Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Researchers Exploit Safari Security Hole in Five Seconds at PWN2OWN

There is a guy at work here who will definitely send me the link about this (having not read the whole thing) as he absolutely loves it when these stories come out. :p

It really is tiresome setting him straight.
 
jav6454 said:
The exploit itself took five seconds, but all the preparations and knowledge behind it took more than five seconds. At minimum it took them 1-2 days of nonstop work.
Click to expand...

Which is true of nearly all exploits, and is beside the point. If people are looking to break into a Mac using Safari, they're going to be able to do it, and you the user would be unaware when they've been successful.

The key thing is that Snow Leopard still has some serious short comings when it comes to security, and in this area Apple are lagging.

Also, it took a malicious website to crack in. In other words, be a safe user and don't visit dodgy websites.
Click to expand...

Or visit websites that show banner ads as they can be used to execute exploits, or don't visit websites that have been compromised, or ...

You have no a-priori knowledge that a site is clean until after you have already visited, and then only if you audit what the site delivered. Otherwise you're just living in denial.

Yes, this is true for all OSs. No, OSX 10.6 is *not* as secure as newer Linux distros or Win7.
 
Popeye206 said:
We go through this every year. :rolleyes:

Here comes all the trolls to chime in!
Click to expand...

really. I more see post like as blind fanboys putting their head in the sand and screaming NOT HAPPENING.

How many years in a row is this that OSX is the first to fall.
I will say I am glad Apple is starting to wise up and reach out to Devs and groups like this for Lion. It seems Apple has finally figured out that its "security by obscurity" is going to start failing in soon and they are taking what time they have left to really clean itself up.
Reason "security by obscurity" is going to start failing is Apple is becoming more popular gaining market share and it knows is iOS is going to start being targeted in larger numbers which could have a direct effect on OSX being targeted.
 
Penfold2711 said:
I think Steve has realised that since the move to Intel the Mac has become a target since due to the past Mac doesn't get viruses Windows does moniker, Lion will be focused now on limiting the use of such backdoors.

Im not to bothered in the security hole with Lion as if i don't trust the site i won't get lured there thats the only reason for viruses backdoors etc working

Human error not machine or OS failure is the key
Click to expand...

What does the switch to Intel has to do with Viruses? Windows Viruses still won't run under MacOS since they are written for Windows. A virus is usually written to target a specific OS (exception MS Word Macro Virus, but not sure how much harm they could do on a Mac). Don't think there is an 'intel-chip' virus that works independent from the OS.


Anyway: It good that they look into finding security wholes - that will make Apple fix stuff and it will be fixed before others write maleware to exploit it.
 
Rodimus Prime said:
Reason "security by obscurity" is going to start failing is Apple is becoming more popular gaining market share and it knows is iOS is going to start being targeted in larger numbers which could have a direct effect on OSX being targeted.
Click to expand...

Security by obscurity is not descriptive of market share. You're misusing the term.

Since OSX is heavily built around open source code, a more appropriate term would be security through inconsequence.
 
0815 said:
Anyway: It good that they look into finding security wholes - that will make Apple fix stuff
Click to expand...

Yes.

and it will be fixed before others write maleware to exploit it.
Click to expand...

No. Apple need to be much faster about pushing security patches. Bloody iTunes seems to get an update every couple of weeks or so. Safari can sit with known security holes for months at a time.

Apple need to be pushing security updates on at least a bi-weekly basis.
 
I wonder how much this has to do with the switch to the X86/X86_64 ISA versus say the PPC ISA: http://www.techrepublic.com/article/will-apples-switch-to-intel-processors-mean-less-secure-macs/6039377

Penfold2711 said:
I think Steve has realised that since the move to Intel the Mac has become a target since due to the past Mac doesn't get viruses Windows does moniker, Lion will be focused now on limiting the use of such backdoors.

Im not to bothered in the security hole with Lion as if i don't trust the site i won't get lured there thats the only reason for viruses backdoors etc working

Human error not machine or OS failure is the key
Click to expand...
 
Žalgiris said:
Which is media coverage and sitting on a security hole for months in order to get money instead of reporting it. Pathetis if you ask me.
Click to expand...

Why should they work for free? Do you? There's far less savoury ways they could be profiting from their skill-set, and rather handsomely too.
 
SimonTheSoundMa said:
Most people want to hack Macs first at this event, because you win the computer you did the hack on. Dell and HP machines are less popular to hack first.
Click to expand...

That's blatantly untrue. The first one to hack a computer gets 15,000$ and that computer. If the Dell or HP was easier to heck, you'd be a darned fool to go after the Mac. Let's see, a 2000$ computer, or 15,000$ and a 2000$ computer... hum... Hey, let's not hack the easiest one and go for the Mac!

The reason people hack Macs first has no link whatsoever to trying to own a Mac. You can buy many MBAs or whatever they had this year with the 15,000$ you win if you're simply first.
 
The only mitigating factor in this is that it doesn't include privilege elevation. That's not to say it's good that Safari has such a gaping hole in it, but at least the underlying OS provides some protection once you've been compromised.

It's another reason not to have admin rights on your normal login (although I'm not sure how many people actually follow that basic advice)
 
jon08 said:
How did Firefox and Chrome do?
Click to expand...

Chrome was the winner... again. 3rd year in a row I believe (which is a new record). It has not be hacked. Google offered $20,000 to anybody who could hack it this year.

There was only ONE person brave enough to try Chrome this year, and he ended up being a no-show (rumor has it google had him assassinated).

But yeah, Chrome is (according to PWN2OWN) the safest, while safari fails.
 
adbe said:
Why should they work for free? Do you? There's far less savoury ways they could be profiting from their skill-set, and rather handsomely too.
Click to expand...

So yeah if i see someone stealing something the first thing i ask when i call police is how much can i get? Stop joking.
 
z3r0 said:
I wonder how much this has to do with the switch to the X86/X86_64 ISA versus say the PPC ISA:
Click to expand...

I think it's pure market share personally. Grey hats are going after OSX cos it makes news now. Black hats will follow the dollars. Why ignore 10% of the US market, especially if that 10% is looking increasingly like low hanging fruit?
 
Rodimus Prime said:
really. I more see post like as blind fanboys putting their head in the sand and screaming NOT HAPPENING.

How many years in a row is this that OSX is the first to fall.
I will say I am glad Apple is starting to wise up and reach out to Devs and groups like this for Lion. It seems Apple has finally figured out that its "security by obscurity" is going to start failing in soon and they are taking what time they have left to really clean itself up.
Reason "security by obscurity" is going to start failing is Apple is becoming more popular gaining market share and it knows is iOS is going to start being targeted in larger numbers which could have a direct effect on OSX being targeted.
Click to expand...

My head is far from in the sand Rodimus. I'm glad to see Apple working on avoiding the issues that have been around forever with viruses on PCs.... but like it or not, we're still virus free on the Mac and I don't think "Apple just figured it out" otherwise we'd be toast already.
 
Žalgiris said:
So yeah if i see someone stealing something the first thing i ask when i call police is how much can i get? Stop joking.
Click to expand...

Your analogy is stupid. Either you have no concept of how skilled these guys are, or you're too blinkered to think straight.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back