Feeds

Apple security team adds British white hat hacking talent

From Redmond to Cupertino for Kristin Paget

Build a business case: developing custom apps

Apple has added to its growing security team with the hiring of noted white-hat hacker Kristin Paget, who broke and then got hired to fix Windows security, Wired reports.

Kristin Paget, formerly Chris and originally from the UK but lately of California, is the inventor of the term "shatter attack" in a 2002 paper on a system for privilege-escalation attacks on applications in Windows NT, 2000, and XP operating systems. Microsoft issued a partial patch for the problem in December, but it wasn't finally fixed until Vista came out.

One of the reasons for that fix was that Redmond had made the canny move of hiring Paget and a team of other hackers to beef up the security on Vista. They gained renown – and caused Microsoft not a little aggravation – by delaying the launch of Vista after finding a critical security failure at the last minute.

Paget has made a name for herself with a number of interesting hacks across the technological spectrum outside of the world of pure software. In 2007 she was forced to pull out of a Black Hat conference talk on hacking building entry systems under threat of legal sanction from a major US RFID manufacturer.

A few years later, she showed off a $250 proof-of-concept device that cloned three passport card RFID tags during a 20-minute drive in downtown San Francisco. Later that year she demoed a $4,000 prototype that could match the random channel-hopping systems used by GSM, allowing extended eavesdropping.

At the 2010 DefCon security conference, Paget set up a spoof GSM base station in the conference hall that hacked many of the audience's phones and left them messages telling them their security had been compromised. All participants had been warned beforehand – Paget's good, but she's strictly white hat.

Paget has worked at a variety of security consultancies since her sojourn at Redmond, but in July she announced on her Twitter feed that she was looking for another job. "I've done too much breaking of things, it's time to create for a change," she said.

It now appears that Apple has scooped her up as part of its attempts to beef up security and fend off a growing malware threat. Cupertino has been quietly hiring security experts for a few years now, although many haven't lasted long at the company, citing Apple's tricky corporate culture.

While Paget has been a regular on the DefCon/Black Hat/Shmoocon hacking conference circuit, it's not clear whether her new employers will allow her to continue. Apple's first presentation at Black Hat this year was widely mocked as insultingly low in information, whereas Paget is more of a full-disclosure type of person.

Nevertheless, Apple has itself a valuable asset in Paget, and it's going to be interesting to see what kind of changes will sneak into iOS and OS X that come from their new hire. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Know what Ferguson city needs right now? It's not Anonymous doxing random people
U-turn on vow to identify killer cop after fingering wrong bloke
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.