Mac Hack Contest Redux 164
narramissic writes "Remember the controversial Mac hacking contest from last year's CanSecWest conference? No? Here's a refresher: Conference organizers challenged attendees to hack into a Macintosh laptop, with the successful hacker winning the computer and a cash prize. Winner Dino Dai Zovi found a QuickTime bug that allowed him to run unauthorized software on the Mac once the computer's browser was directed to a specially crafted Web page. Well, the contest is back again this year, but with a twist, says Dragos Ruiu, the principal organizer of CanSecWest: 'We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.""
easy (Score:5, Interesting)
how about a taste test (Score:2, Interesting)
out of the box linux? Is there really such a thing? Ubuntu OEM, knoppix? That's a pretty wide range here.
I'd like to see stats on effort per platform (Score:5, Interesting)
We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.
What I'd be most interested in is a survey of contestants as to their platform experience, and how focused they intend to be on attacking the different platforms. That part could be wildly unscientific, but could be interesting if everyone answers openly.
Couple that with some good logs of network activity, to see how focused attacks are on the various systems.
For example, it could turn out that nobody goes for the supposed low hanging fruit, and everyone tries to target the Mac...or an OpenBSD box, if they bring one. Etc.
Re:"fair" would be "what users need" (Score:4, Interesting)
I think this is an excellent point.
Default windows configuration is defaulted to... well, a very compatible set of options.
Not having actually done a Mac install, I don't know what the default is.
A default Linux partition, depending on the flavor, could be pretty minimal...
Here's what I think would make it more fair: make all the operating systems able to do the same things. Presumably, the normal Mac user, at some point, will want to opens a windows media file and an Office 2007 file. The typical Windows user will use quicktime at some point, and thus have it installed and have its possible security holes, too.
Otherwise, I could create a Linux distro that is THE safest operating system EVER... and just not let you do anything, no network connectivity, etc. Pretty safe! And useless.
OSX, Linux, Vista (Score:2, Interesting)
OSX is first because apple has been hideing behind security by obscurity for too long. I have seen no evidence that suggests OSX gets it any more than Microsoft did.
Linux next because source code is avaliable... and while clever hits without source are sometimes easier you just might get lucky walking the ususal paths and find something exploitable.
MS has been more or less awake from the security perspective for years now and most of the expliot efforts have been targeted at this platform which raises the bar for discovery of new expliots because all the trivial vectors have already been probed. Following the same line windows expliots are simply worth more than OSX or Linux expliots. Good ones can be worth a room full of PCs if you can find the right buyer.
Applications such as browsers, media players, and various popular plugins
Besides a PC is a PC... you can always reformat the drive and install Solaris if you want
Re:What about Quicktime? (Score:3, Interesting)
Re:Vista would be first (Score:3, Interesting)
Oh, I'm sure Linux boxes are subject to attacks as well. I just think, as a nefarious writer of cracking software, you'd have to believe your time is better spent cracking Windows than Linux. And I don't believe servers are the most profitable boxes to hack anymore - keyloggers to swindle online banking users are probably the big moneymakers.
Re:Default Install (Score:1, Interesting)
Some ways of doing it are:
1. Windows Vista as per release date shrink wrapped copy, Ubuntu as per most recent internet downloaded copy. Result: Vista has a lot more bugs, especially the exploits that have been published and fixed. Ubuntu will use the very latest patches and have none. Argument in favour: The 'idealised new customer experience' is reflected. Argument against: The 'quality of programming' at either the point of Vista release or at the present is not reflected. Is there an 'idealised new customer' who does not get a patched version from Dell, or store-buyer who does not run Windows Update as prodded to many many times by the OS?
2. Windows Vista as per release date shrink wrapped copy. Ubuntu as per internet download availble on the date Vista was released. This would not reflect any 'idealised new customer experience', but would reflect a 'quality of programming at that point in time' measure to some rough degree. The problem is, which unpatched version of Mac OS/X would be used? The one released at the earliest date BEFORE Vista, or at the earliest date AFTER Vista, and why should Vista's release be the yardstick?
3. Windows Vista patched to the latest date. Ubuntu patched to the latest date. Mac OS/X patched to the latest date. This would not reflect an 'idealised new customer experience', but would come close to reflecting a 'quality of programming at the present' measure together with an 'average user' experience (considering how many get moderately patched versions when they buy it). When Vista SP1 is released, will e.g. anyone buying from Dell have a 'first user' experience WITHOUT SP1?
I'd say 3 is the best, because, although 1 is tempting because it clearly increases the likelihood that Vista will be hacked first, the 'idealised first user experience' that it claims to justify its case is unlikely to exist.
As for the choice of distro - you could always have several teams working on Vista and Mac OS/X computers, and one team for each distro.
Re:too easy (Score:3, Interesting)
Re:TFA doesn't say (Score:5, Interesting)