MacBook Hacked In Contest Via Zero-Day Hole in Safari

EMB Numbers writes "Shane Macaulay just won a MacBook as a prize for successfully hacking OS X at CanSecWest conference in Vancouver, BC. The hack was based on a Safari vulnerability found by Dai Zovi and written in about 9 hours. CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions. 'Dai Zovi plans to apply for a $10,000 bug bounty TippingPoint announced on Thursday if a previously unknown Apple bug was used. "Shane can have the laptop, I want the money," Dai Zovi said in a telephone interview from New York. TippingPoint runs the Zero Day Initiative bug bounty program.'"

switcher

that's it! I'm switching back to Windows!

Explanatin of rules relaxation

CanSecWest organizers actually had to relax the contest rules to make the hack possible, because initially nobody at the event could breach the computers under the original restrictions.

In other words, nobody was able to remotely hack the machine, so they allowed for local exploits, which someone used in a Safari URL.

Expect Apple-haters and other FUDmeisters to completely ignore the difference, like InfoWorld did yesterday in their breathless headline about "remotely breaking in."

Re:Explanatin of rules relaxation

InfoWorld Publishes False Report on Mac Security [roughlydrafted.com]

"Nancy Gohring, writing for InfoWorld, delivered a misleading report yesterday on a Mac security exploit contest held at the CanSecWest conference in Vancouver, BC.

"In her defense, it appears likely that Gohring did not write the headline for her InfoWorld article, which described the contest winner as being "able to remotely break into a Mac as part of a contest designed to illustrate security flaws in OS X." That part was simply wrong.

"Whoever did write the headline must have been smoking weed in celebration of 4/20, because Gohring's article clearly described a local exploit. There's a big difference between the remote exploits that made Windows infamous for its insecurity and a local exploit of an application."

More info under a series of subheadings:

Gohring's Mac Security Myths
Microsoft's Security Embarrassment
Mac OS X and Security
The Mac Minority Malware Myth
Why Macs Aren't Sending You Spam

So, if I reaf TFA correctly:

The machine couldn't be hacked, so they relaxed the rules so it could be? I wish they'd been more explicit as to what 'relaxing the rules' meant. But maybe that would've spoiled the story.

Re:So, if I reaf TFA correctly:

If I recall correctly, originally the requirement was remote access, but when that went nowhere, they allowed entrants to submit URLs that would be navigated to via Safari. Check out Engadget for more details...

Re:So, if I reaf TFA correctly:

As I understand it:

The rules originally required getting a user shell on a macbook connected to a wireless router without any other access, or getting a root shell under the same conditions on a second macbook without using the same bug.
The prize was the macbook(s) you hacked.

But they decided not enough people were interested, so 3Com added a $10,000 bounty for a winning bug.

But no one could crack it, so they set the machine up to visit malicious web pages submitted by email.

Then someone found a bug in Safari, and successfully crafted a webpage to exploit it to get user shell access.

Admin user or regular user?

I wish they would say if the user that safari was running under was admin or regular. If it was admin then this is even less of a hack than it already is. Also I wonder if they disabled the safari feature to automatically "open safe files after downloading". That option puts a lot of trust in other programs not to have holes. indeed it's not really safe at all. Only stupid people or people that don't do stupid things leave it on.

Bottom line no remote hacks.

Re:Admin user or regular user?

From one Mac user to (presumably) another, please get your head out of the sand. These "stupid people" to whom you refer you might otherwise know as "The Rest of Us." It doesn't matter how technically competent you are, we are all "stupid" every now and then—or do you only ever visit the same two or three well-known sites every day? Even if you do, how can you be sure they haven't been compromised by, say, some sort of injection attack? Or even by an unscrupulous advertiser in an iframe?

And why on earth does it make a difference whether the user account was admin or regular? If an intruder has access to your personal documents, you're just as fucked either way.

Re:Admin user or regular user?

because you can encrypt your personal documents, and if many users are on it only one of them gets hit.

However, if someone has access to root, they can do a lot more malicous things. bots, keloggers, etc...

Re:

(1) FileVault won't help you here, since an intruder gaining Safari's privileges (e.g.) has access to everything Safari has access to, namely, your entire home directory. Besides, do you encrypt your entire home directory?

(2) You don't need root to launch

Re:

Interesting that your sig:

You are coming to a sad realization. Cancel or allow?

skewers that very behavior of Safari you describe [third-design.net]. Of course, if you have "open safe files after downloading" turned off, it's even more obnoxious—you have to find the

Re:

...you have to find the file on your desktop and open it manually. Exactly the sort of repetitive task I thought my computer should be doing on my behalf.

Or you could double-click on the file's icon in the Safari downloads window. If you really wan

The "never opened before" dialog is good.

I'm not exactly sure what the default settings are like, because honestly it's been years since I've used a Mac that was in its out-of-the-box, default state, but the way I have it right now, the only warning I get is when I'm about to open an application

Re:So, if I reaf TFA correctly:

The Register is a little more informative in that regard, from http://www.theregister.co.uk/2007/04/20/pwn-2-own_ winner/ [theregister.co.uk]

The pwn-2-own contest got off to a slow start on Thursday. The rules originally mandated an exploit that required no action on the part of the user. The reward for a successful hack was the machine that had been compromised. Conference attendees were underwhelmed, reasoning a Mac exploit that required no end-user interaction could be sold for upwards of $20,000. Things changed significantly on Day 2. That's when Tipping Point upped the ante with its promise of a $10,000 bounty. Contest organizers also relaxed the rules so exploits could include malicious websites that attacked Safari.

no such thing as a white hat...

...is there?

I mean - I can only assume this was a 'white hat' hackers conference, given there was actual publicity given and a public bounty and such. But then things like these pop up?

"'Shane can have the laptop, I want the money,' Dai Zovi said in a telephone interview from New York"
"Conference attendees were underwhelmed, reasoning a Mac exploit that required no end-user interaction could be sold for upwards of $20,000."

Makes me think.. black hat, white hat.. what's the difference these days? I thought a white hat hacker was the 'good guy' (albeit still a hacker).. the kind of person who hacks for fun / curiosity.. the kind of person who notifies the developer of the bug or, at least, just makes the bug known to the world at no charge. Not the kind of person who hacks, then scours the 'security conferences' for a bounty, and when that bounty is lower than what they could get off of actual 'bad guys', complain that the bounty is too low. To me, that just sounds like the person is a black hat, but dons a white hat on top in an attempt to fool us into thinking they're white hat.

Re:no such thing as a white hat...

Okay, maybe a black hat tendency, but there might be alternatives.

There are plenty of security companies out there legitimately trying to sell their software, plenty of people who would love to be the only ones who have a defense against some secret hack. If you want me to spend time finding a vulnerability and then into writing an exploit, my time would not come cheap. I'm not even talented in that direction. Imagine that you're a security researcher who gets paid for your time investigating and resolving potential security breaches, what kind of payoff makes it worth investing your time in that gamble? It has to be a pretty penny or else you're better served doing what you do for a living.

"Give me the money" is a legit response when you've invested your time and effort into something with that as your goal. If he'd said "I don't hack for fun or evil, I only did this for the contest and expect to be given what I was promised" then I don't think you'd have the same take. There is a good chance that is exactly what he meant too. You might be shocked to learn that a lot of us who are considered computer geeks are not the world's foremost verbal communicators.

I love my job, but I won't work here long after they stop paying me.

Re:

Relaxed rules = they gave out the root password and let them sit at the keyboard for a while.

Re:

The intent was always that the rules would be progressively relaxed - see http://www.securityfocus.com/archive/142/464216/3 0 /0/threaded [securityfocus.com] from last month.

Konqueror

Safari's rendering engine is based on KHTML. So is Konqueror affected by this flaw as well?

Re:

Thats a good question. There's a good chance it could be. Then again with the speed that updates/patch's/fix's come out for Linux, if it does it'll be fixed in a relatively short time.

Re:

WebKit was forked from KHTML and developed internally at Apple for about a year before Safari was released. Then the patches were all sent back in one big lump. During this time, the KHTML team cleaned up the code a lot, and had to go to a lot of effort

Read a better article than the one linked.

The MacBook was actually only hacked because they lessened the rules and actually had someone open Safari and use a malicious website. No ports were closed nor was the firewall running.

This seems a little sensationalized...

I'm a Mac user and as such I'm not claiming invincibility although the "Unix" like foundation makes me more secure its still the end user's responsibility to not run as admin or God forbid root. Not to mention using a good firewall or correctly configuring the one that's already built in is vital and just practicing caution on the web. That aside I just don't think this is entirely honest, I wish they would disclose all the variables involved to include all settings used. But as others here have said considering Apples foresight using open source means the between Apple and the Konqueror devs this will be quickly addressed. But my gut feeling here is that something stinks in Denmark!

there are some weird things in Safari...

Safari lets you include local files, for example...

i told apple (and got a lame reply that it would be fixed eventually) month ago, yet it still works.

see http://destabili.zation.eu/ [zation.eu] for a quick harmless example that can check what applications you got installed.

and then there is a way to crash Safari which exists for more than a year - again i had an email conversation where they wanted more info and crashreports - yet nothing was ever done about it.

http://lixlpixel.org/safaricrash/ [lixlpixel.org] and follow the instructions - but make sure you don't have any important tabs open...

What I want to know

How was the machine configured relative to an off-the-shelf OSX installation?

While I understand that for the purposes of the contest it might have been necessary to reduce those protections, I think that before something becomes "news" we should know what the real risk is.

Does this hack require the user to manually disable protections the OS ships with, or manually enable services that default to off? The article seems light on detail.