News, info, and opinion by Mac users, for Mac users.

April 23, 2007

security

Mac hacked at CanSecWest

Posted Apr. 23, ’07, 5:13 AM PT by Derik DeLong
Category | Security

CanSecWest We’ve got a new security saga for consumption here in the Mac community. It’s been a while and we’re likely to see some old names and faces to surface in the following weeks (I’m hoping that exaggeration, but I doubt it will turn out to be). A MacBook was hacked at CanSecWest.

The conference organizers decided to offer the contest in part to draw attention to possible security shortcomings in Macs. “You see a lot of people running OS X saying it’s so secure and frankly Microsoft is putting more work into security than Apple has,” said Dragos Ruiu, the principal organizer of security conferences including CanSecWest.

Initially, contestants were invited to try to access one of two Macs through a wireless access point while the Macs had no programs running. No attackers managed to do so, and so conference organizers allowed participants to try to get in through the browser by sending URLs via e-mail.

Allow me to point that they changed the rules when it turned out no one could accomplish the goal, they changed the goal. The hack basically comes down to this: If someone visits a maliciously crafted page in Safari (or Firefox according to Matasano), it can trigger a remote shell for an attacker on that machine. While that could be coupled with a privelege escalation problem (a user on the system can get root without permission) for serious damage, that shell is as the user using the web browser. Turning off Java reportedly will avoid the problem.

Now for some off the cuff analysis. You need to surf to a bad page. However, due to the lack of details, we don’t know if people will be able to embed the necessary content into websites like MySpace, etc. Matasano is leaking pieces of information in chunks (and putting in fancy bold type “EXCLUSIVE: MUST CREDIT MATASANO” like ten times). He says you might want to turn off everything under Web Content, including JavaScript and plug-ins. The JavaScript bit doesn’t have much traction because unless that would rely on Safari and Firefox both having a common implementation flaw in their independent codebases. It’s not impossible, just unlikely. The flaw, most logically, is in the Java Virtual Machine for Mac OS X. That would make it apply to basically any Mac web browser. The current information also says nothing about whether a hardware firewall would prevent the remote shell access (which would make this pretty impotent for most Mac users).

We’re still early in the saga, so stay tuned to (Java free) MacUser for more details as they’re revealed. If you want to stay safe, turn off Java (just a sidenote, OmniWeb allows for globally turning off Java while enabling it for specific websites, a feature I’ll be using for now).


4 Comments

Greg said:

Or you can use Opera (hopefully)

April 23, 2007 5:50 AM
Dave said:

Say what you will about agendas or changing the rules, they have gone to a great effort to provide enough information to avoid panic and allow you to protect yourself without giving hackers enough information to exploit the hole. They are also talking to Apple to get a fix as soon as possible. Contrast with the irresponsible egoism of the MoAB.

April 23, 2007 7:18 AM
Walt Basil said:

ooo... good tip on that OmniWeb preference. I use it for 99.9% of my browsing. Matter of fact, there is only one web site I go to that I have to use Safari. Yes, OmniWeb allows custom settings for everything for each and every web site you visit.

April 23, 2007 8:10 AM
peter said:

I find it remarkable that the contest rules had to be altered before the Mac could be hacked. I also think it’s worth pointing out that Microsoft is one of the chief sponsors of the CanSecWest conference.

April 23, 2007 8:27 AM

Leave a comment

 



IDG IDG NETWORK:   CIO   Computerworld   CSO   GamePro   GamerHelp   IDG Connect   Infoworld  
   JavaWorld   LinuxWorld   Macworld   Network World   PC World   PC World Canada   Playlist   Techworld