Mac is the first to fall in Pwn2Own hack contest

Mac OS X Firewall

I am a Mac user, so I suppose that does make me a fanboy, but not a rabid one.

OS X does have its faults, as do all OSs and as many have already noted.

BUT, in an attempt to get some rationality into this debate, consider this:

1. Mac OS 10.5.2 comes, by default, with the Firewall switched off, as has been the case with all previous versions of OSX.

2. From the competitions web site:

[Question] Anonymous commented on 2008-03-27 @ 19:26

"Are the OS installs left in default configurations, or are some settings turned on or off by the organizers?"

[Answer] ZDI commented on 2008-03-27 @ 19:54

"All platforms are left in their default configuration, as if a normal desktop user were operating it."

3. (Miller) said he chose Apple over the other machines because "I thought of the three it was the easiest."

Well who wouldn't think that a machine with a disabled firewall was the easiest target for a remote telnet exploit!!? The easiest $10k possible, plus a free Airbook to boot!

4. Why in God's name Apple does not make the Firewall default "On" has always baffled me.

Meanwhile, it seems that the competition is fundamentally flawed, if the Vista and Linux machines have their firewalls on by default.

@brimful

"no but it does mean you'll be 'safer' "

A fine example of faulty logic. In the same way that saying the guy the train hits first will be 'more dead' than you. The end result is quantifiably the same.

It is impossible to claim (and idiotic to try and claim) that one platform is absolutely more secure than another, because it is impossible to accurately measure.

Only if every computer user had a Windows machine, a Mac OS X machine and a Linux machine side by side at all times, and only if every hacker dedicated an equal amount of time to hacking attempts on all 3 platforms, would we be able to make any judgements of absolute security. In the real world, one can only judge the *effective* security of a given platform, which is, of course, influenced by many factors including, but not limited to, installed user base.

The fact that there are many, many more Windows users does not change the empirical FACT that there are many, many fewer security vulnerabilities, viruses etc. on the Mac OS X platform. The platform is EFFECTIVELY more secure. I am statistically LESS LIKELY to suffer a remote attack on a Mac OS X machine, than on a Windows one.

Claims that I would at just as much risk if there were as many Macs and PCs is meaningless drivel, when that is patently not the reality in which we live.

Obviously, as the Mac OS X platform gains market share, it follows logically that it is likely to suffer more attacks (successful or not). What will be interesting is whether the number of attacks grows *proportionately* to its market share. Currently, that is not the case. Regardless of where you peg the Mac's market share (dependent of territory, demographic, direction of wind etc.) it cannot be denied that its level of actively exploited security flaws DOES NOT correlate to its market share. This may well change in the future.

It does not change the fact that, right here and right now, I am safer using a Mac than I am using a Windows PC. It may well be that I would be safer still using a Linux PC, for exactly the same reasons.

thank god

as a long time mac user (and other Os's daily), i am glad this has finally happened and levelled the playing field.

Now people might wake up to the fact that all OS's have security holes.

The only thing all computers have in common is the dumbo at the keyboard, effectively, the 'nut holding the wheel'

Apple needed this wake up call.

And users need to be educated more then ever.

I got a call the other day from a client telling me that a virus got past my filtering and going mad. Turns out an email with a link came in and someone click the 'Free Porn' link. I am still amazed that this happens. surely all employees are told first day : "DONT DO THIS."??

oh, and windows users suck !!! LOL

Glass houses etc.

http://www.theregister.co.uk/2008/03/28/memory_sniffer_unveiled/

Who needs remote exploits when Windoze and Linuz are giving you"Boatloads" of passwords...

I'll be running my C64 with tape drive....

switch back?

osx is full of holes

I for one, am surprised the Mac went down first

Only because of the 50 or so Mac users I know, not a one of them could write a "Hello World!" program to save their lives.

Imagine, a computer literate Mac user! Who'd have thought?!?!?

Apple users tears taste so good

It was hacked first because it was the easiest.

Trust that with $10,000 on the line, anyone would hack a linux or windows machine. Its friggin $10,000 dollars. People tried all day I'm sure.

The point is OS X users think they are invulnerable and are using some sort of 'super' computer. The truth is with a 3% market share (what 4% maybe?) who cares about them. As a hacker I would attack the two most common machines on the internet. Windows and Linux.

I would primarily hack linux hosting boxes considering they are more likely to have high-speed connections and not slow ass cable or DSL connections. They will reside online 24/7 and never be restarted.

I also know that the term "Root Kit" doesn't come from gaining "Administrative" privileges on a Windows computer - considering 'root' doesn't even exist on the O/S.

Also to give people an idea of how well this mac exploit would work:

1. Setup fake links

2. Tail your Apache log file

3. Telnet to any machine that has clicked your farm of links.

4. Execute code freely.

That sounds even easier then forcing someone to download and install a peice of shitty shareware filled with spyware.

@ Inspector_Morse

And the fact that Apple have the firewall turned off is supposed to be a mitgating factor?

Just makes them look even dumber TBFH

Re: Get a PC !

I think that all the new Macs are just a PC in fancy packaging with a different OS on them. ;)

Flame away!

FFS Mac Fan boys shut the f**k up

you go on and on and on

and yet when dear old bill gates beats you (its happended before lol) you cant take it.

OSX this day is more insecure than Windows and Linux.

Its not hard to get your head around.

For all that c**P about picking OSX becuase he wanted the mac or something, for god sake hed get $10k no matter which machine he get into.

And if I wanted to win, I'd pick the easiest box to break!

Morons

Sorry, have to do this...

But having a user click on a link to a web site is hacking? From the original article, I was under the impression that these three laptops were sitting there - with no user intervention - and the attacker walks up to the table, connects with a patch cord, and has to come up with an attack RIGHT THEN AND THERE. What gives?

I suppose if the generic definition of (computer software/OS) hacking is deemed to be "gaining unauthorized access or perimssions within an OS through a flaw in the OS or a process running within it", then this would meet the definition.... but geesh. I was expecting something better than "exploiting" a user's idiocy. I mean, what's the challenge?

Secondly...

@ Ian Davies:

"Claims that I would at just as much risk if there were as many Macs and PCs is meaningless drivel, when that is patently not the reality in which we live."... "it cannot be denied that its level of actively exploited security flaws DOES NOT correlate to its market share. THIS MAY WELL CHANGE IN THE FUTURE." [Emphasis added]

I appreciate your attempt at a balanced argument, but you wipe away that the credibility for the basis for your own argument at the end, there. At no time before has such connectivity been applied to so many computers running an OS with MS' market share. There is simply no logical or historical comparison of any kind for any data to make a logical assertion.

Any and all arguments based on market share as a factor of "exploitability" or security have no way of comparing any two (or more) flavors of OS with any validity, though it does provide an intellectual "thumb and blankie" to all advocated (both for and against) so they sleep better at night.

Halloooo!!!

..In the interest of good journalism.

Are we sure that ANY kind of code was executed on the Mac?

I smell a rat here and not because I am any Mac Fan but because my idea on how telnet works would have to change radically.

Has anyone gone looking what this exploit actually does?

As I mentioned before: by looking at the specific exploit it does not seem to open any possibility to execute any code on the Mac itself.

I am still not convinced. Anybody?

Mabuse68

Secure?

@Paul Buxton - What? Out of all the idiots here, you're the best ...

I'm a Gentoo user, I don't think it's perfectly secure. And unless you are quite delusional I don't think many Linux users believe that. Just MORE secure (even if it is just due to less people trying). Okay, most confess I don't run a S/W firewall, I don't use any mainstream desktop so I couldn't find an easy way of setting one up in the past. It does seem to be a failing of many *nix packages. It only works with this major desktop, or that one. How about starting generic and then polishing?

The biggest issue isn't with what bugs are found, it is how long it takes for the exploit to be stopped. Unfound bugs aren't a problem, bugs found and patched in a couple of days are a very little problem, bugs left open for a long time are near criminal. The average user? Well, the OSs own security issues pale in comparisson.

Not really a Safari issue?

I first thought this was a damning indictment of Safari, a non-battlehardened browser, then I realized that the ability to reverse telenet into a PC wasn't browser-based, but OS-based.

OUCH!

So OS X allows remote telenets from TCP-IP sessions it has established without further verification of the other party, eh? No additional log-ins needed?

That is a gaping hole, a whole lot of hole, if that is truely the case.

Bad flaw Apple...very bad flaw.

Apple Fan-bois disappear up own Arse first

I can't believe the apple fan-bois trying to defend an indefensible position here. Your machine got hacked first and the reason given is "that its more desirable". Bullshit. Your machine got hacked first because it was the easiest to hack. Apple is worse than Microsoft at patching security problems, and Microsoft isn't what you would call good. Linux is full of security holes - I've seen friends who are top notch Linux experts still get their servers rooted. All Mac-OSX is is a crippled and badly patched version of Linux, so no surprise they got rooted first.

Of course, I'm expecting the fan-bois to come on and argue vehemently that black is white. Sorry to burst your bubble, but Apples are nothing more than crippleware on expensive hardware. The expensive hardware helps a little with stability, but the software certainly doesn't.

Get a life and stop blindly worshipping at the temple of jobs.

@Steven Hewittt

The C64 reference, the paris icon and the general tone not enough for you?

Let's see you hack my C64 with your fancy firewiring doo-hickey...

@Anonymous Retard: OSX != GNU/Linux

OSX is NOT Linux based! It is *BSD based. A mutilated, crippled BSD, but BSD nonetheless. There IS a difference, you know.

@ Steven Hewittt

wasn't there some way to crash a C64 by touching a bare wire between two pins on the cassette DIN socket? bwaaaaahahahahahaaaa....

I'd like to teach the world to sing

Blu-ray vs. HD-DVD,

Windows vs. OSX vs. Linux,

Religous arguments have nothing on the bile that comes out when technologies collide.

Somewhere off in the mists of time there are two cavemen arguing over who has the pointiest stick....

Re: I'd like to teach the world to sing

Alan Wray: "Somewhere off in the mists of time there are two cavemen arguing over who has the pointiest stick...."

Flaked flint FTW!

Ground basalt users 4 extinction!!

Will some of you listen to yourselves

Bickering over which OS is better.......they are simply a means to an end.

Which ones better.....the one I can support which gives me the biggest wage packet.

Remember this 'Without problems you would not need solutions'. This can be translated to 'Without broken OS's and PEBKACs issues I and many more people would be unemployed'

PEBKAC = Problem Exists Between Keyboard and Chair

Paris cause I would like to give her a good crack

@Alan Wray

"...two cavemen arguing over who has the pointiest stick...."

...to say nothing of the longest.

@Damien Jorgensen

Any computer, regardless of OS, is as secure as the user/administrator makes it. Given the time I'm sure a regular Windows/OSX/Linux admin could make their chosen OS installation as secure as admins of either of the other two could do.

FFS lighten up, I use all three OSs regularly (albeit mainly Windows XP, not Vista, and OSX) and they all have their merits and flaws, they all have their place, this simply demonstrates that the default configuration of the Mac is dumb. Apple should use this wake-up call to harden up the default configuration somewhat.

POETS day - I'mm off now, hence the jacket.

Hm...

I don't like OS X, don't care for Macs. Disclaimer done. But...

Very few seem to have read the article with care (and all I can go by is what's in the article, so this might be wrong), judging by the very few comments mentioning that:

*No OS was cracked in the first day.*

What is the logical conclusion from that? To me, it seems like: **even without a firewall** OS X still did not get broken into. The other two didn't either, of course, but they had an extra layer of security.

So, all three OSs withstood a day of attack. Applications, that's a whole other world. So it seems like Safari sucks mightily, that's the only thing we can say for certain here.

@ J

Quote from article:

[Not a single attendee entered the contest on day one, when all vulnerabilities had to reside in the machine's operating system, drivers or network stack.]

...and again, incase you missed it:

[Not a single attendee entered the contest on day one...]

...then, just once more for luck:

[Not a single attendee...]

So, who did you say hasn't read the article with care?

most desirable? - fanboys fail reading again

the bloke said "I thought of the three it was the easiest".

he did not say "I thought of the three it was the most desirable"

cue conspiracy rantings.... now!

OSX v Linux v Windoze v whatever

Ah, reading this thread is amusing: First I read this:

"All Mac-OSX is is a crippled and badly patched version of Linux, so no surprise they got rooted first."

and then someone points out the obvious:

"OSX is NOT Linux based! It is *BSD based. A mutilated, crippled BSD, but BSD nonetheless."

Funny thing being that OSX amongst the average joe is seen as "Linux with a pretty UI", as the *BSD's are not known beyond the IT spheres of influence.

IIRC, there are a lot of rabid *BSD fans out there, maybe that attitude permeated to the Mac crowd with OSX? .... no, that would discredit Jobs' reality distortion field ;) Not that the *BSD's don't have a Jobs-like poster, just search for the "Linux is a half-assed patched-up hack job" article from one of the *BSD folks.

Let's Face the Truth

Apple now pays the price by distributing an OS that has an in-built Firewall that is disabled, by default.

That's it.

End of story.

Macpwn'd

This was inevitable. Apple has been stumbling in the dark for 10-15 years in the OS/Desktop/laptop dept. Apple should focus on iTunes and the iPhone. The current "macs" are pc's with a port of BSD ho-hum.

Microsoft owns it is the least secure OS of the bunch and makes an effort to correct it. Its for sure a lot more Windoze will get hacked, only beacasue there are so many more windoze systems compared to Macs and MacTards....

So, uh

The competition is made up of three computers that are as close to factory defaults as possible? Doesn't anyone realise that a very large percentage of security holes on computers come from software that users voluntarily install?

http://www.theregister.co.uk/2008/03/27/buggy_flash_menace/

http://www.theregister.co.uk/2008/03/12/march_patch_tuesday/

http://www.theregister.co.uk/2008/02/25/vmware_critical_vuln/

http://www.channelregister.co.uk/2008/03/27/firefox_security_flaws_update/

http://www.theregister.co.uk/2008/02/11/adobe_reader_exploit/

And in my opinion, even with computers that are at factory default, having a user click a link doesn't really count as hacking per-se. Let's face it; the typical person is going to be connected through one of:

1) wireless networks with no port forwarding by default;

2) other routed networks with no port forwarding by default;

3) GPRS/EDGE/3G/HSDPA networks with no port forwarding by default;

4) a firewall.

In this case, what does it matter if a port is opened here or there? There aren't really that many standard modems in use anymore where you are completely externally exposed, and if you are stupid enough to be using one without a firewall, or if you are stupid enough to permanently have your router/gateway set to DMZ, you are asking for trouble. If you are stupid enough to allow a hacker onto your LAN, ...

If a hacking competition is based on the idea that someone is going to have to physically walk up to your computer and stick a crossover cable in the side of it to do any real harm, then the competition is sorta flawed. In that case, I would be more concerned about someone breaking into my house rather than "hacking" my computer.

Similarly, a competition where people have had the time to orchestrate their attack and just execute it when they get there is equally flawed.

I'm a Mac user day-to-day. I don't believe that the system is completely secure, which is why I keep my firewall up, regularly install updates and security patches and don't set myself up for trouble. At the same time, I don't expect everything I install to be completely secure. I have had previous Windows computers that have been infected with viruses before my first logon after a fresh reformat and reinstall (just by being connected to a LAN during setup). But at the same time, I've also had Windows installs in the past that have been flawless for as long as they have been in use. Computers are inherently insecure, regardless of your operating system.

Okay, yeah. So the MacBook got beaten first, and now this has happened, the playing field is leveled a bit. The moral of the story is "use your firewall, install your updates and don't click links you don't trust". Now will the Windows or anti-Mac zealots please stop with the "take this, fanboys!" attitude? Your operating system is not perfect either, yet I do not waste my time bashing your system. Get back to me when it is and then I might be less tempted to gouge out your eyes with a screwdriver.

It seems the word "hacking" is vastly misunderstood these days.