Feeds

Apple security team adds British white hat hacking talent

From Redmond to Cupertino for Kristin Paget

Internet Security Threat Report 2014

Apple has added to its growing security team with the hiring of noted white-hat hacker Kristin Paget, who broke and then got hired to fix Windows security, Wired reports.

Kristin Paget, formerly Chris and originally from the UK but lately of California, is the inventor of the term "shatter attack" in a 2002 paper on a system for privilege-escalation attacks on applications in Windows NT, 2000, and XP operating systems. Microsoft issued a partial patch for the problem in December, but it wasn't finally fixed until Vista came out.

One of the reasons for that fix was that Redmond had made the canny move of hiring Paget and a team of other hackers to beef up the security on Vista. They gained renown – and caused Microsoft not a little aggravation – by delaying the launch of Vista after finding a critical security failure at the last minute.

Paget has made a name for herself with a number of interesting hacks across the technological spectrum outside of the world of pure software. In 2007 she was forced to pull out of a Black Hat conference talk on hacking building entry systems under threat of legal sanction from a major US RFID manufacturer.

A few years later, she showed off a $250 proof-of-concept device that cloned three passport card RFID tags during a 20-minute drive in downtown San Francisco. Later that year she demoed a $4,000 prototype that could match the random channel-hopping systems used by GSM, allowing extended eavesdropping.

At the 2010 DefCon security conference, Paget set up a spoof GSM base station in the conference hall that hacked many of the audience's phones and left them messages telling them their security had been compromised. All participants had been warned beforehand – Paget's good, but she's strictly white hat.

Paget has worked at a variety of security consultancies since her sojourn at Redmond, but in July she announced on her Twitter feed that she was looking for another job. "I've done too much breaking of things, it's time to create for a change," she said.

It now appears that Apple has scooped her up as part of its attempts to beef up security and fend off a growing malware threat. Cupertino has been quietly hiring security experts for a few years now, although many haven't lasted long at the company, citing Apple's tricky corporate culture.

While Paget has been a regular on the DefCon/Black Hat/Shmoocon hacking conference circuit, it's not clear whether her new employers will allow her to continue. Apple's first presentation at Black Hat this year was widely mocked as insultingly low in information, whereas Paget is more of a full-disclosure type of person.

Nevertheless, Apple has itself a valuable asset in Paget, and it's going to be interesting to see what kind of changes will sneak into iOS and OS X that come from their new hire. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.