashDup, or is there some finer point in his long post that I'm missing?

    Oh! I see! There are lots of ADVERTISEMENTS on this blog page! Phew! This was a great way to drive traffic! Thanks ZD-Net, for the "news"!!!

    Now I'll turn on CNN and watch the "news" about the next dreaded disease from Asia that could kill my children (and see Viagra ads at the same time.)

  • I am confused (Score:3, Insightful)

    by pudge ( 3605 ) * Works for Slashdot <<slashdot> <at> <pudge.net>> on Tuesday March 20, 2007 @10:48PM (#18424877) Homepage Journal
    Um ... why does Ou think those researchers should get credit for uncovering a vulnerability in Mac OS X that (Ou reminds us over and over again) they themselves claimed, from the beginning, that they did not uncover?

    And when did Apple ever "claim that there were no vulnerabilities in Mac OS X"? I am pretty sure that's never been said, at least, not officially. Maybe some employee spoke out of turn, but the company itself has never made that claim. Ever.

    I don't know anything about Ou, but these two huge misstatements don't make me trust him ...

    • Re: (Score:2)

      by ryanr ( 30917 ) *
      Um ... why does Ou think those researchers should get credit for uncovering a vulnerability in Mac OS X that (Ou reminds us over and over again) they themselves claimed, from the beginning, that they did not uncover?

      Where did Maynor and Ellch claim they did not discover the vulnerability?

      • Re: (Score:2)

        by pudge ( 3605 ) * Works for Slashdot

        Um ... why does Ou think those researchers should get credit for uncovering a vulnerability in Mac OS X that (Ou reminds us over and over again) they themselves claimed, from the beginning, that they did not uncover?

        Where did Maynor and Ellch claim they did not discover the vulnerability?

        That was Ou's main point: that they were not demonstrating any vulnerability in Mac OS X or Apple hardware (and therefore Apple was wrong to "smear" them). The question you should be asking Ou is, where did they ever claim they DID discover the vulnerability?

  • Seriously, this whole sorry saga has been hashed and rehashed all over the web. Why should /. give these clowns any more publicity? See John Gruber's blog [daringfireball.net] for an excellent debunking of Maynor, Ellch, and Ou's claims.

  • What about implementing WHQL? (Score:3, Interesting)

    by Ilgaz ( 86384 ) on Tuesday March 20, 2007 @11:04PM (#18424965) Homepage
    If this thing is completely related to 3rd party driver , it is a sign that Apple needs to adopt a WHQL like method to certificate third party drivers. I know it would sound bad but they could publicly call users not to use a certain, unmaintained driver which apparently got abandoned by hardware manufacturer.

    I know MS one is not that serious but Apple could start from beginning learning from MS mistakes.

    It could be more security and performance focused rather than vendor lock in.

    BTW I bought a Windows only USB Wireless product by mistake (site error) and I have good clue what driver they may be talking about. If it is the case, it is completely unrelated to Apple really. Also I am not talking about Orangeware etccommercial drivers which are maintained very good.
    • There aren't many 3rd party drivers--- apart from the occasional printer driver, that are used with Mac OS X on a regular basis to begin with. Because as has been pointed out time and time again they were using a 3rd party wifi product on a laptop with wifi built in. In general about everything is built into a mac and Apple directly supports said products with drivers either written or supported by Apple.

      • Re: (Score:2)

        by Ilgaz ( 86384 )
        I see "macbooks" everywhere so it will/may change in the future. I mean, popularity of Mac exploded and from driver discussion mailing list, I assume lots of vendors are "learning" how to write OS X drivers for their product.

        So I suggest it for future and I also heard sort of executable/driver signing (not like MS!) coming to Leopard.
  • Please, continue to have "Months of Apple Bugs", hell, make it every month! The more you force Apple to patch the more secure my mac will be.

    • Re: (Score:2)

      by Oswald ( 235719 )
      Sir or Madam, I commend you. Apparently you are able to use and enjoy your Macintosh without feeling the need to become a shill for this for-profit, publicly-held, multi-billion dollar corporation. Their product is not you; you are not identified or completed by your use of their product. This is a radical new concept which should receive wide dissemination.

      • Re: (Score:3, Interesting)

        by Watts Martin ( 3616 )
        While there are indeed real "Mac zealots" out there, there seems to be a far, far greater number of PC users who squeal like stuck pigs and go on flaming, spittle-flecked anti-Apple rants whenever anyone suggests that they prefer Macs to PCs -- even when the preference is stated no more challengingly than, "Why, yes, I do own a Mac."

        I've been a Mac owner for about six years and a Mac user off and on for twenty. (I've also owned several PCs, running, at various points, Windows 2000, Windows 95, DR-DOS, Free
  • If Apple is just as bad as Microsoft OSs where are all the viruses and zombing? I sometimes leave my Mac logged onto the internet for days at a time. I take a deep breath everytime I log on with an XP system. I run spybot several times a day on my PCs and never have a problem with the Mac. Why all the obsession with degrading Macs when Macs have a history of security? Better to use it as an example to Microsoft why they need to improve their security.

    • Re: (Score:2, Insightful)

      by spxero ( 782496 )
      Only time will tell if Apple is just as bad as MS. While they are gaining market share, at what point do the vulnerabilities turn into money? 8%? 15%? 39%? (I'm going off of these figures [hitslink.com])

      With help from third parties (AV software (no, I'm not talking Norton...), firewalls, etc.) I think Windows is a LOT more secure than it used to be. I personally wouldn't trust MS by itself. But it all goes back to market share. No system is invincible, so why not go after the biggest and milk it for all it's worth?
  • The Mac community seems really histrionic in comparison to Windows...what's the deal here?
  • Not apple, these idiots that went to all this out of spite.

    Way to be adults. I don't mind the results of a more secure OS X, but this was entirely the wrong way to do it. Completely irresponsible and childish. Shame on them.

  • Why is this tagged FUD?? (Score:3, Insightful)

    by germansausage ( 682057 ) on Tuesday March 20, 2007 @11:49PM (#18425245)
    Some moron keeps tagging every story with a claim that may or may not be true as FUD.

    Please stop it.

    FUD has a very specific meaning. Pay attention - FUD stands for Fear, Uncertainty, Doubt. It is a marketing strategy that spreads, you guessed it, Fear Uncertainty and Doubt about a competitors product. Every statement you disagree with is not FUD. Not every untruth is FUD. Not all FUD is untrue for that matter.

    Thank You, that is all. /rant

    • Every statement you disagree with is not FUD.
      Welcome to Slashdot - it sounds like you're new here.

      For a lot of /.ers it's obvious that FUD = "anything I disagree with". And, if they have mod points, they replace FUD with "-1, Flamebait" moderations.

  • Are you fucking kidding me? (Score:4, Insightful)

    by LKM ( 227954 ) on Wednesday March 21, 2007 @05:22AM (#18426627)

    I thought Ou had lost all credibility by now. He's biased and stupid. I know that sounds harsh, but for heaven's sake, read his blog posts! He compared Apple to Nazi Germany, not even knowing how to spell Joseph Goebbels ("Joseph Gerbils [macalope.com]", I'm not kidding!), and he called Fox using a number he got in a confidential mail from Maynor [daringfireball.net]. I mean, geez!

    The people he accuses have gone on the record saying that Fox had not contacted them. Chartier says: [macalope.com]

    What a riot: no, I have never been contacted by Fox or anyone else from Apple regarding any of this stuff. In fact, I'm not even receiving those post-support call surveys or notices that my Mac warranties are about to expire and that AppleCare is an affordable way to stay within Apple's graces.

    This whole story only exists in Ou's head. Apple orchestrated nothing at all, the "researchers" discredited themselves all on their own, simply by claiming different, contradictory things at different times.

    George Ou is nothing but a Troll. Can we please just ignore him?

  • So called researchers. (Score:5, Interesting)

    by ThePhilips ( 752041 ) on Wednesday March 21, 2007 @07:07AM (#18427099) Homepage Journal

    I'm sorry to chime in with stupid comment. But sorry this is Slashdot so here I go ;-)

    I'm sick tired of such "researchers". Back in good old days they were simply called "testers" - and their job was look for bugs localize them and report to developers. Instead of reporting bug all they do is create a "sensation" or "scandal".

    Apple might not the best company when it comes to PR (actually probably second worst - right after Sony) but most of the problems gets resolved easily. And even then, most of the time Apple's PR reaction is ... right no reaction. The guys are used to live and work under piles of NDAs and very very rarely talk to press. Or rather they organize events if they want to announce something. (I'd rather give thumb up to Mac fan boys for smoking the so called "researcher" into clear. Because that what I believe took place.)

    Rise of Internet unfortunately attracted hunters for cheap publicity. And most of the so called "security researchers" are fit right into the category. They relate to research equally as e.g. Britney Spears relates to music.

    P.S. Disclaimers: Ex-Mac-owner. Linux developer. And yeah, I know how to write secure programs and what QA is.

  • Forget responsible exploit publishing? (Score:3, Insightful)

    by Lethyos ( 408045 ) on Wednesday March 21, 2007 @07:16AM (#18427131) Journal

    I am the worst (or best, depending on your point of view) kind of Apple apologist, but any attempt from any company to stifle, ignore, or deny security research is not just silly, it is reprehensible. Companies with products where security is a concern should always respond with acknowledgement of the research, credit to the researchers, and evidence proving the validity of the claim either way. Then, of course, release a fix in due time if necessary. These same corporate entities ask for courtesy from the security community in notifying them first of problems, but yet many still react negatively to this valuable community-provided service. For those who behave properly, this restraint should be afforded. For those who respond as Apple have done, the appropriate response is, I think, exactly what happened: a flurry of publicized of exploits without prior and exclusive notification. Proceding in this fashion creates an incentive to take security concerns seriously and disintentives to burry them.

Slashdot Top Deals

"The vast majority of successful major crimes against property are perpetrated by individuals abusing positions of trust." -- Lawrence Dalzell

Close