![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Businesses Businesses](http://a.fsdn.com/sd/topics/business_64.png)
![Operating Systems Operating Systems](http://a.fsdn.com/sd/topics/os_64.png)
![Software Software](http://a.fsdn.com/sd/topics/software_64.png)
![Windows Windows](http://a.fsdn.com/sd/topics/windows_64.png)
![Apple Apple](http://a.fsdn.com/sd/topics/apple_64.png)
![Linux Linux](http://a.fsdn.com/sd/topics/linux_64.png)
Mac Hack Contest Redux 164
narramissic writes "Remember the controversial Mac hacking contest from last year's CanSecWest conference? No? Here's a refresher: Conference organizers challenged attendees to hack into a Macintosh laptop, with the successful hacker winning the computer and a cash prize. Winner Dino Dai Zovi found a QuickTime bug that allowed him to run unauthorized software on the Mac once the computer's browser was directed to a specially crafted Web page. Well, the contest is back again this year, but with a twist, says Dragos Ruiu, the principal organizer of CanSecWest: 'We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.""
easy (Score:5, Interesting)
how about a taste test (Score:2, Interesting)
out of the box linux? Is there really such a thing? Ubuntu OEM, knoppix? That's a pretty wide range here.
Re: (Score:2)
They are all common operating systems and they all fulfill the same purpose.
Although they'd probably have to do a handful of Linux boxes to ensure that problems aren't distro specific.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Funny)
Prediction (Score:3, Funny)
Wrong! (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
Hey it is a possiblity. I ain't taking bets on who will be first to be broken in.
Linux being Open Source having the ability of some hacker checking the code and use a volnerability that was just open reported. May not be useful for a large scale hack but for the contest it just might work.
Max OS may have some old Unix volnerability That has never been fixed. Or one of the new features that allows remote access say via iChat may allow a back door.
Windows while h
Re:Prediction (Score:5, Funny)
Re:Prediction (Score:5, Funny)
Re:Prediction (Score:5, Funny)
Default Install (Score:5, Insightful)
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms.
Just to make it "fair".
Re:Default Install (Score:4, Insightful)
Comment removed (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Informative)
When you buy a mac, it comes with iLife and Quicktime. Both are made by Apple. Both are pretty fundamental to macs providing quite a lot of functionality out of the box.
Even if you delete Quicktime.app, the quicktime framework
Re: (Score:2)
iLife being fundamental to providing functionality is a bit off though. You could argue any PC manufacturers bundled apps are fundamental to providing that functionality out of the box too. In the context of comparing the base operating systems its a bit unfair to include iLife but exclude whatever equivalent suites Sony / Dell / HP /
Re: (Score:3, Informative)
Since you've heard, the number of OpenBSD remote exploit holes doubled
"fair" would be "what users need" (Score:5, Insightful)
Vista installed from DVD default/recommended choices where possible on installation screens. Same with Ubuntu, and Mac OS/X. Any deviations noted. Any extra software installed must be available on all three platforms. Just to make it "fair".
When is the last time you left an OS in its default configuration?
A fair configuration is one in which all tested operating systems provide as identical as possible feature sets, including all the features the majority of people like to use. Like printer and file sharing, for example.
It's also not fair to include, for example, NoScript- that breaks a ton of websites out of the box until you whitelist sites. Likewise for not including Flash as part of the package. An even more relevant example: the necessary firewall rules to allow IM (and file transfers.)
Re:"fair" would be "what users need" (Score:4, Interesting)
I think this is an excellent point.
Default windows configuration is defaulted to... well, a very compatible set of options.
Not having actually done a Mac install, I don't know what the default is.
A default Linux partition, depending on the flavor, could be pretty minimal...
Here's what I think would make it more fair: make all the operating systems able to do the same things. Presumably, the normal Mac user, at some point, will want to opens a windows media file and an Office 2007 file. The typical Windows user will use quicktime at some point, and thus have it installed and have its possible security holes, too.
Otherwise, I could create a Linux distro that is THE safest operating system EVER... and just not let you do anything, no network connectivity, etc. Pretty safe! And useless.
Re: (Score:2, Informative)
Re: (Score:2)
Anyway as others have said OS X has flash and javascript enabled and installed in the browser, quicktime, itunes with streaming music, mp3, pdf, dvd, burner support. Can show docs maybe (?)
I think default is the only way to test this however. If one os does more bad luck for it. Just take some regular/useful Linux dist.
Re: (Score:2)
Personally I see a ingoing firewall as rather useless since you shouldn't be running services you don't need anyway, and if you need them blocking them out isn't t
Re: (Score:2)
Oh, I dunno... http://tinfoilhat.shmoo.com/ [shmoo.com] It has its uses.
Re: (Score:1)
What about Quicktime? (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2, Informative)
Re: (Score:2, Funny)
Re: (Score:2, Funny)
What will be the GNU/Linux prize? (Score:5, Funny)
Re:What will be the GNU/Linux prize? (Score:5, Funny)
Fixed.
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Cool. (Score:1, Insightful)
Like I always say, "anything made by a human can be broken by a human".
Begs The question (Score:3, Funny)
When vista inevitably goes first, who is going to want it? I assume it must be a good enough computer to actually run vista, so lets all take guesses at the OS loaded onto it after it's "pwnd".
It doesn't beg any question... (Score:2, Funny)
Re: (Score:2)
Potential for rigging (Score:1)
Re: (Score:1, Informative)
Re:Potential for rigging (Score:5, Insightful)
Re: (Score:2)
This is kind of a silly contest. Fun but silly. It might be more fun to see which OS annoys the user enough to launch the CPU across the room.
If you really want to know what happens from a security standpoint, just connect them all to the Internet and wait. That's real world for you. Even if Linux or OS X does get hacked first, there's a lot of catching up to do before anyone can say "see, it's just as insecure as windows".
Re: (Score:2, Funny)
I don't know about you but when I'm annoyed I don't have the patience to remove the case, CPU cooler and finally the damn chip itself just to throw it around.
Re: (Score:2)
And thus another window into how I don't think like some other people. Sure I guess the idea is possible - but to instantly assume all actors are bad actors shows a fundamental distrust of humans I find frightening.
Re: (Score:2, Insightful)
Obvious misleading conclusions (Score:5, Insightful)
This "twist" is bullshit.
Re: (Score:1)
H.
Re: (Score:2)
I feel a better way would be to run the tests consecutively rather than concurrently.
So you take your room of hackers, and you let them loose at a Vista box. Once that's cracked, you end that test. Then you let them loose at a Mac. Rinse, repeat.
The "Winner" would be the group that managed the fastest crack overall.
Re: (Score:2)
Brute force attacks taking a long/short time using a generic fuzzer do not count as extra/less effort.
Poor subnet (Score:2)
Re: (Score:2, Funny)
I'd like to see stats on effort per platform (Score:5, Interesting)
We're thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first.
What I'd be most interested in is a survey of contestants as to their platform experience, and how focused they intend to be on attacking the different platforms. That part could be wildly unscientific, but could be interesting if everyone answers openly.
Couple that with some good logs of network activity, to see how focused attacks are on the various systems.
For example, it could turn out that nobody goes for the supposed low hanging fruit, and everyone tries to target the Mac...or an OpenBSD box, if they bring one. Etc.
Lopsided... (Score:2)
I'll predict that Vista goes down first, because there are more Windows programmers out there than Mac/*nix. Time-to-first-hack isn't a valid measure of OS robustness.
That probably won't be a popular statement here on
Re: (Score:3, Insightful)
Besides, that involves a logical fallacy. Basically be your statement to be true, they must ahve the same architecture, developed by people od equal skill use the same project management style and the same QA.
Re: (Score:1)
Re: (Score:2)
Rare? Diamonds are rare, yet I see them daily.
Are you saying the same class of exploit that is used to infect Windows users every day is not significant on OSX?
One uses an exploit to potentially cause an infection. If it doesn't spread, well, that doesn't really say much about the exploit.
But I am really interested in the outcome of the contest, especially what they will consider as a 'default' install and 'default' configuration.
Re: (Score:3, Informative)
Diamons aren't rare, only the stupid really believe this - why do you think diamonds are rare, because they are marketed to you as such. Diamonds are carefully controlled, so they a huge amount don't flood the market, but that doesn't make them rare.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It was (past tense because Apple patched it in 2006) strictly a local exploit, and therefore of negligible risk. This is why the same milwOrm.com site lists a bunch of them for other UNIX variants that have excellent security records, e.g. AIX, Solaris, and HP/UX, and even QNX.
"Mac OS X simply has not been a valuable enough target in the past to be attacked in a meaningful way."
Or perhaps it's due to the fact that milw
It would be more interesting to have (Score:2, Insightful)
A new rule (Score:1)
Vista would be first (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Oh, I'm sure Linux boxes are subject to attacks as well. I just think, as a nefarious writer of cracking software, you'd have to believe your time is better spent cracking Windows than Linux. And I don't believe servers are the most profitable boxes to hack anymore - keyloggers to swindle online banking users are probably the big moneymakers.
Re: (Score:1)
Re: (Score:2)
Different class of exploit.
Your average Vista install's destiny is to become part of a botnet. That doesn't requre the type of remote cracking that's being set up in this test, just a trojan embedded in a shiny cursor app.
Windows botnets tend to be herded by Linux servers which have been individually cracked, which is what this test is about.
*BSD! (Score:2)
Hehe. Let's see them try to pwn that one.
Re:*BSD! (Score:5, Funny)
Please turn in your geek card on the way out.
http://en.wikipedia.org/wiki/Image:Unix_history.en.svg [wikipedia.org]
TFA doesn't say (Score:5, Funny)
Who is operating each machine? I need their email addresses. I want to send them some programs, and my "hack" is that the programs will come with instructions to the operator: please execute this attachment.
My understanding is that for Windows, I just need to have the filename end with .exe. For MacOS, I need it to end with .dmg. For Linux, I need to train the user how to use chmod.
Re: (Score:2, Funny)
Can't wait to see those vacation pictures!!!
Ahhh f*ck.
Re: (Score:2, Informative)
stupid test (Score:2)
it measures the stupidity of the user
your program can be a one liner on any of the machines.
just a freaking script that says "delete *.*"
or you coudl see who has passwordless sudo and go sudo rm
and that will do on any *nix pretty much
again we are testing the OS not the STUPID USER AT THE WHEEL
Re: (Score:2)
Relax! Stress prematurely ages people.
Re: (Score:2)
I think I will do just that.. except i may have to steal someone elses roommates organs since I dont have a roommate
i could have sworn the parent was +5 insightful which incited my response
Re:TFA doesn't say (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
OSX, Linux, Vista (Score:2, Interesting)
OSX is first because apple has been hideing behind security by obscurity for too long. I have seen no evidence that suggests OSX gets it any more than Microsoft did.
Linux next because source code is avaliable... and while clever hits without source are sometimes easier you just might get lucky walking the ususal paths and find something exploitable.
MS has been more or less awake from the security perspective for years
Kobayashi Maru (Score:1)
Re: (Score:1)
GNU/Linux... which distro will they use? (Score:1)
Re: (Score:2)
I don't understand this "uncrackable" part. OpenSSH is on the livecd. Most admins ssh into the box to set it up... leaving ssh open to all. On the current live CD, OpenSSH is pretty old.
I recently installed Gentoo on my new AMD64 X2 5200+ (65nm/65W). Took about 3-3.5 hours to: partition, install the base, install grub, compile a kernel(took about 3 mins for the kernel, another 10 for modules), boot into new install, upgrade portage
To make it fair. (Score:2, Insightful)
Me thinks... (Score:1)
These contests provide limited information... (Score:2)
Aw, man... (Score:2)
On your marks, get set (Score:2, Funny)
It's just a game. (Score:2)
Re: (Score:1)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)