Safari hole exploited in seconds at security conference
Updated at 5:53 p.m. PDT with information on a second winner at the ongoing contest.
Charlie Miller won $5,000 after demonstrating a new Safari exploit as part of the Pwn2Own hacking contest at CanSecWest.
(Credit: Elinor Mills/CNET)VANCOUVER, Canada--The security expert who won $10,000 hacking a MacBook Air in less than two minutes last year won $5,000 on Wednesday by exploiting a hole in Safari in 10 seconds or so.
Charlie Miller, principal security analyst at Independent Security Evaluators, used a MacBook running the latest version of the Mac OS as part of a contest at the CanSecWest security conference called "Pwn2Own," which is hacker slang for gaining control of a computer.
The security hole, which Miller said he discovered last year, allows a remote attacker to gain control of a machine simply by getting the computer user to click on a malicious URL, as Miller demonstrated.
"It's not easy, but this worked with one click" from the Safari browser, he said.
Miller is prevented by contest rules from revealing details of the exploit. He said he told Apple representatives what he planned to do earlier in the day. "They're happy because they get free research and get a bug fixed," he said.
The contest is sponsored by TippingPoint, which will share details on the exploit with Apple and develop a patch for it. TippingPoint is offering $5,000 for each new exploit demonstrated in the major browsers and $10,000 for each successful exploit in the major smartphones, as well.
Previously, Miller discovered a hole in the mobile version of Safari shortly after the iPhone was launched in 2007.
Later in the day, a 25-year-old computer science student at the University of Oldenburg in Germany, won $15,000 for exploits he demonstrated in IE 8, Safari, and Firefox. The student, who declined to give his full name, gets to keep the Sony Vaio he did his exploits on, and Miller gets to keep the MacBook he used.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
However, try reading the article... this isn't quite what it sounds like...
for example:
"... simply by getting the computer user to click on a malicious URL ..."
so, he didn't exactly 'hack in'... though still useful and good to be pointed out for Apple to fix.
Note what kind of computer he uses to do his hacks.... he likes collecting these MacBooks for prizes. Also, note others hacked IE, Firefox, etc. I doubt any company will close all holes in every product... but if you don't realize in comparison, OSX is a fortress, you're simply not living in reality.
I agree. There is no such thing as a 100% secure operating system. That includes osx, linux, and windows. All have been improved over the years (all fortresses to a major extent) but as the results showed in the contest this year... ALL still not 100% secure. The worst thing you can do is pretend otherwise. Everyone should take computer security seriously and use whatever steps they can to add more protection (antivirus/antimalware software). How serious? Let me ask you this... would you have sex using a condom that has a hole in it? Think about that the next time you browse the net, reguardless of what OS/Browser you are using.
>>That's refreshing. Last I heard, Vista was tougher than OS-X. It took longer to hack last time, and before that time in a Hack a Mac contest by Dino Dai Zovi. He said that OS-X was "LESS SECURE THAN VISTA." And he isn't alone:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9072959
http://www.zdnet.com.au/news/security/soa/Mac-OS-X-hacked-under-30-minutes/0,130061744,139241748,00.htm
'"Mac OS X is easy pickings for bug finders. That said, it doesn't have the market share to really interest most serious bug finders," added gwerdna.'
'"The only thing which has kept Mac OS X relatively safe up until now is the fact that the market share is significantly lower than that of Microsoft Windows or the more common UNIX platforms.... If this situation was to change, in my opinion, things could be a lot worse on Mac OS X than they currently are on other operating systems," said Archibald at the time.'
Eat your words, SteveW928.
If don't recognize how much more secure OSX is... then you've clearly never used both OSX and Windows in any kind of real way.
Lets put this another way.... I have NEVER had to clean a SINGLE virus off a Mac in 20 years of working with Macs... and even consulting with clients.... not just my personal Macs, thousands of them I have helped to manage. I don't know ANYONE who has ever had a virus either.
On the other hand, I think ALL but maybe one of my friends who run Windows PCs have had at least one virus attack at some point... some of them multiple attacks. Many of them were even running anti-virus software... and most of the people running anti-virus software are constantly having issues caused by the anti-virus software. About the only Windows PCs I know that haven't typically gotten viruses are in corporate settings with good IT managed firewalls and anti-virus protection on the machines.... and a few have even gotten through that over the years.
I totally realize OSX isn't flawless... but sorry, no comparison. Get yourself some real-world experience rather than going off warped press articles and M$ propaganda.
Sadly, there are going to be security problems no matter which browser you use. They get some patched up, and more are found. There are many, many ways to exploit Sarari, IE, and Firefox to gain control of someone's computer, whether running Windows or Mac. It's just a fact of life. Deal with it.
I actually did read the article.
And it is the same with everything that crew writes. The unpatchable QuickTime or Safari.
OSX may fair a little better, but they didn't write that. They cut and pasted from the FreeBSD crowd, because the OS Apple did write was so pathetically bad that not even Apple could use it.
The flaw shouldn't be in Safari (or Firefox, or IE). But Mac OS X (or Windows) shouldn't allow the application enough access to the core OS to let it its privs escalate.
MS to release patches every day of the month to cover every new hole found.
So freakin' what?
If you are attempting to point out failures, the first failure was in your own post. :/
heard of patch tuesday?
apparently not
Quote: "The Macintosh and base Linux kernel operating systems have dominated the top spots for vulnerabilities by operating system over the past three years".
Source: http://news.cnet.com/8301-1009_3-10154662-83.html
Does Safari have the most holes or did they just get the most patches out? MS has been known to have exploits known and actively used and still not patched....there's an Excel one out there right now, its being exploited in the wild and MS hasn't fixed it yet.
But then while I love my Mac I am not a fan of Safari and just don't use it.
I realize MS requires you to check your brain at the door, but you might want to retrieve it.
How many exploits for those 815 OS X patches? 0.
How many for Windows? 4847328947983274892375874957497543789543798579349
How many unpatched flaws exist in Windows 4859485089435894390859043859043850984358438438647385693408
Yes, your life is over and the hackers rape everything you hold dear...
or you boot the system to another uncompromised disk and remove the problem to regain control
It's the attitude that you have displayed here which demonstrates why this same ignorance makes you a prime target for these sorts of exploits.
So when this all happens to an MS product MS sucks... when it happens to an Apple product its okay?
When did it happen to an Apple product? Also, M$ phones home constantly, as I see the hard disk light go on and on when I'm not at the computer using it, just letting it idle between tasks, while all of my Macs do nothing, just wait for me. Then, when I scan my computer with SpyBot and AVG, I get list after list of malware, whereas nothing is on Mac. Why? No Active X. If you can site when this "happened" to and Apple product with three different links to prove your statement, then you have room to write something in regards against Apple.
Are you saying disk activity is an indication of phoning home? How does disk activity indicate network activity of any sort? The answer: "It doesn't". The disk activity you are seeing may be part of the disk indexing process, it may be optimization activity used to put the most frequently used executables and binaries on the fastest parts of the disk, it may be any number of things. Unless you actually look at the process manager you just don't know.
You see the hard disk activity light on your computer when you are not sitting there in front of your computer? That's either some amazing powers of vision you have or one humongously large hard disk activity light you have there. :)
And as for you having lots of malware/spyware on your computer whenever you scan for it, have you considered that it is there because of your own action/inaction in the use of that machine? Did you do something silly like click on a popup warning stating your computer was infected and to run a scan now?
Looks like all your problems are brought on by you yourself.
I've been doing this computer thing since 1987 and have yet to have a system compromised by any virus, spyware or malware. I just keep the machines up to date per the OEM' recommendations and don't do stupid things like click on popup boxes or go to untrusted web sites.
So when this all happens to an MS product MS sucks... when it happens to an Apple product its okay?"
You are incorrect. Most Windows exploits happen without user consent or knowledge.
So where is the bug in Safari? If he hadn't clicked the URL he couldn't gain access. This is simply an exploit that can be perpetrated on anyone.
I want to see this clown take over a Mac without any of this orchestrated rigging.
He couldn't do it this year any more than last year. I call b******t.
The entire web is all about links. Anyone can put a malicous link in any forum / blog / comments section and take down any mac user - they end up having to power boot their system.
Explanation of how the hack works and work around to secure your system:
http://rixstep.com/2/20080427,01.shtml
However, if you really want to cry about something Windows fanbois, visit rixstep's page here: http://rixstep.com/2/20090318,00.shtml
Windows, Give it up dude!
Tried the site with IE8. No problems reported- the script failed to run as IE8 detected and warned against it.
Sorry, you fail.
Chrome.
I was responding to getfix's snark
I don't know what your definition of an Apple hater is, but there elements to the Mac I can't say I am particularly fond of. Same for Windows and Linux.
But why hate Apple? The Woz of Apple created the idea for home computers to interface with a keyboard and joystick with a screen having the memory on-board and user able to upgrade easily. Before that, there were Altairs and IMSAI computers that used switches, punch-cards, and teletype machines. If Woz never decided to follow Jobs with Apple, you wouldn't have the ability to use a computer at all. Woz even has the patent for the keyboard as a interface device. Look it up, it's around on the Internet. But make sure the site you're clicking on is the real deal...
There are many examples of Apple users in this thread that do not respect choices or people that expect double standards - eg. [insert outrageous and unsubstantiated claim] but prove me wrong with 3 sources to back it up. I'm not saying Windows users do, I'm saying your point about the 'fanboy' thing is more about the attitude. There are definately Windows fanboys that these sentiments apply to as well. As with EVERY other platform out there.
Burglar given keys to house... then breaks in 2 seconds later!
Wow, how amazing!!! NOT... what a bogus contest...
Doesn't C|Net do any factual news anymore?
Burglar knocks on door and homeowner answers it and invites them in.
It's not the door's fault. It's the people that use it.
this shows why contests like these are so bogus, they don't produce anything of any value, nor are they useful in reality.
Some really stupid people click on those links. Some are not stupid just ignorant. And some are security professionals that are too arrogant to acknowledge that risks and exploits exist even if it involves the user playing some part. Fortunately, contests like this identify these exploits so that all those ignorant people that trust every link they 'think' they can trust are a little safer.
Just use Firefox
I simply don't get the Windows to Mac fight. Everyone sounds like a little kid who nags and teases the other by saying "My thing is better than yours..na na na nag". If I am not mistaken I will be attacked by someone who is loyal to either thing which would prove my point.
I use both OSx and Windows. Both have their fair share of responsibilities that they help me with and both work well. I have mostly had very little problems with both of the OSes. I develop for both and I like having the backwards compatibility with windows as it allows me to use some old software that normally wouldn't have been able to use. With my Mac, I can do a lot of image editing and other stuff that either takes longer on windows and sometimes I can't find the proper software for it simply becoz some software is made excusively for OSX.
In other words what I am saying is, use both of them if you can. If you don't like either one, use whatever works for you.
having learned that safari is good but overall it's still a bit of a Security risk
and opera 10 alpha is fast and has so many usable features that FF lacks
BTW still no Spyware on my Macbook with zero protection and full usage with no fear
on my Wndows Xp desktop I get some on almost a daily basis with mild usage and protection
it also requres Adaware spybot and spy sweeper scans every week to get rid of !
I wonder if real world security is more important or some spoon fed hack in a lame hacker fest
the chances of which happening in real life r close 0.00001% considering Macs aren't even targeted
and BTW still no major outbreaks of virusese on OSX
thats right 10 yrs in and still not even one major outbreak kind strange don't you think
All we know from this competition is that researchers who attended the event know of flaws in each of the major browsers and were able to demonstrate them within the time allowed. As an evaluation of overall application/platform security I don't think that it means very much.
it's easy by facts
still no attacks on Opera or major Security threats on OSX
so it's safe to say OSX is more secure than Windows
and opera is definitely safer than FF or safari
People seem to be forgetting about real world usage
and concentrate on patches and exploits
Who cares how many holes or patches they are ?
as long as u don't get Affected which is a given on Opera and OSX
thats wat matters to me n the end !
And still no viruses or worms.
There doesn't seem to be a way to break into it unless one has physical access to it AND uses a browser.
Even if using a browser, one still can't remotely control the Mac. It's only the browser that is the problem. But then every browser has lots of security holes.
No, you guys do the math. I'll stick to using the safest and most stable operating
system and software available. No anti-virus needed. And no annual reformatting to
keep my computers running.
So you use OpenBSD then? SELinux?
"And still no viruses or worms". Give me your IP address, I'll send some viruses and worms made exclusively for Macs. Don't come around with the argument that Macs don't get viruses or the other way around linux doesn't have any virus. Just becoz you haven't ecountered or seen any doesn't mean that there aren't any.
If you would love to have some viruses, spyware etc. Let me know. I'll help you out. I have got some really nasty ones that I am sure you will enjoy and remember.
Have a nice day.
They know these people are in the business of looking for weaknesses in the OS(s) or web browsers and then they gave them the key to open the door to the house and then they reward them for breaking into the house.
What a bunch of iDiots. Hello in these difficult times giving money to the needy make more sense.
The software maker gets the details of an exploit to their software and the publicity to prompt them to fix the problem.
The hacker gets some money, a prize and some publicity for showing the exploit instead of using it.
The consumer gets updated software that is more secure than it was before.
Remind us where the "bad" is in all this?
Quote: "The Macintosh and base Linux kernel operating systems have dominated the top spots for vulnerabilities by operating system over the past three years".
Source: http://news.cnet.com/8301-1009_3-10154662-83.html
I bet I can find 5 for winblows for each one you can find for *nix. Currently exploited in the wild - hell, I'll even restrict myself to unpatched ones. I'll still win.
Don't misunderstand my "attack" here - NOTHING IS INVULNERABLE. Imperfect human beings are by definition incapable of creating perfection. But there is a difference between "vulnerability" and "exploited in the wild for the last year, causing millions of zombies". And it's not market share either, otherwise OS 9 wouldn't have had any viruses for it either (it did - quite a few in fact).
But if you read the article, those were just "vulnerabilities" not anything that ever allowed access to those OSs. you need to learn UNIX based OSs are far different that the kludge of Windows, that's why nobody has been able to hack or crack UNIX systems. Those are the facts, deal with it...
Nobody has been able to hack or crack unix systems? Excuse me? I hate to be the one to disabuse you of this notion but as someone who's been involved in the unix world for 20 years I can assure you that unix system have been hacked, cracked, pwned, infected, and rooted. Even a cursory review of the literature clearly demonstrates that linux systems have their own vulnerabilities and exploits. Windows may get all the press but it happens in the unix world as well. For example: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=92230
These weren't windows systems that were hacked but top end systems generally running RHEL, CentOS, and other linux variants and were being administered by some of the smartest people in the field. Heck OS11, most of the basic techniques of hacking, cracking, and pwning were developed on unix systems.
Its not like the ring security model is invulnerable.
There are no flawless products. All systems have risks and your role as the user is to be aware of that. Pride always comes before the fall. I know windows is flawed. I know it is a virus magnet. But I acknowledge that and keep it in mind. But i don't pretend my linux system or mac is invulnerable if I want it to stay clean/secure.
Oh, hey hippiemadness - just read OS11's responses - just a good example of what I was referring to. People that don't back up any of their claims but demand 3 references (as someone did in this set of posts) for anyone to 'prove them wrong'. Bah
Just look at the internet. What are most of the main servers running the internet running on.
so you want me to download the src run of the mill UNIX networking or remote access tool
turn it into a RAT
and put it up on TPB
then tell you about it
okay!
*off to work*
- by bgnm March 19, 2009 7:21 AM PDT
- Apple haters make such inane comments! When the only thing they have to say is not worth listening to, they scream it so loudly that it can't be ignored. In so doing, they mostly reveal their limited capacity for rational discourse.
- Like this Reply to this comment
-
-
- by Sporlo March 19, 2009 4:43 PM PDT
- It seems the only thing you have to say is not worth listening to (neither is my comment).
- Like this
-
- by screamapillar March 19, 2009 8:03 PM PDT
- Oh look hippiemadness - another example for you.
- Like this
-
Showing 1 of 2 pages (160 Comments)Also, using that kind of grammar doesn't make you seem smarter. You can't disguise bad content with pretty grammar.