Comments on: Safari hole exploited in seconds at security conference
Charlie Miller, who won a contest by hacking a MacBook Air last year, exploits a security hole in Safari within seconds at the CanSecWest security conference.
Most Popular
15 sites that went kaput in 2009
Web sites launch all the time, but they also shut their doors. We highlight 15 that bit the dust this year.
Top 10 news stories of the decade
Let the debate begin: Was the iPhone more important than iTunes? Was anything bigger than Google finding a great business model? CNET offers its list of the 10 most important stories of the '00s.
About Security
Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.
Add this feed to your online news reader
Security topics
[CNET editors' note: Prohibited content deleted.]
The bigger problem is that this contest is poorly run. They allow you to bring in work you've already done. Most security contests don't announce to everyone the setup well in advance so people can work on it before the stopwatch ever goes off. All this is is a contest to see who can execute a hack they worked on well in advance of the contest the fastest.
those rules would be much more fair, real world and interesting.
Next month all Mac users will be safer online because of this (Apple is typically pretty good at patching problems like this fairly quickly). How long has winblows users been fearful of that ex-hell exploit that's making the rounds now and remains unpatched by M$? How much longer will they have to wait?
The way that TippingPoint has kept this contest in the headlines over the last few years is by tweaking the contest to get quick exploits. I couldn't help but notice that this year seems to be targeting applications, browsers specifically, and not the OS's directly as in previous years. The reason seems obvious - no one was bothering on the OS exploits and simply waiting for the easier browser exploit days. So ....
I think this is a great thing myself. The software maker gets prompted to fix the problem with the headlines the contest is generating and gets the details of the exploit (so they know what they're fixing). The consumer gets an update to their software (hopefully sooner rather than later) and in the end is more secure using it. The hacker gets some dough, a prize (laptop) and publicity WITHOUT doing any actual harm to anyone.
I can't see anything bad about this at all, even if it is a little "rigged".
I would agree with your statement if he wasn't a security researcher getting paid to do this work in the first place. He works for ISE, a security research firm. This is basically a bonus for him, or getting paid twice for work he did once. It's bad form for him and worse for ISE as they would seem to condone his actions by proxy.
If he turned to "the dark side" ie, went blackhat and released his exploit into the wild I would expect that he turn in his badge at ISE at the same time.
@Dalkorian
I would agree with your statement if he wasn't a security researcher getting paid to do this work in the first place. He works for ISE, a security research firm. This is basically a bonus for him, or getting paid twice for work he did once.
----------------------------------------------------------------
We might have to agree to disagree on this one. How many times to musicians get paid for their music? I don't have a problem with him getting a bonus for his work at all since his work is in the end making the world (well, internet:)) a better and more secure place.
As for if he turned black-hat, I wouldn't expect him to necessarily turn in his badge. That would take honesty and integrity, which might arguably be lacking on the dark side of the force.
;-)
if there ever is a contest like that
sign me up!
I need a 100k
*writes virus and waits*
Patches are good - they're attempts to acknowledge and fix issues caused by the fact that no one (not even a group of people) is perfect.
Exploits in the wild are bad.
There will always be humans who figure out your code, because there are allot of really SMART people out there, smarter than you, whoever you may be.
That said, a little proactive prevention will go along way to protecting us small fish in the pond.
Staying away from certain web sites will help too.
Also, since Safari has proven so vulnerable over the last two contests, I'd like the option of a different browser for my iPhone. While I doubt someone like CNET's Tom Merrit would send out a malicious link on Twitter, I'm not so sure about Scoble :-) or a few of the other digirati that I follow.
And where did it say root access...?
There is this foolish perception propogated by Apple users that Apple is all sweet and pure and creative and good where Microsoft is evil and a menace to society. Now while the latter is probably not far from the truth, the former is fatally flawed. They are all out to get your money and don't give a stuff about you. Stop pretending Apple are the good guys, they are just as disgustingly anti-competivive with their useless and overpriced accessories as anyone else.
The problem is the perception of arrogance and attack that many Apple users have. So as a defence, users of all of the other platforms (that just get bunched together by Apple users as 'other miscellanious inferior products') retaliate. It is a response. There is NO perfect system and no Windows person or Linux person will say their system is perfect, only that it works for their particular needs. Apple people often say theirs is perfect. That is the difference.
Not all Apple users do this mind you. I am a good example. However, even I am jacked of the Apple users around me. iPods are not perfect. I personally prefer mine over the rest but that is it. Macs are not perfect. In fact, I prefer my Mac for some tasks and my PC for others. YES I prefer my WindowsXP PC to the Mac for many applications.
The problem here is some people get fanatical and the rest of us respond to that because we are sick of it. It is not isolated to Apple vs. PC. Take a look at some of the PS3/Xbox/NES forums... sheesh. Just get your favourite product isn't best for everyone, it is just best for you. We aren't all suddenly undeducated hillbillies just because we have other uses or preferences.
And no we're not suddenly "uneducated hillbillies", we're "uneducated INBRED hillbillies". It makes all the difference in the world.
Oh, and my OS *CAN* beat up your OS any day of the week. ;-)
And I agree with you 100% Dalkorian. I guess I'm just sick of the whole 'mine is better' attitude. I use both platforms (pc and apple and both windows/unix on pc) and see pros and cons with both. I think those that worship Mac really don't use a good Windows or linux PC. And vice versa (those that hate Mac haven't used one). What bugs me about Apple fanatics is this perception that Apple is wholesome and good while Windows is evil. (I'm yet to meet a person who - even if they love windows - doesn't hate M$, when I find one I guess I'll be in shock. Most PC lovers love linux and concede the practicalities of M$... not saying M$ lovers aren't out there...) But my summary here is they (apple and microsoft) are both evil!! Once people realise that both of them are anti-competitive nasty corporations that having nothing but their bottom line at heart, then lets all sit down and have a constructive conversation. I love my Mac, really, I do. I just hate the hype around it. But guess what, I love my windows box too and yes, my windows box has better specs for about a quarter of the price and runs better than my Mac on the programs i use it for. And yuppers, my Mac runs better on the programs i use it for (although iTunes is pushing me so far over the edge I'm ready to convert...) There are things that drive me nuts about my windows box (eg. could xml be a worse more bloated language if it tried??) but same with the Mac. Its all semantics at the end.
Moble Me anyone ??? Bwahahahaha !
No, did I really just do that? Did I really just toss a bone to an obvious troll? Hey, even trolls need to eat sometimes I guess ...
I guess that is it though isn't it? I just try to take all those thing into account. I'm still running XP because I hate 'dial home' vista. But I have the same philosophy with iTunes, my god, every upgrade makes it crapper than the pervious version so I've become resistant to upgrading. Particularly if it is another 'ooo let me re do the gaps between tracks - you'll now lose your computer for the next year while I do this...' upgrade (/seethe) To bad if I want to use iTunes. The practicality of windows is what I use it for - i need it for work. I need it because I'm an avid gamer. Simple.
- by goodgawdman September 16, 2009 12:39 AM PDT
- its all lies! MACS are unhackable!!
- Like this Reply to this comment
-
Showing 2 of 2 pages (160 Comments)