Replies

Comment by Swordmaker: direct hacking with an active hacker like Charkie Miller is different than achieving an automated exploit. In each of these Pwn2Own competitions, the targeted computer's users had to navigate to a prepared website and take an action directed by the hacker. None of the Macs gave up ROOT access... Miller only gained user level access and had the user been a standard user, that's all he would have achieved. All of Miller's hacks took weeks of prior preparation, and contrary to the hype they were not breached in minutes or seconds... when Miller's and his staff's prep and research prep time has to be factored in as well. The exploit executed in minutes or seconds, but it took weeks of work. The other systems fell to people who said they started from scratch at the Pwn2Own contest.

The question still needs to be asked of Miller and the others who claim the Security by Obscurity canard: if 55 million OSX Macs and 110 million iOS devices aren't enough to attract malware authors to the platform, when malware writers were attracted to the 12,000 BlackIce protected Windows computers when they wrote the Witty Worm in 2006, just how many will it take??? When WILL the malware writers be attracted to the millions of Macs sitting out there running bare naked without anti-virus of any kind, sitting ducks, just waiting to be fleeced? When???

In addition, Apple has closed the vulnerabilities that Miller used in these contests. It was revealed, however, in the 2010 contest, that Miller's team discovered in their 2009 research a second flaw which they did not reveal to Apple for correction, apparently choosing instead to hold on to it for use in the following year's contest. Some say that was an unethical decision, that professionals have a duty to report such findings.

I think backdoors are left in these apps on purpose. Making a backdoor look like sloppy coding has become an art itself.

MS had to stop bulking up its systems so much because of competition from Apple and Linux. It would be nice if similar competition stopped the backdoors.

The worst backdoor is having USB keys automatically run executables. How can I ever trust a company that does these things?

Charlie Miller talks about Apple product Security... But he doesn't tell the whole truth—PING!
I wont call FUD on this article because it's mostly accurate. Good read.

Please, No Flame Wars!
Discuss technical issues, software, and hardware.
Don't attack people!

Don't respond to the Anti-Apple Thread Trolls!
PLEASE IGNORE THEM!!!

Apple Security claims denied Ping!

If you want on or off the Mac Ping List, Freepmail me.

Having just suffered a fatal virus crash on my PC, I am loathe to wish ill on anybody.

But it sure would be schadenfreude to see a “Wipe the smug grin off your face” virus shake up the Mac community.

Just sayin’.

Any vulnerabilities used in the contest would have to be given to the organizers who would then give the information to the vendor, in this case Apple.

In addition, Apple has closed the vulnerabilities that Miller used in these contests. It was revealed, however, in the 2010 contest, that Miller's team discovered in their 2009 research a second flaw which they did not reveal to Apple for correction, apparently choosing instead to hold on to it for use in the following year's contest. Some say that was an unethical decision, that professionals have a duty to report such findings.

They would be wrong based on the conditions of the challenge.

The Pwn2Own competitions are fine, but they are not enough. Charlie Miller, the author of this article, was behind the "No Free Bugs" campaign, that proposed a legitimate commercial market for exploits. I thought it sounded like a great idea, provided that the software companies paid hackers adequately for their highly skilled, labor-intensive work.

The market now exists, but compensation has been terrible.

http://www.computerworld.com/s/article/9179538/Google_calls_raises_Mozilla_s_bug_bounty_for_Chrome_flaws

From the linked article, printed last July:

"Google has paid out $14,846 for 21 reported vulnerabilities since January."

Calling that "chump change" is an insult to chumps. While Google and Mozilla have increased their payout to about $3000 per exploit, that is still very low.

I bet the black market in exploits is flourishing.