Flash flaw leads to Vista laptop's fall
It held out as long as possible, but a Windows Vista laptop fell to a determined bunch of hackers Friday evening at the Pwn to Own contest at CanSecWest.
Since it was the third day of the contest, which saw a MacBook Air get hacked on Thursday, the TippingPoint Zero Day Initiative relaxed the rules even further. On the first day of the contest, only the operating system could be targeted, but on the second day that was expanded to include standard applications. An undisclosed Safari flaw led to the MacBook Air's downfall.
TippingPoint's Aaron Portnoy, with Shane Macauley and Alexander Sotirov (left to right) take control of a Windows Vista laptop.
(Credit: TippingPoint)But on Friday, hackers could target any "popular" piece of application software that you might find on a system. The Fujitsu laptop, running Vista Ultimate, was compromised by a previously undiscovered flaw in Adobe's Flash software.
Shane Macaulay, Derek Callaway and Alexander Sotirov, were able to gain control of the laptop, which also means they get to keep it. However, since the rules had been relaxed, they only get $5,000; the MacBook Air winners collected $10,000.
The contest rules stipulated that any winner sign a nondisclosure agreement immediately after a successful hack, so that the nature of the flaw could be disclosed to the vendor. Once Adobe and Apple patch their flaws, the nature of the flaw will be disclosed.
A Sony Vaio laptop running Ubuntu remained unscathed at the end of the conference.
Tom Krazit writes about the ever-expanding world of Internet search, including Google, Yahoo, online advertising, and portals, as well as the evolution of mobile computing. He has written about traditional PC companies, chip manufacturers, and mobile computers, spending the last three years covering Apple. E-mail Tom. 
There's several possible reasons for this:
A) Linux security was too tight
B) It's a Sony Vaio- nobody wanted it
C) No money for hacking it (the money was in the Apple and Vista systems, not Linux)
I'm not sure what the answer is there. Spin it how you want, it doesn't make a bit of difference in the end.
5) there's more to be gained from hacking Windows
6) just dumb chance
7) as the machine (different from the Apple one) was hacked not through an OS vuln but through an app vuln, the fact that there are more "common" windows applications than Linux applications opened more doors
8) ...
I can think of a few more if I try. Which obviously you didn't.
reasons-why-cansecwest-targets-apple/
Funny how that works.
XP and Vista get owned thousands of times daily. Yet little here.
hmmm....
http://www.cansecwest.com/sponsors.html
Following your flawed logic, I suppose Adobe did not pay off the hackers enough since their software was the vector for the Vista attack.
due to a flaw found in an application, not the OS and involved as
well as required social engineering to make it happen, the same
thing that happened to the Windows laptop!
reasons-why-cansecwest-targets-apple/
Oh, wait... Microsoft didn't win either - by your logic, Ubuntu did (which incidentally is a desktop distro, and rarely used as a server OS variant).
Maybe the headlines should read about how Linux won and Microsoft lost instead?
/P
So we see as usual here, Microsoft BAD, whisper something about Apple but not enough for anyone to think we're speaking ill of them, and tout the greatness of Linux!
If your going to report, at least try to show a pretext of journalistic integrity. This is exactly why MOST people do not consider bloggers journalists or even reliable.
part=rss&subj=news&tag=2547-1_3-0-5
they already reported the macbooks fall. And look at the title.
Macbook Air hacked in security contest. That doesn't look good
for apple...
Or this one?
"The flaw is in something else, but the inherent nature of Java allowed us to get around the protections that Microsoft had in place," he said in an interview shortly after he claimed his prize Friday. "This could affect Linux or Mac OS X."
Hmmmm. I thought so...
Check the Symmantec site and dig up their '07 report. They call Vista "possibly the most secure [commonly used] OS available".
ADOBE on the other hand seams to be on long running losing streak across the Flash and Acrobat product lines.
Note:Vista/IE7 runs in sandboxed mode and was not hackable.Flash is an Adobe product.
Note: Latest news bashed Apple for not patching code promptly like MSFT does. Steve Jobs is a bald-faced and bald-headed liar.
P.S. Real world use... I have NEVER in 20 years of owning a Mac (I
have 5 of them now in my house) used ANY virus software and I
have NEVER had any problems or reinstalled my OS or restored
anything or had to wipe the drive clean and start over. I think
most Windows uses have to fess up to doing at least one of
those a year. I had one (an OS 9 Mac laptop) that I took with me
everywhere, internationally, and never even had a blip out of
that machine for seven years before I retired it. I'd say that's
impressive and shows the quality of Apple hardware.
The code is not from 1969. Unix has been constantly updated. At least make your lies plausible.
Stop being chumps, people. Open source software works, it is free, and it is demonstrably more secure than the costly black-box systems like Windoze.
Think Linux is complicated? My nine-year-old just installed Ubuntu for my 74-year-old father-in-law, a man with no computer experience to speak of. The total installation time was about 25 minutes, and Ubuntu automatically detected all of his hardware, including an HP 3940 printer (and shared it!) all without any hitches or problems the first time through. My father-in-law is tickled at being able to just turn on his computer, have it boot up in 40 seconds, and just use his computer rather than spend his time dealing with problems and my son is happy that he doesn't have to spend his time fixing granddaddy's computer any more.
know compile routines? the thing that is keeeping masses away
from linux is apps and ease of use, will itunes work for him? and
please lets not get all high n mighty about drivers, we know the
truth.
> 74-year-old father-in-law, a man with no computer
> experience to speak of.
Ubuntu (and any Linux-based OS) is CLI-based system. There are hundreds of tasks which require "compiling" or do some commands. For example - to diagnose error messages of specific app (Azureus?) which displays error messages only when started from command line and simply disappearing when started by the click on the icon.
Recently I have to configure IrDA connection and Internet access by GSM phone - try to do in in Ubuntu WITHOUT command line.
What interest do you have in spreading lies ? GNU/Linux systems ARE difficult to maintain, much more difficult than Windows and still required toying with command line.
Are you run "Linux support company" and want more customers, who cannot do trivial maintenance task in that "1-click-systems" ?
Ubuntu and similar distros are great OSes, but saying that "everything is configurable in them by clicking" is simply act of misinformation and fraud.
I absolutely agree with your statement which I pasted above.
mahurshi
~From a noob 'nix user via winbloze
1. No IE x64 Flash
2. Flash crashes Vista IE all the time
3. It took forever to get even a marginally OK Vista Flash
4. Acrobat still doesn't fully support the Vista UI
Adobe hates MS, it's clear, but the millions of Vista users will eventually go elsewhere for these solutions. Adobe doesn't have the market power to prevent Vista migrations forever.
which is militant about licensing, insanely expensive, bloated, and
less user friendly with each release, Adobe is the new Microsoft.
It was only possible with user intervention. People that use macs
are stupid, and so in the real world the flaw doesn't matter...:)
So therefore macs are still better, always will be. Windows eats Mac
s*** for breakfast, and likes it.
reasons-why-cansecwest-targets-apple/
http://www.roughlydrafted.com/2008/03/29/mac-shot-first-10-
reasons-why-cansecwest-targets-apple/
osnews-calls-?mac-shot-first?-misinformation-and-slander-
oops/
QED: Vista is vulnerable.
...meanwhile, the Linux-based box remains (naturally) unscathed... :)
/P
http://www.desktoplinux.com/news/NS2702127176.html
you read it right it from desktoplinux site, at least you can't say they have a pro Vista bias. Obviously no one can confirm that till the vulnarability is made public.
'nuf said on that subject.
http://www.desktoplinux.com/news/NS2702127176.html
its from desktoplinux site, at least one can't say they have a pro Vista bias. Obviously no one can confirm that till the vulnerability is made public.
Desktop Linux states the possibility, but no actuality (and obviously it didn't break on the Ubuntu box, so...)
/P
Would the same flaw affect Windows, Linux.. if yes, the research is using Apple's popularity to instead of pointing the blame where it should... Open Source?
Just questions....
http://www.flickr.com/photos/kool_skatkat/
- No good researcher?
- by kool_skatkat April 1, 2008 1:47 AM PDT
- On their site, they've only got two things in 9 months to brag about. They both had to do with Safari. MMM... Gold-diggers ridding on Apple's success? Or who's paying them?
- Reply to this comment
-
(119 Comments)March 27, 2008
ISE wins Pwn to Own at CanSecWest by taking over a MacBook Air.
July 23, 2007
ISE discovers security vulnerabilities in the iPhone.