Original URL: https://www.theregister.com/2007/04/23/mac_vuln_contest/
A Mac gets whacked, a second survives
CanSecWest PWN to Own contest beaten
Posted in Security, 23rd April 2007 10:56 GMT
Shane Macaulay strode into the conference hall at the CanSecWest conference on Friday afternoon, balancing a MacBook Pro on his palm and making a beeline for the table displaying two more of the silver laptops.
The well-known security researcher had just spent the morning testing an exploit designed to take advantage of a vulnerability in Apple's Safari browser. He set down his MacBook, connected to the network and started up a web server from which he would host the attack. A conference staff member entered a URL into the Safari browser running on the target machines and, just like that, Macaulay took control of the machine and became the first winner of the CanSecWest conference's PWN to Own contest.
With the hack, Macaulay laid claim to one of two MacBook Pros offered up as a prize to the anyone who could compromise them. While the flaw required some user interaction, the conference organisers, as well as every security researcher interviewed for this article, ranked the vulnerability as a critical flaw and a real threat.
"This is more realistic," Macaulay said of the exploit. "Everyone is going to be behind a router, so you are not going to have a chance to use a fully remote exploit."
The flaw threatens everyone running the Mac OS X, even after applying a patch that Apple released on Thursday.
The user-level exploitation of the MacBook ended the a day-long wait for a security researcher that would part with a remote zero-day flaw to exploit the Mac OS X. Yet, most researchers did not even consider attempting the feat until TippingPoint, the security division of networking giant 3Com, sweetened the pot with an offer to buy the winning exploit for $10,000, a figure that is more in line with the value of vulnerability information.
Macaulay would not see the money, however. More than 2,000 miles away, the flaw's actual discoverer, Dino Dai Zovi, had laid claim to the cash as part of a deal with Macaulay.
Reached by phone, Dai Zovi sounded tired. Macaulay had called the former security researcher - now a security manger at a financial firm whose name he was unwilling to disclose - on Thursday night and asked if he had the time to find a flaw that could compromise the fully-patched MacBooks. The deal would be simple: Macaulay would get the MacBook, Dai Zovi the cash.
At about 10 pm, the New York City-based security expert sat down and started looking in likely places for a serious bug that could satisfy the challenge. Several months ago, he had done some poking around the Mac OS X's operating system and applications looking for vulnerabilities and found a few promising places in the software that could hide flaws, Dai Zovi said. Checking the suspect code early Friday morning, Dai Zovi discovered a single flaw.
"I only found one," he said. "But by later that morning, I had a working exploit."
Despite their success, Dai Zovi and Macaulay are not maintaining that the Mac OS X is any more or less secure than, say, a Windows Vista system or some variant of Unix. While Macaulay uses a MacBook installed with Windows Vista, Dai Zovi considers himself a Mac fanboy and uses Macs regularly. The contest just shows that Mac users have to worry about vulnerabilities just as much as other computer users, Dai Zovi said. It's a fact of life with which all security experts are familiar, but to which some Mac users seem resistant.
"It works. It is real. This is not something that I have made up," Dai Zovi said. "It seems that a lot of people harbour the belief that the Mac doesn't have these problems, but it does."
The Safari flaw is approximately the same severity as the recent animated-cursor vulnerability recently fixed by Microsoft and used widely in attacks by groups that appear to operate out of China and Eastern Europe. The flaw was rated critical by Microsoft.
Browser flaws are fairly easy to find, said HD Moore, founder and developer for the Metasploit Project. Moore used data-fuzzing techniques to find a large number of flaws in internet browsers a year ago, releasing them as the Month of Browser Bugs in July 2006.
"It makes it a lot easier to find a flaw," Moore said. "There are so many (similar) bugs in Safari."
Yet, Moore and others gave mixed responses comparing the security of the latest Mac and Windows operating systems. Macaulay favoured Windows Vista for security, but Dai Zovi said the Mac seemed to be the more secure platform, but acknowledged that the reason could be because the operating system has far less marketshare.
"While the Mac does not have problems with widespread malware like Windows, if they had that kind of marketshare they would have similar issues," he said. "But, by the time they do get the marketshare, they should be on a trajectory to have much better security than Windows."
There is still a way to go: Amidst the bustle of cleanup, two security engineers from networking firm Juniper frantically raced to beat the clock and churn out code to reliably exploit a second bug, this time a truly remotely exploitable flaw in the Mac OS X.
The two engineers described the bug as a "really weird" heap overflow in a default service on the Mac. TippingPoint confirmed that the company would pay a second $10,000 bounty for any zero-day flaw that compromised the other system. The two engineers had already decided to give the money to a charity fund at Viriginia Tech, where 32 students and faculty had died last week in the United States' worst school shooting.
Yet, the two engineers, who asked not to be identified, couldn't get the exploit to work. Around 6pm, the conference staff pulled the plug.
After the conference, CanSecWest organiser Dragos Ruiu acknowledged that he may have miscalculated the interest that free MacBooks would generate. Money should have likely been a prize right from the start.
"It is interesting to me that it took a cash prize to bring the flaw out of the woodwork," he said.
For his part, Dai Zovi said the money was not necessarily the object.
"I have a day job in finance, so I'm not hurting," he said. "I think there has been a lot of controversy over Mac vulnerabilities in the last year, and I was hoping to prove something concrete."
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus