So, were the Windows and Linux systems hacked in a similer way?

If apple was smart they would hire this guy and give him a nice salary.....

Apple rarly takes these things to heart, once a vulnerabillity is discovered it usualy takes them 6 months to patch it, if they do at all. They seriously just don't care about these vulnerabillities.

Quote

geoduck wrote:
So, were the Windows and Linux systems hacked in a similer way?

Just Apple was hacked

I hope apple hires the kid before microsoft does!!!

they had to execute a specific code from a website in order to hack it. they couldn't do it via network. i'm just wondering if a user would have to give it permission to install an application. it'll be be patched by the end of next month.

Wow, very nice..... i wanna know the exploit.

nope, the vista and ubuntu machine were still standing.

ha-ha

/nelson

This is old news. Happened this summer also with a similar flaw.

THIS IS OLD NEWS!!!

According to Tuaw.com

http://www.tuaw.com/2008/03/28/macbook-air-knocked-out-quickly-in-cansecwest-contest/

"It is a little troubling, however, that the other two laptops (Vista and Ubuntu) are still standing."

And as the scales fell from their eyes they came to the sad conclusion that their beloved Mac’s were not divinely inspired.

Where are all the Mac lovers and Micro$oft bashers? Come now, we know Apple is better than Micro$oft and this has to be a misprint...lol

Billy gates is chukling

WAY to go CHARLIE.

Quote

Guest wrote:
Just Apple was hacked

apples the worst kind of system ive ever used...

The Linux and Windows computers were both still standing at the end of Day 2.

Clearly shows apple's inferiority.

ok...so if you read it carefully "Mr. Miller was able to gain control over the MacBook Air in only two minutes by directing a contest organizer to visit a specially crafted Web site with the laptop." That is the only way to hack into a UNIX box in the first place. you have to gain control of it, not like windows when spyware, malware, and anything else can install and seed itself without someone known it. I praise Charlie Miller for the fine work he is doing. Steve Jobs, Hire this guy!!!

Quote

Guest wrote:
Clearly shows apple's inferiority.

That's old news, the kid wanted the Mac Air, not the other stuff.

So much for feeling secure

As of Friday morning the Vista and Linux computers hadn't been hacked.

Clicking Links is not the same as having malicious code maliciously installed on your machine. If you click a suspicious link, I'm sorry, but you deserve what you have coming. The fact that the guy researched it for a month or more, as one of the articles I read implies, and didn't bother telling Apple tells me he doesn't give a crap about security, only cash prizes and fame. Congratulations exploiting something you have known about for a long time in order to get recognized. The hack didn't take two minutes, it took months of research plus time spent coding. The EXECUTION took two minutes. Read the articles and you'll realize why these contests are simply epeen contests between security "experts" and Windows or Mac fanatics.

The same faulty misrepresentation of the circumstances regarding security have been used for years to bash Windows.

" Mr. Miller was able to successfully hack the laptop after the rules of the contest were relaxed to allow for more than remote attacks"

The minute he can hack a Mac remotely I'll be interested, as it is he did nothing that a moderately advanced user couldn't prevent with a few simple steps and a little common sense.

As one of the guests noted, why expend that effort to get a PC or a Linux machine either, I would have targeted the MBA first as well...

As there is definitely a chip on hackers shoulders regarding OS X, and a desire to prove Apple wrong regarding security, it is not surprising that the Air was targeted. it would be really interesting to see the statistics regarding the attempts on the Air vs the attempts on Windows and Ubuntu. Without that information, reporting that the Air was hacked first is meaningless. If nobody was trying to hack the other machines, the Air was first by default.

Quote

Guest wrote:
nope, the vista and ubuntu machine were still standing.

ha-ha

"As one of the guests noted, why expend that effort to get a PC or a Linux machine either, I would have targeted the MBA first as well..."

Because all the machines were supposed to be less secure than MacOSX according to Apple?

The sad thing is that IE7 and Vista remained UNCRACKED through to the end of Day 2.

After 2 days, the MacBook Air MacOSX/Safari combo was the *ONLY* compromised system.

And the payout is the same, whether you cracked a more secure or less secure system.

Guess we know which ones are actually less secure now.

All it took was to send a user to a URL to compromise the MacOSX system. Vista didn't even crumble under this despite running IE7.

Quote

Guest wrote:
All it took was to send a user to a URL to compromise the MacOSX system. Vista didn't even crumble under this despite running IE7.

Quote

Guest wrote:
"As one of the guests noted, why expend that effort to get a PC or a Linux machine either, I would have targeted the MBA first as well..."

Because all the machines were supposed to be less secure than MacOSX according to Apple?

The sad thing is that IE7 and Vista remained UNCRACKED through to the end of Day 2.

After 2 days, the MacBook Air MacOSX/Safari combo was the *ONLY* compromised system.

And the payout is the same, whether you cracked a more secure or less secure system.

Guess we know which ones are actually less secure now.

All it took was to send a user to a URL to compromise the MacOSX system. Vista didn't even crumble under this despite running IE7.

Calm down people. The Mac was hacked because it ships with a browser that has a bug (Safari 3.1). Windows & Linux don't ship with Safari. End of Story. We should thank Charlie for identifying it and giving Apple the chance to fix it.

Apple needs to (and probably will) take this seriously. The best way to handle it would be with better communication (like Mozilla) when they issue an update. I won't be holding my breath, because Apple has a very arrogant attitude when it comes to communicating about updates.

Of course, I am still curious as to whether or not an Administrator password had to be entered to install software OR if it was as simple as clicking on the link and being owned.

If it was the latter... it is a genuinely NASTY error.

According to various accounts Charlie Miller used to work for the NSA, so even though the MacBook Air is still the only laptop of the three to fall (it was the first one tested yesterday with the relaxed rules) so far, I'm going to declare BS. Not because it isn't a valid crack, but because we have no idea what kind of privledged information Miller had access to while at the NSA that would have allowed him to develop the crack that took control of the MacBook Air.

however he would have had access to insider windows info also undoubtedly

I don't think its BS. He developed the hack based on a known flaw. Just like the Windows hackers were basing their attack on known Windows flaw. The results were that the Mac was easily hacked. While Vista could not be hacked the same day. So far its still not hacked yet.

http://www.news.com/8301-13579_3-9906001-37.html?tag=nefd.top

Here is the news of the vista machine falling to the way side!!! linux the only one standing...

so, all you DOS turds...lets here it now!!!

why hack a machine with VISTA on it????? The air is worth so much more? I am SURE if they wanted to, they would have cracked the vista machine. But why? sell it on ebay like he did with the hacked iphone? Praise the all mighty dollar!!!!!

Actually, all three systems did fairly well. None were hacked on the first day when it was really a "hack the OS" day. The second day was attacking installed software (not the OS), and a flaw in Safari was found - a good thing, as it will lead to a fix. On the third day, third party apps were attacked and a flaw in Flash was found - a good thing, as it will lead to a fix.

From what I have read, the folks that cracked the Vista machine also had a proposed exploit for the Ubuntu machine but didn't find it worth the remaining time to run the exploit.

While the Windows and Linux fans will tout their "success" over the Mac, NONE of the OS's succumbed to the OS-only attack. Not the Mac. Not Vista. Not Ubuntu.

This is a good thing.

The "Guests", and our regular registered posters, should read this article at Roughly Drafted.

"Mr. Miller was able to successfully hack the laptop after the rules of the contest were <b> relaxed </b> to allow for more than remote attacks"

they actually changed the rules so he could just sit down in front of the machine and log in. haxx0red.

Actually the rules were relaxed (per the rules in the contest) to allow attacks through standard installed software. IE for Windows and FF for Ubuntu would then be valid attack vectors. He was not sitting there with direct hardware access.

99.9% of mac users never use the safari to surf the internet.. Hence Mac is safe.

But if you are reading this forum you probably need to patch it ASAP.

Every hack I've seen the last years using Safari have been due to a bug in Safari that allows you to run code if you can convince Safari that the file extension is "Safe". This setting allowing Safari to run "safe" files is I believe still there But has been turned of for years in Firefox and IE.
Correct me if I'm wrong, but I would bet that upcoming patch will fix, yet another way to do this... But It would be better to turn of this Default setting.

Quote

Guest wrote:
So much for feeling secure

...but now you are using good common sense in putting scattered info together and drwawing a logical conclusion. How many people do that? How many people read "...2 minutes to hack into a MacBook Air..." and go home thinking "oh, Apple sucks and I knew it".

I am a proud user of PCs since 1992 and have been conscious about clikcking here and there and opening attachments. I have purchased my first MAC 3 months ago and love it as well.

This was not a hack done over a network but it was a drive-by into a site that had custom code running behind the scenes. Still, no one is saying whether the user had to "allow" any installation which makes a whole lot of difference.