Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

All Five Smartphones Survive Pwn2Own Contest

Soulskill posted more than 5 years ago | from the can't-hit-a-mobile-target dept.

Cellphones 144

CWmike writes "Although three of the four browsers that were targets in the PWN2OWN hacking contest quickly fell to a pair of researchers, none of the smartphones were successfully exploited. TippingPoint had offered $10,000 for each exploit on any of the phones, which included the iPhone and the BlackBerry, as well as phones running the Windows Mobile, Symbian and Android operating systems. 'With the mobile devices so limited on memory and processing power, a lot of [researchers'] main exploit techniques are not able to work,' said TippingPoint's Terri Forslof. 'Take, for example, [Charlie] Miller's Safari exploit,' referring to Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year. 'People wondered why wouldn't it work on the iPhone, why didn't he go for the $10,000?' she said. 'The vulnerability is absolutely there, but it's a lot tougher to exploit on the iPhone.'" Chrome was the only browser at the contest that was not successfully exploited. We previously discussed day one of the contest, and a summary of day two is available as well.

cancel ×

144 comments

Sorry! There are no comments related to the filter you selected.

Oh lawd (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27328819)

Is dat some CP in that wikileaks list?

All 5, eh? (2, Insightful)

jav1231 (539129) | more than 5 years ago | (#27328877)

They name the iPhone and Blackberry and 3 OS's. Poorly worded much?

Re:All 5, eh? (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27329331)

Q: Why didn't barack obama read the stimulus bill before signing it?

A: Nobody loaded it onto his teleprompter!

Re:All 5, eh? (1)

The Wooden Badger (540258) | more than 5 years ago | (#27329517)

Exactly what I was thinking. I went to the article to see what the 5 were and didn't really glean much more information out of it than what was in the summary.

Re:All 5, eh? (2, Informative)

vux984 (928602) | more than 5 years ago | (#27331373)

Exactly what I was thinking. I went to the article to see what the 5 were and didn't really glean much more information out of it than what was in the summary.

I had no trouble identifying the five that were tested:

iphone, blackberry, windows, symbian, android.

Re:All 5, eh? (1)

More_Cowbell (957742) | more than 5 years ago | (#27332497)

I think you are missing the GP's point that they only named two of the five devices...
"windows, symbian, android" gives no indication of the phones they were running on.

Re:All 5, eh? (1)

wealthychef (584778) | more than 5 years ago | (#27332645)

It's not clear from the pwn2own website [tippingpoint.com] , but there is this:

After much appreciated feedback from the contestants, weâ(TM)ll be sure that such details as version numbers of the OS and exact hardware specs are made available well in advance.

HTH

Re:All 5, eh? (1)

vux984 (928602) | more than 5 years ago | (#27332707)

I think you are missing the GP's point that they only named two of the five devices...

Oh, I see.

But if that's the case, what were the two -devices- they did name? I only see one.

I mean, techically there are a couple different iphone models, but assuming a current model, the only difference between them is flash capacity, so I'll give you that one.

But what's a "Blackberry"? Bold? Storm? Curve? Pearl...? Blackberry doesn't really tell me anything more specific than 'an Android phone'.

Re:All 5, eh? (1)

More_Cowbell (957742) | more than 5 years ago | (#27332827)

Yeah, you certainly have a point. And hey, I could be wrong, it was just how I read the GP's comment (probably because I wanted to know about the hardware myself).

Re:All 5, eh? (1)

More_Cowbell (957742) | more than 5 years ago | (#27332967)

Now that I've actually RTFA (or one of them anyway)...

For example, Forslof said that one researcher had prepared an exploit for a vulnerability on a BlackBerry Touch emulator, but the BlackBerry model used in the contest was the Bold. "There was enough difference [between the two] that his exploit wasn't working," said Forslof.

So, like I said earlier, you had a point, and I think you are right to assume the current iPhone.
Still wondering what the other three were.

Re:All 5, eh? (1, Informative)

Anonymous Coward | more than 5 years ago | (#27329935)

From the 3rd link [computerworld.com] in TFS:

This year's PWN2OWN also features a mobile operating system contest that will award a $10,000 cash prize for every vulnerability successfully exploited in five smartphone operating systems: Windows Mobile, Google's Android, Symbian, and the operating systems used by the iPhone and BlackBerry.

Not any tougher on iPhone according TFA (4, Informative)

Shatrat (855151) | more than 5 years ago | (#27328911)

Apparently the safari exploit

"should work on the iPhone but the bug couldn't (be) used twice in the competition."

So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.

Re:Not any tougher on iPhone according TFA (0, Troll)

scorp1us (235526) | more than 5 years ago | (#27329677)

The iPhone does not use Safari. The iPhone uses a rebranded mobile browser from another vendor. This vendor also makes the browser for other smart phones.

Re:Not any tougher on iPhone according TFA (1)

Goaway (82658) | more than 5 years ago | (#27329707)

What

Re:Not any tougher on iPhone according TFA (1, Funny)

Anonymous Coward | more than 5 years ago | (#27329779)

At least you had balls to make fool out of yourself without being anonymous coward :-)

Re:Not any tougher on iPhone according TFA (5, Informative)

Jedi_Master_SS (622260) | more than 5 years ago | (#27329789)

The iPhone uses a modified version of WebKit (see webkit.org) which is the same engine behind Safari and quite a few other things not just from Apple but other sources as well.

Re:Not any tougher on iPhone according TFA (1)

neoform (551705) | more than 5 years ago | (#27331073)

Chrome is built using WebKit.

Which raises the question, why is Safari less secure than Chrome?

Re:Not any tougher on iPhone according TFA (2, Funny)

Anonymous Coward | more than 5 years ago | (#27331535)

Chrome is built using WebKit.

Which raises the question, why is Safari less secure than Chrome?

Safari was developed by Apple therefore security was overlooked for style and usability.

Re:Not any tougher on iPhone according TFA (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27331671)

Which raises the question, why is Safari less secure than Chrome?

It might not be, it might just have been how the content was set up.

On day 1, the targets were IE, Firefox, and Safari. All three browsers got compromised, some more than once.

On day 2, the targets were Chrome and the mobile phones, although contestants were allowed to attack the other 3 browsers again, provided they did not use the same bug to do so. None of the browsers had a successful (new) attack against them, and none of the phones did either (although only 2 attempts were made against the total of 5 phones I believe, one against the Blackberry Bold and one against a Symbian phone).

Chrome very well might be just as vulnerable as Safari is, but since they were attacking Chrome on day 2, they couldn't use the exploits that worked against Safari on the previous day.

If they had Chrome on day 1 and Safari on day 2, we might be reading that Safari was the only browser that was not compromised. I'm not sure why they structured the contest that way, but I'm thinking that's the primary reason that Chrome was not exploited.

Re:Not any tougher on iPhone according TFA (1, Informative)

Anonymous Coward | more than 5 years ago | (#27332943)

Chrome was a target on day 1, not just day 2.

Also, if you read Charlie Miller's comments, you'll note that he explicitly said Chrome wasn't compromised because its sandbox makes renderer bugs more difficult to exploit. i.e. Chrome is, in fact, somewhat more secure.

Disclosure: I am a Chromium developer.

Re:Not any tougher on iPhone according TFA (1)

oldr4ver (1192469) | more than 5 years ago | (#27332321)

Because Google employs experienced, quality developers who would rather see something functional versus something that a bunch of flashing lights and shiny outer layer.

Re:Not any tougher on iPhone according TFA (1)

mail2345 (1201389) | more than 5 years ago | (#27332639)

Simple.

Implementations can be different from the actual idea/code.

OpenSSL/Debian fiasco RNG mess up, netscape RNG mis-implementation so it only uses the PID, ect.

Re:Not any tougher on iPhone according TFA (1)

linhux (104645) | more than 5 years ago | (#27330639)

It's quite possible for Mobile Safari in iPhone to be vulnerable without that making the phone pwnable. For example, one reason could be that the iPhone OS kernel is only able to execute signed code - unless the phone has been pwned and the signing restrictions disabled. There are probably ways around this from userland, too, but I guess they are pretty hard to find and even harder to exploit. And also, owning Mobile Safari would only give you a uid 501 process, from there you'd have to find some way to escalate your privileges to root.

Re:Not any tougher on iPhone according TFA (1)

Lars T. (470328) | more than 5 years ago | (#27332941)

Apparently the safari exploit

"should work on the iPhone but the bug couldn't (be) used twice in the competition."

So the iPhone should be quite vulnerable, but wasn't compromised because it wouldn't have been eligible for the award since it was the same exploit used against OS X in the first day.

That makes two things apparent:
A) Miller only had one fault left (and didn't find a new one since he found it a year ago).
B) He wanted the MacBook Air more than an iPhone and $10,000 in cash. Or he was so scared that somebody else had found the bug that he drew fast. Or the fucking bug does not work on the iPhone.

Okay, only one of these is apparent, that would be A)

A Symbian with a browser? (5, Funny)

Anonymous Coward | more than 5 years ago | (#27329021)

I saw one of them Symbian's on the internet once. But I didn't know it could have a browser. I thought it was used more for content production.

Symbian (0, Redundant)

troll8901 (1397145) | more than 5 years ago | (#27329747)

I missed the joke. Can someone tell me?

Oh, I keep mixing up the Symbian [wikipedia.org] and the Sybian [wikipedia.org] .

Re:A Symbian with a browser? (1)

noobsauce (1501379) | more than 5 years ago | (#27330147)

The Nokia E71 is a kick-ass phone with a kick-ass browser also based on WebKit. Yes, I have one and love it. :-]

Chrome only browser ... (4, Interesting)

Thornburg (264444) | more than 5 years ago | (#27329093)

Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera, or any of the non-webkit open source browsers other than Firefox? (Ok, they may be fairly obscure, but surely Opera is well known enough, right?)

Re:Chrome only browser ... (5, Funny)

Anonymous Coward | more than 5 years ago | (#27329149)

They didn't want to give Opera any more ammunition against the other browsers.

Re:Chrome only browser ... (5, Insightful)

pxlmusic (1147117) | more than 5 years ago | (#27329211)

as someone who recently gave Opera another go, i can see why.

i would appear that i've been missing out

Re:Chrome only browser ... (2, Funny)

n1ckml007 (683046) | more than 5 years ago | (#27329369)

yeah I tend to sing Opera's praises.

Re:Chrome only browser ... (2, Insightful)

Kamokazi (1080091) | more than 5 years ago | (#27331319)

I switched to Opera when FF was in version 2, because Opera was considerably faster in most cases. Now that FF is up to speed with Opera, I'm still with it because I'm more familiar with it...and it feels more 'complete' out of the box to me...no need for extensions. For someone who uses it regularly on four different machines (and irregularly on several more), that's important.

Sure, it's not open source, but I'm concerned about free beer more than free speech (not to say that it's unimportant, I just have my priorities...as far as my browser is concerned, open vs closed is not nearly as important as it is with OS or production stoftware).

But Firefox has changed the browser 'market' more than any other I think, and in a very good way. They were striving to make a good free browser when no one else seemed to care about the web browser as much, as long as it worked. Opera was the only one really trying, and to compete they dropped the ads and became completely free. MS actually tried with IE7 (still failed), and...I know I will catch crap for this...have actually did a pretty damn good job with IE8. Chrome came out, obviously, and Apple has shown more interest in improving Safari.

So while Opera is my browser of choice, I know I owe a lot to FF for setting the bar higher.

Re:Chrome only browser ... (3, Insightful)

worip (1463581) | more than 5 years ago | (#27329459)

Chrome is also one of the newest browsers in the market. The longer a browser is out there, the longer the time someone can develop a hack for it. I bet for the next contest, presuming that Chrome will still be around, there will be a few Chrome hacks to go around.

Re:Chrome only browser ... (0)

Anonymous Coward | more than 5 years ago | (#27329921)

point is that everyone had a year to work on the exploits, not 3 days.

so everyone came with their exploits ready-to-go.

so since chrome came out this year, most people didn't bother trying to find an exploit for it the past year...

and since phones, well, cost a lot and arent as easy as computer programs to debug/etc, most people also didn't work on them the past year

THATS THE FUCKING POINT.

PWN2OWN proves NOTHING like "this is more secure than that". NOTHING.

Re:Chrome only browser ... (1)

FredFredrickson (1177871) | more than 5 years ago | (#27330241)

Thanks, I was about to comment on this, but you beat me to it.

It's poor reporting, really. Make Chrome look like a hero, when there are other browsers that just weren't tested at all... (and would most likely pass).

[posted from opera]

Re:Chrome only browser ... (3, Insightful)

Actually, I do RTFA (1058596) | more than 5 years ago | (#27330387)

Chrome was the only browser in the contest that was not successfully exploited... why didn't they include Opera

For the same reason high school sports teams don't play NFL teams; it just would be disheartening to the players.

My guess is that Opera never really got the attention because it never had a big company pushing it (MS, Apple, Google, and Firefox had the whole Mozilla/FOSS thing).

Apple security (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#27329163)

Aren't Apple's long-running security woes the direct result of Steve Jobs' attitude towards security? When you have such contempt for secure code at the highest levels of an organization, that stuff tends to trickle downward and it's bound to be reflected in the company's products.

Re:Apple security (3, Funny)

Rayban (13436) | more than 5 years ago | (#27329173)

[citation needed]

Re:Apple security (0)

Anonymous Coward | more than 5 years ago | (#27329253)

Steve Jobs' attitude is focused on usability and looks, not security. Apple has more than one employee, and I also bet there's more than one person assigned to software security.

Re:Apple security (1)

aliquis (678370) | more than 5 years ago | (#27329837)

no.

Economics (0)

Anonymous Coward | more than 5 years ago | (#27329301)

Maybe there's just too much money to be had selling phone hacks. Miller has already said that $10,000 was well below the market value of some of the exploits used in the contest.

Re:Economics (1)

n1ckml007 (683046) | more than 5 years ago | (#27329453)

I wonder if crackers get annoyed when one of their "tools" gets a zero-day.

Not likely... (1)

denzacar (181829) | more than 5 years ago | (#27330323)

After all... As TSA states - there is a world market for maybe five smartphones.

I still wouldn't call it a "hack"... (0)

Anonymous Coward | more than 5 years ago | (#27329339)

Call me crazy but I still wouldn't call it a true "hack" when it requires someone to click on a link. No browser can protect against human gullibility.

I look at it as the difference between pushing past an old lady and robbing her after you told her you were from the electric company as opposed to a cat burglar "tip toe in and tip toe out and they don't realize they were robbed until you're long gone".

Both are bad, mind you, but only one of them actually requires skill.

Re:I still wouldn't call it a "hack"... (1)

morgan_greywolf (835522) | more than 5 years ago | (#27330071)

Well, that's where the whole concept of 'honor among thieves' comes from. Cat burglaring and pick-pocketing are truly artforms. Knocking over old ladies is just plain thuggery.

Re:I still wouldn't call it a "hack"... (0)

Anonymous Coward | more than 5 years ago | (#27330103)

If a bad webpage can own your box by nothing more than you visiting it, it could just as easily do so while presenting a semi-legit looking page. You wouldn't necessarily be aware of the fact that you'd been rooted.

Re:I still wouldn't call it a "hack"... (0)

Anonymous Coward | more than 5 years ago | (#27333175)

Also, all it would take is an insider admin at a place like Google, Yahoo, to compromise millions of computers. Or somebody with access to the graphics department at a corporation with a large online presence or at an advertising agency.

Reboot when deleting pictures bug? (1)

n1ckml007 (683046) | more than 5 years ago | (#27329429)

http://discussions.apple.com/thread.jspa?messageID=9193300&tstart=0 [apple.com] I'm suprised this bug hasn't be used as a "toe hold" for an exploit.

Re:Reboot when deleting pictures bug? (1)

Jesse_vd (821123) | more than 5 years ago | (#27329583)

ha i always thought that was just because i was using picasa. it broke somewhere around 2.1. luckily we have iphonebrowser

Re:Reboot when deleting pictures bug? (1)

n1ckml007 (683046) | more than 5 years ago | (#27329739)

Does http://code.google.com/p/iphonebrowser/ [google.com] work on locked iPhones?

Re:Reboot when deleting pictures bug? (1)

Jesse_vd (821123) | more than 5 years ago | (#27329875)

locked yes, non-jailbroken, no.

Re:Reboot when deleting pictures bug? (1)

Jesse_vd (821123) | more than 5 years ago | (#27329979)

but i think that alone is a good enough reason to jailbreak. and if you need about 20 more, just look here http://thebigboss.org/why-jailbreak-iphone/ [thebigboss.org]

Hmm (4, Funny)

LizardKing (5245) | more than 5 years ago | (#27329537)

Miller's 10-second hack of a MacBook via an unpatched Safari vulnerability that he'd known about for more than a year.

Definitely a black hat then, as I'm assuming if he'd reported the vulnerability when he'd found it even Apple would have patched it by now.

Re:Hmm (5, Interesting)

Yamamato (1513927) | more than 5 years ago | (#27329879)

No, it's because he's not going to do free work for Apple.

Did you consider reporting the vulnerability to Apple?

I never give up free bugs. I have a new campaign. It's called NO MORE FREE BUGS. Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away. Apple pays people to do the same job so we know there's value to this work. No more free bugs.

Re:Hmm (5, Interesting)

LizardKing (5245) | more than 5 years ago | (#27330069)

No, it's because he's not going to do free work for Apple.

That's precisely the attitude of a black hat. A responsible hacker notifies the vendor or author of the issue, giving them a reasonable amount of time to release a fix. If the fix is forthcoming in a timely manner, the hacker should be thanked in the release notes and is then free to post a description of the issue along with a proof of concept exploit if they like. If a fix is not forthcoming in a timely manner, and no reasonable explanation given by the vendor or author, then the hacker releases the description in the knowledge that they've adhered to the widely acknowledged good practice. This is responsible full disclosure.

A black hat doesn't notify the vendor in order to gain some kind of material benefit - be it selling the exploit or using it directly for personal gain. Funnily enough personal gain is what this guy did it for, making him a scumbag black hat hacker.

Re:Hmm (3, Insightful)

Yamamato (1513927) | more than 5 years ago | (#27330169)

No, he's just not an idiot. BTW Apple pays people to report verifiable bugs to them. Does that make all those people black hats too? You never actually mentioned why he should do free work for Apple when they pay others to do the same thing.

You talked earlier about the value of vulnerabilities. Was it a surprise that he (Nils) basically gave up three "high-value" bugs for $5,000 each?

It's clear he's incredibly talented. I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I've talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I'd say $50,000 is a low-end price point.

For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they're paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac.

Re:Hmm (1)

LizardKing (5245) | more than 5 years ago | (#27331105)

BTW Apple pays people to report verifiable bugs to them.

So your original point is moot - he could of been paid by Apple for finding and reporting issues. The fact he didn't makes it even more suspicious that he had something else in mind, perhaps selling to someone prepared to pay more. I wonder who that someone might be? Surely not someone with less than entirely innocent intentions? To be honest though, all this talk of people paying tens of thousands of dollars for an exploit sounds more like a black hat's imagination running riot, which fits with the sad sack fantasists calling themselves "hackers" that I've encountered.

Re:Hmm (1)

maztuhblastah (745586) | more than 5 years ago | (#27332307)

No, he's just not an idiot. BTW Apple pays people to report verifiable bugs to them.

Interesting. Since I (and perhaps others) have never heard of this, perhaps you could corroborate your story with a link to Apple's policy on this?

Re:Hmm (1)

RussellSHarris (1385323) | more than 5 years ago | (#27330201)

I beg to differ.

urbandictionary:

1- A Hacker (Or rather cracker, but that's a different discussion) who uses his abilities for malicious purposes.

2- Anything relating to malicious use of the internet.

wiktionary:

A malicious hacker who commits illegal acts.

other relevant definitions from google: (disregarding the ones about actual hats, westerns, search engines, and judaism)

Black hat is used to describe a hacker (or cracker) who breaks into a computer system or network with malicious intent. Unlike a white hat hacker, the black hat hacker takes advantage of the break-in, perhaps destroying files or stealing data for some purpose.

A malicious hacker who exploits - or publicises - a security weakness before informing the affected organisation.

Nowhere was "personal gain" mentioned. "Black hat" was always applied to individuals with "malicious" motives and/or whose actions are "illegal". Winning the prize money in a contest is neither of those.

Re:Hmm (1)

bostongraf (1216362) | more than 5 years ago | (#27331159)

A responsible hacker notifies the vendor or author of the issue, giving them a reasonable amount of time to release a fix.

I think this is putting too much responsibility on the hacker. I would argue that the only responsibility the hacker has is to not use the exploit in a malicious manner. And asking for payment from the vendor for the work done by the hacker is not malicious. It is business.

The "personal gain" you reference should be limited to the enjoyment of investigating and engineering the exploit in the first place. If the exploit is released in any way, then I am on your side, and they become scumbag black hat. But if it never leaves the basement, and is discovered with the sole intent being to sit in a personal library of code, then there is no foul. Nor is there any onus placed on the hacker.

I do think that the exploit contest itself is an interesting grey area. But if the vendors are willing to put their systems up to that kind of scrutiny, then it can not be called malicious.

Re:Hmm (1)

AndersOSU (873247) | more than 5 years ago | (#27332723)

And asking for payment from the vendor for the work done by the hacker is not malicious. It is business.

You've got to be careful though, it could also be blackmail.

Re:Hmm (1)

bostongraf (1216362) | more than 5 years ago | (#27332927)

You've got to be careful though, it could also be blackmail

Absolutely.

Of course blackmailing the vendor would 1)be malicious and 2)involve releasing the exploit. Both of those would go far beyond the stance I am defending.

Re:Hmm (0)

huge (52607) | more than 5 years ago | (#27331719)

That's precisely the attitude of a black hat.

No, that's hard-core capitalism - supply and demand; all that jazz. Apple doesn't see any value in his product (exploit) so they aren't willing to pay. Somebody else could be willing to pay for what he has so he could sell it to them instead.

Normally when there is much more supply than demand then manufacturer needs to start advertising to make sure that the potential buyers are aware that product exists. When there is more demand but almost no supply, then potential buyers will advertise to every potential manufacturer (or author in this case) that they are willing to pay for certain product, if anybody has it.

Re:Hmm (1)

jomuyo (1082721) | more than 5 years ago | (#27332337)

I agree with LizardKing's post. To know about a security venerability and not tell anyone for more than an year is completely immoral and wrong. The attitude that one should only report security vulnerabilities for some type of payment is a dangerous precedent. If this type a behavior made it into the FLOSS community, it would be a disaster. Say I found a venerability in Firefox. Should I go to the Mozilla Foundation and demand payment for finding this bug? Of course not, that is like asking for a ransom. If you want to get paid for finding security vulnerabilities. Go work for a security company like the other security researchers out there.

Re:Hmm (1)

mkiwi (585287) | more than 5 years ago | (#27330221)

Vulnerabilities have a market value so it makes no sense to work hard to find a bug, write an exploit and then give it away.

Emphasis mine. The very quote you mentioned clearly states he uses exploits for profit. The GP is completely right- this guy is a black hat.

Re:Hmm (2, Interesting)

Yamamato (1513927) | more than 5 years ago | (#27330363)

Emphasis mine.

There is no emphasis...

The very quote you mentioned clearly states he uses exploits for profit.

No it doesn't. He said he's not going to go through the trouble of finding and bugs and writing an exploit and then giving it away to Apple for free when they pay others money to do the exact same thing.

The GP is completely right- this guy is a black hat.

Sorry, the GP is wrong unless you have some information of him actually using any exploits for malicious use which I doubt you have.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27330509)

he uses exploits for profit. The GP is completely right- this guy is a black hat.

Oh really? Profiting from an exploit means you're a black hat?

white hat hacker [wiktionary.org] : (emphasis mine)

A hacker who is ethically opposed to the abuse of computer systems.

A hacker who is legally authorized to use otherwise illegal means to achieve objectives critical to the security of computer systems, for example, someone hired to execute a penetration test upon a network to produce a report for its administrator about vulnerabilities and solutions to the networks security.

Hired? You mean HE PROFITED FROM IT? Isn't that EVIL?

ZOMG, WHITE HAT HACKERS ARE NOW BLACK HAT HACKERS! The world is coming to an end!

Re:Hmm (1)

LizardKing (5245) | more than 5 years ago | (#27331313)

There's this subtle difference (well it must be too subtle for you) between where you get your payment from. Apart from the vendor, Apple in this case, I struggle to think of any other source of payment for an exploit that isn't, well, dodgy. Although I seem to recall from my days on the security mailing lists that there were plenty of people for whom the kudos of their peers was payment enough.

Re:Hmm (1)

hldn (1085833) | more than 5 years ago | (#27331345)

next time you need to pay a bill, just give them some kudos from peers instead of cash and see how that goes over.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27331091)

So, he's a mercenary, then. He could try to help others fix the damn thing, but instead he's hoarding it for his own personal gain (yes, personal gain, unless you can think of another reason he mentions the "market value" of the vulnerability).

Fucking self-absorbed prick.

Re:Hmm (1)

Fnord666 (889225) | more than 5 years ago | (#27331907)

and also

I could get more than $5,000 for it but I like the idea of coming here and showcasing what I can do and get some headlines for the company I work for (Independent Security Evaluators).

Because everyone wants to hire a security firm that employs morally bankrupt people. I'm sure his employers are so proud.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27332229)

He's not "morally bankrupt". He took $5k, a low-end price, for the exploit – and by entering the contest he agreed to give the exploit to the affected vendor so they could get it fixed. How is that anything less than noble?

Re:Hmm (2, Informative)

Chaos Incarnate (772793) | more than 5 years ago | (#27329903)

That's a bad assumption. Apple tends to sweep security problems under the rug as much as possible.

Re:Hmm (3, Informative)

Yamamato (1513927) | more than 5 years ago | (#27329999)

Plus he added a few more funny things about OSX.

Why Safari? Why didn't you go after IE or Safari?

It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.

It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn't have anti-exploit stuff built into it.

With my Safari exploit, I put the code into a process and I know exactly where it's going to be. There's no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I don't know where it is. Even if I get to the code, it's not executable. Those are two hurdles that Macs don't have.

It's clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that's only half the equation. The other half is exploiting it. There's almost no hurdle to jump through on Mac OS X.

Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.

Re:Hmm (1)

CannonballHead (842625) | more than 5 years ago | (#27331199)

But Macs are pretty and EVERYONE knows that Windows is bad, so as long as we keep up the Microsoft critique about their security, we can ignore Macs... especially since so few people use them, it's not worth it (except in contests) to exploit them...

Lack of Perfection Doesn't Make You a Joke (1)

geoffrobinson (109879) | more than 5 years ago | (#27331615)

I don't think anyone claimed that OS X was or would be going forward perfect. That doesn't mean that it is not well ahead of Windows in terms of a secure design.

Re:Lack of Perfection Doesn't Make You a Joke (1)

drinkypoo (153816) | more than 5 years ago | (#27332197)

I don't think anyone claimed that OS X was or would be going forward perfect. That doesn't mean that it is not well ahead of Windows in terms of a secure design.

The quote makes it clear that in fact, OSX is well behind Windows in terms of secure design. It doesn't have NX (or similar) support, and it doesn't have address randomization, and that's fucking pathetic because both technologies predate OSX considerably*, but neither predates Windows XP.

* I don't think literal NX bit support predates OSX, but the idea is older and does not require hardware support to implement, although hardware support improves things considerably. You can still have support for non-executable memory. Out of the major three operating systems anywhere near a desktop today, OSX is the only one which doesn't have it. OSX's famed "security" is indeed a joke. Windows does indeed get hit more than OSX only because it is the dominant platform. Linux has these features, though not all distributions activate them (they might be defaults now.)

Re:Lack of Perfection Doesn't Make You a Joke (1)

pyrbrand (939860) | more than 5 years ago | (#27332303)

Isn't that explicitly what the GP is pointing out - that it is light years behind Windows in terms of secure design?

Re:Lack of Perfection Doesn't Make You a Joke (1)

Chutulu (982382) | more than 5 years ago | (#27332347)

don't you know how to read?

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27332195)

Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.

One has to wonder if user friendly exploits were an intended part of their "It just works!" campaign :)

Re:Hmm (1)

maztuhblastah (745586) | more than 5 years ago | (#27332411)

Looks like all that supposed security you hear about in Mac OS X is really just a huge joke.

Not really. The ASLR can be bypassed, and the NX support is indeed quite incomplete in Leopard (it's heap only IIRC), but the real strength of OS X's security comes from the Unix permissions model. It's still very tricky to write malware that, say, turns a Mac into a zombied warez server. It's still difficult to get root, which would be necessary to do most of the useful things you can do with a compromised box.

On Windows, once you've got access to a user account you've got root, since 9 times out of 10 the person won't have the patience to fight with all their legacy software (and Windows poor UI) and run as a limited account.

Ask yourself this: if Mac OS X's security is such a joke, why haven't any of the millions upon millions of Macs out there been part of a botnet? Yeah, I know... marketshare, etc... but if the security really is as you're making it out to be, isn't it kinda odd that there aren't *any* zombied Macs? Surely with several million trivially exploitable machines, somebody would have taken advantage of them, right?

Re:Hmm (1)

brkello (642429) | more than 5 years ago | (#27332893)

How do you know that none of them are zombies? Show me a citation on that. And I have been saying for years once Mac's get more popular, you will see a lot more exploits for them. They still aren't near enough to be as tempting as windows boxes. But really, it's this smug attitude that OS X is this bastion of security and you don't need to run firewalls or AVs that is going to make you all sitting ducks someday.

Re:Hmm (1)

weicco (645927) | more than 5 years ago | (#27333029)

I would consider system which requires root access to send data to internet a) not very secure b) not very usable. And I really much doubt that you need root access to connect to internet on Mac OS X. UNIX permission model doesn't help shit in this kind of situation.

Re:Hmm (1)

LizardKing (5245) | more than 5 years ago | (#27330119)

Apple tends to sweep security problems under the rug as much as possible.

Their track record has been a bit variable, but by his own admission this guy didn't contact Apple. He sat on the exploit, in the knowledge that it could be used for no good by others, making him little better than the really bad guys. He then used the exploit for personal gain. Classy.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27330257)

Unless he was worried that the exploit would be discovered by malicious crackers, sitting on the exploit was no risk.

How dare he use his technical skills for personal gain. Wait, what do you do for a living? Yeah, real classy. You should work for free, society deserves to leech off you...

Re:Hmm (1)

LizardKing (5245) | more than 5 years ago | (#27331253)

Unless he was worried that the exploit would be discovered by malicious crackers, sitting on the exploit was no risk.

How does he know that others haven't discovered the exploit (unless he believes he's more l33t than anyone else).

How dare he use his technical skills for personal gain.

As others have pointed out, Apple pay for verified bugs. By sitting on it he simply made it more likely someone else would get paid for it, unless he thought there was a more profitable use for the bug. And I wonder what those would be?

Wait, what do you do for a living?

Something a damned sight more productive than this cracker, which is probably why I don't have to fuck about to get paid.

You should work for free, society deserves to leech off you...

Oh do fuck off you anonymous twat.

Re:Hmm (1)

FLEABttn (1466747) | more than 5 years ago | (#27331561)

You should work for free, society deserves to leech off you...

Oh do fuck off you anonymous twat.

What's the problem? We were planning on thanking you in the release notes...

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27331841)

unless he believes he's more l33t than anyone else

Maybe he does.

As others have pointed out, Apple pay for verified bugs

Maybe he wanted the notoriety that winning the contest would provide.

he thought there was a more profitable use for the bug. And I wonder what those would be?

He entered a contest. He won $5000 for the exploit (which is undoubtedly far less than he could have got for the exploit* if he had actually been a black-hat cracker as you claim). Apple now has the exploit, so they can fix the hole**. What's the big problem again?

Something a damned sight more productive than this cracker, which is probably why I don't have to fuck about to get paid.

You believe that your job is more productive than a guy who has provided several large companies with invaluable information about undiscovered flaws in their products which would potentially have a global effect if ever exploited by a malicious person or persons? Oh...

Oh do fuck off you anonymous twat.

Posting anonymously to avoid un-doing moderation. You cleverly avoid my point: what makes you think this guy should work for free? He provided a valuable service; he deserves to be compensated for his hard work.

--

* According to this guy [slashdot.org] , whom I have no reason to doubt.

** From the 2008 Pwn2Own rules [tippingpoint.com] :

All winning exploits will be handed over to the affected vendors at the conference through the ZDI, with the appropriate credit given to the contestant once the vendor patches the issue. Until then, the actual vulnerability will be kept quiet from the public. This is a required condition of entry into the contest; all entrants must agree to the responsible disclosure handling of their vulnerability/exploit through the ZDI.

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27331433)

But he also said it wouldn't be such an easy target if they'd randomize the address space and execute-protect stack and heap like other OSs do. OpenBSD was the first I've ever heard of doing this, then Linux distros and Windows XP SP2 and higher started doing it.. Is it true that Darwin does not?

Re:Hmm (0)

Anonymous Coward | more than 5 years ago | (#27331109)

Why would you give something away for free when you can make a few bucks off it? It makes alot more sense to use that information to make some money, especially in this economic climate.

Software experts and professional hackers are trying to make a living in a legal way and deserve to be paid well for the expert work they do.

I don't think it's greedy of him to do this. Why I think it's greedy for a rich company like Apple to not be rewarding people who report legitimate bugs. Why should Apple get his hard work for free when they over charge for everything?

Grammar Nazi alert (2, Funny)

Linker3000 (626634) | more than 5 years ago | (#27329561)

"none....was..." puhleeze!

Phones (2, Informative)

Anonymous Coward | more than 5 years ago | (#27329623)

A quick Google Pulled up the Phones as:

Phones (and associated test platform)

        * Blackberry(TBA)
        * Android(Dev G1)
        * iPhone(locked 2.0)
        * Nokia/Symbian(N95-1)
        * Windows Mobile (HTC Touch)

Re:Phones (3, Informative)

Thornburg (264444) | more than 5 years ago | (#27329717)

A quick Google Pulled up the Phones as:

Phones (and associated test platform)

        * Blackberry(TBA)

        * Android(Dev G1)

        * iPhone(locked 2.0)

        * Nokia/Symbian(N95-1)

        * Windows Mobile (HTC Touch)

The Blackberry was apparently a "Bold", at least, that's what one of the related blog posts refers to.

Re:Phones (0, Troll)

petehead (1041740) | more than 5 years ago | (#27330645)

A quick Google Pulled up the Phones as: Phones (and associated test platform) * Blackberry(TBA)
* Android(Dev G1)
* iPhone(locked 2.0)
* Nokia/Symbian(N95-1)
* Windows Mobile (HTC Touch)

I have the HTC Touch. It has a built in security feature: It will crash whatever you are running to try to exploit it. If anyone here figures out how to exploit it, please tell Microsoft. Not so that they will patch it, but so they can use it as an example to developers for how to code.

Final Score (From DVLabs blog) (4, Informative)

Deathlizard (115856) | more than 5 years ago | (#27329805)

Browsers
Chrome: 0***
IE8: 1**
Firefox: 1(1)*
Safari: 2(1)*

Mobile Browsers
Android: 0
iPhone: 0
Nokia/Symbian: 0
Windows Mobile: 0
Blackberry: 0****

*Numbers in parenthesis indicate Successful exploits that fell outside the contest criteria and therefore could not be rewarded.
**Exploit Confirmed by MS
***Chrome was impacted by one of the flaws, although exploit was not possible using any current known techniques.
****The Blackberry was attempted and resulted in "Something Interesting", but not an exploit.

DIE HACKER DIE (-1, Flamebait)

chemicalfacist (963555) | more than 5 years ago | (#27330099)

Hackers should just be killed.

Re:DIE HACKER DIE (3, Funny)

petehead (1041740) | more than 5 years ago | (#27330543)

DIE HACKER DIE

Your German is unintelligible to me.

Re:DIE HACKER DIE (0)

Anonymous Coward | more than 5 years ago | (#27332887)

DIE HACKER DIE

Your German is unintelligible to me.

I'll translate that to English for you:

The Hacker The

Re:DIE HACKER DIE (0)

Anonymous Coward | more than 5 years ago | (#27330731)

He says, to a message board of hackers, owned and operated by hackers...

Be seeing you. :)

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?