Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Researchers Exploit Safari Security Hole in Five Seconds at PWN2OWN

lowbatteries said:
This thread is long on crappy analagies and short on facts.

1. OS X with Safari 5.0.3 was hacked in 8 seconds by an exploit that took a multi-person team 2 weeks to prepare.

2. Windows 7 with IE8 was hacked by a one-man team whose exploit took several minutes.

3. Safari has been patched before the contest was over and the exploit no longer works.

4. Microsoft is releasing IE9 on Monday (not sure if it fixes the exploits).

So, Google sponsors a hacking event, and they release a huge update to their browser, and then "freeze" the versions, so hackers have to attack old versions of competitors browsers, but a brand new version of their browser. Pretty transparent.

These events should not be fodder for petty flame wars.
Click to expand...

Time to apply the same rule to point #2, that you applied to point #1.


The IE guy was also prepared.

http://www.zdnet.com/blog/security/...indows-7-hijacked-with-3-vulnerabilities/8367

Fewer said it took about five to six weeks to find the vulnerabilities and write a reliable exploit. ”Writing the exploit was the tricky part. It was very time consuming, especially bypassing protected mode,” he added.
Click to expand...
 
Surely said:
Perhaps it took five seconds to implement, but it's not like it was the first time these hackers saw a MBA and Safari.

I'm sure there were dozens or hundreds of hours worth of research and coding in order for these guys to get to the point of being able to implement their hack.


I remain unconcerned.
Click to expand...

God, Apple has their hooks deep into you brother. This is troubling in that the main browser of the ecosystem is so riddled with holes and flaws. No browser is perfect...but 5 seconds? Wow.
 
dejo said:
Sorry, I was just joking. Windows 7 is quite capable. Immediately should be significantly faster than 20 minutes is what I was trying to imply.
Click to expand...

Sorry, It's just I went through 2 years of College with a class full of people who refused to touch any tech Non Apple, and would sneer at me and make unkind remarks about me and my Windows Laptop, usually about being poor, a point disproven by my £1,300 laptop.

So whenever someone aims a dig at Windows in my direction, even as a joke, I just sign, broken... And fail to see the humour.
 
Protection Racket

longofest said:
Apple's recent "reaching out" by offering Lion to security researchers may not be enough.

The rest of the industry pays researchers when they find vulnerabilities and they privately disclose them to the company without making them public before they can be patched. Apple does not. For that reason, Charlie Miller no longer reports bugs to Apple (http://tinyurl.com/5tfee7w).
Click to expand...

"Christ, what an *******."
 
Benjy91 said:
Sorry, It's just I went through 2 years of College with a class full of people who refused to touch any tech Non Apple, and would sneer at me and make unkind remarks about me and my Windows Laptop, usually about being poor, a point disproven by my £1,300 laptop.

So whenever someone aims a dig at Windows in my direction, even as a joke, I just sign, broken... And fail to see the humour.
Click to expand...

Heh, they made fun of you for "not having enough money"? I think that in itself would make their taunts meaningless (like how does having the money to buy the laptop make them any more superior)?

But, I had the opposite problem in college. I went to an engineering school that pretty much everyone I knew thought Macs were stupid and for idiots who didn't know how to use computers and were the inferior computer (basically the people who prefer Android now, same kind of taunts Android users use towards iPhone except think Windows vs. Mac). And constantly made fun of cause I used and preferred a Mac. So now it always amazes me to hear people complain of Mac people being that way (I guess it's become true, but when I went to college it was the Windows geeks who wouldn't leave me alone).
 
emvath said:
For some reason while I read this I imagined Steve reading the same thing and tugging at the neck of his black turtleneck and sweating profusely. ;)
Click to expand...

I think Jobs has more important issues on his mind like his health.
 
mrblack927 said:
That's it. Mac isn't obscure enough anymore. Time to switch to Linux.
Click to expand...

This has nothing to do with obscurity. Mac OS 9, which was much less widespread than OS 10, had over 15 accounted, REAL WORLD viruses. My own iMac was once infected under OS 9.

The problem is Safari, it sucks, it always has.
 
tigress666 said:
Heh, they made fun of you for "not having enough money"? I think that in itself would make their taunts meaningless (like how does having the money to buy the laptop make them any more superior)?

But, I had the opposite problem in college. I went to an engineering school that pretty much everyone I knew thought Macs were stupid and for idiots who didn't know how to use computers and were the inferior computer (basically the people who prefer Android now, same kind of taunts Android users use towards iPhone except think Windows vs. Mac). And constantly made fun of cause I used and preferred a Mac. So now it always amazes me to hear people complain of Mac people being that way (I guess it's become true, but when I went to college it was the Windows geeks who wouldn't leave me alone).
Click to expand...

Maybe it had nothing to do with what brand computer you guys were using and they were picking on you because you're nerds?
 
^ Safari is getting the new sandbox web kit treatment soon anyway correct? It's supposed to bring Safari up to Chrome's security level. Which is one reason I like Chrome lately although I do prefer Safari.

Lion should be much more secure and hopefully Apple realizes this. As they grow the target will get bigger.
 
jesaja said:
I don't understand why Apple doesn't pay prizes for finding security holes… they have ****in' 50 billion in the bank, spending a little of that to make their OS the most secure should be a no-brainer IMHO :rolleyes:
Click to expand...

The security industry as a whole generally pays for reporting new hacks without going public with the information until a fix i made. Hackers have to make a living too, and this is one good way to do it.

At the rate Apple is going with nickel and diming everyone, I would not be surprised if Apple figured out a way to spin some $4.99 app so hackers could try to hack "officially".

Hackers are an interesting bunch. They will find exploits because that's just what they do. Nothing is 100% secure, and given enough time anything can be hacked. If Apple doesn't get serious about security, guess what spurned hackers will do. Rather than reporting an exploit to be fixed, they'll use it or find someone who will.

As for the contest, I'm pretty sure anyone on this forum would take a new laptop and $15k for 2 weeks of work. And if you are of the mindset of these types, it's not work.
 
This is quite troubling but as a Chrome user, I'm not too concerned. However, I do expect Apple to take a serious look at security in Lion. I'm tired of having my Linux+Windows7 fanboy friend taunting me with these articles.

(Correct me if I'm wrong but using Chrome would help avoid the vulnerability, wouldn't it?)
 
infidel69 said:
Maybe it had nothing to do with what brand computer you guys were using and they were picking on you because you're nerds?
Click to expand...

Uh, no. My college was full of geeks (that's what happens when you go to an engineering college ;) ). And why would non nerds give a **** about what computer I was using ;)?

Oh, and how high school can you get trying to be insulting by calling some one a nerd? You realize anyone that comes on a forum to sit here and talk about computers and gadgets can pretty much be called a nerd *poke*? I mean non nerds really don't care about this stuff.
 
Full of Win said:
God, Apple has their hooks deep into you brother. This is troubling in that the main browser of the ecosystem is so riddled with holes and flaws. No browser is perfect...but 5 seconds? Wow.
Click to expand...

Yeah, that's it.:rolleyes:

I see you've taken your show outside of PRSI.

I'll say it again: Saying that it took 5 seconds to hack Safari is like saying it took me 60 seconds to write a 20 page paper because that's how long it took to print.

I'm not doubting that Safari has vulnerabilities......I just think it's disingenuous to say it took 5 seconds to hack.
 
One hacker also demonstrated stealing an iPhone 4's contact list with malicious website code.

It's easy to say, "Oh well you should just avoid evil websites", but it's not always that easy or clear, when you're following news or research links.

After years of never having a virus on my computers, I was finally nailed hard this past Christmas when I was looking up astrolabes, of all things. One of the sites I got linked to was advertising really inexpensive replicas. Yeah, well now I know why. It was just a lure to get you to come in. In the end, I had to wipe my machine and start over from a backup drive,
 
adbe said:
That's a deliberately false reading of the truth. The versions were locked a week or so prior to the event. If Apple had release its bi-yearly security patch for Safari just a couple of days earlier, the exploit would have failed.
Click to expand...

A detail that most of these 'the sky is falling' articles fail to mention. Apple has already patched the hole. Even before the event occurred.

Instead they are getting hits off the FUD.
 
It gets worse, according to Ars Technica the version of Safari was "frozen" from a week ago, so it didn't even include the patches that came out a day before the pwn2own event.

Apple released Safari 5.0.4 a day ahead of the competition, patching some 60 security holes in the browser. However, this year the rules have been altered: the configuration was frozen a week ago, hence the competition being run against Safari 5.0.3.
Click to expand...

Google was hosting the event, so naturally things are going to be different. Also, from the article, Chrome was allowed to update...even though the person that was suppose to break it didn't show up:

The third browser to be tested was scheduled to be Chrome. However, the contestant registered to attempt the attack did not show up, so the browser remains unbeaten. One possible reason for this is that Google published a Chrome update yesterday, closing at least 24 security flaws.
Click to expand...

Full article here...and apologies if this has been posted:
http://arstechnica.com/security/news/2011/03/pwn2own-day-one-safari-ie8-fall-chrome-unchallenged.ars
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back