Mac OS X hacked under 30 minutes

ZDNet Australia ^ | 6 March 2006 | Munir Kotadia

[SengirV]

You argue like a democrat. You try to be as confrontational as possible, but as soon as someone calls you on it - you point your finger at them for being in error.

Sorry, not going to play your weak mind games.

[SJSAMPLE]

I've had very little luck with PC editing software.
I can't recall the last application I've used that worked well. That's where the Mac really shines.

[rzeznikj at stout]

It sounds like this guy invited random folks to his computer and said "Hack into it. The First one Wins" But the article's tone comes out to be a hit piece on Macs instead of pointing out that while the OS was compromised, the guy let people into his computer as users--then enabling the users to steal his root password.

In any case, OSX is still more secure than Windows, Case in point to consider: if the same exact stunt was done to a Windows box, said Windows box would've been hacked in a few minutes without any problem.

[dennisw]

Hahahahah. I will never ever buy a Mac. I don't need the ego boosting, the bragging rights and the additional hardware & software expenses. Though Apple products seem more idiot proof than WinTel machines so I would recommend them to certain people. I just bought a new LCD monitor that runs on DVI so I'll probably get a DVI video card. That's what I prefer to blow my money on. Not these silly Apple Imacs though these new dual core Intel machines should make the Apple crowd very happy ------>>>>

Hot! Amazon - Apple iMac with Intel Duo Core and 17" LCD - $125 Rebate, Shipped Free, No Tax to Most States! (Posted by: Leon)
It`s definitely better to buy these from Amazon rather than Apple.com. The $125 rebate is pretty slick too!

• Apple iMac Desktop with 17" Display MA199LL/A (1.83 GHz Intel Core Duo, 512 MB RAM, 160 GB Hard Drive, SuperDrive) for $1299.99 - $125 Rebate = $1174.99 shipped free! APPLE IMAC DESKTOP 17" LCD 1.83GHZ SALE
• Apple iMac Desktop with 20" Display MA200LL/A (2.0 GHz Intel Core Duo, 512 MB RAM, 250 GB Hard Drive, SuperDrive) for $1699.99 - $150 Rebate = $1549.99 shipped free! APPLE IMAC DESKTOP 20" LCD 2.0GHZ SALE

[for-q-clinton]

Now who are all those that professed this couldn't happen on a MAC?

[N3WBI3]

I dont know maybe you can link to someone who said the mac was impervious...

[Doohickey]

Oh, so now a box has to be configured to be considered secure. The litmus test has always been with a default install...until now.

FWIW, I agree with you. Put a default install of an OS on the iNTeRNeT and you're begging to get owned.

[N3WBI3]

Doohicky,

This was not the default setup. SSH was, on my mac at any rate, by default not allowed. And for sure there were no shell accounts that anyone new about when I first installed it..

[antiRepublicrat]

Oh, so now a box has to be configured to be considered secure. The litmus test has always been with a default install...until now.

He took the OS X client (not Server) and started running various server services. With OS X the default install is everything off, which wasn't this test case. You need to follow good procedure when you start turning things on. OS X makes that bit easy.

Oh, and don't give anonymous hackers shell access. That's always a good idea. :)

I'd also call BS on anyone who did this test with an XP machine instead of 2003 Server.

[Doohickey]

Well, that's a horse of a different color. Thanks for clearing that up.

[Golden Eagle]

Case in point to consider: if the same exact stunt was done to a Windows box, said Windows box would've been hacked in a few minutes without any problem.

What "case in point" are you referring to, or do you not understand the meaning of the phrase? Must not, since your claim is actually nothing more than wild speculation, without even a named hacker or unknown exploit to back it up.

[Star Traveler]

You said -- "... without even a named hacker or unknown exploit to back it up."

Well, who is the named hacker and what is the exploit on that Mac? I haven't heard anything from that hacker and there is nothing on the exploit.

By the way, did you know that I just hacked into your computer with an unknown exploit (very, very few people know about this exploit). I bet that's a surprise to you, too -- huh?

Of course, it wouldn't be "responsible" for me to let anyone know what the exploit was. If I did that, then who knows who else might use it to compromise all those other computers.

Why don't we try a *real test* (instead of all this high-flying rhetoric)... See a real-world test here --

http://test.doit.wisc.edu/

Regards,
Star Traveler

[dinodino]

This was an idiotic test and totally unrealistic. How unsurprising that if you give hackers shell accounts, they can get root!

Of course, the Windows fanatics will latch onto this as "proof" that Macs are as insecure is Windows, which is absolutely false.

[Golden Eagle]

The hacker's name is "gwerdna", thought to possibly be a guy named Andrew G. (reverse) or similar. His exploit was unknown, and not compatible with Windows, but did obviously exist.

If you or reznikj are a hacker, or knows one that has a currently unknown exploit for Windows, you might have a "case in point" that a similar process could actually happen to Windows in a similar circumstance. But calling a hypothetical a "case in point" is clearly a misuse of the meaning and tense of the phrase. Sounds like reznikj should be more concentrating on his studies than making unbackable claims on the internet every night.

[js1138]

This was an idiotic test and totally unrealistic. How unsurprising that if you give hackers shell accounts, they can get root!

Of course business domains depend on this being impossible, or extremely difficult.

[Star Traveler]

You said -- "The hacker's name is "gwerdna", thought to possibly be a guy named Andrew G. (reverse) or similar. His exploit was unknown, and not compatible with Windows, but did obviously exist. "

Well, you have just as much information with me, too -- as you do about that other guy. You've got my name and the statement that it's an unknown exploit that I'm using, too.

Is that enough proof for you?

Oh, could you contact that "gwerdna" and tell him to use that unkown exploit on this Mac...

http://test.doit.wisc.edu/

You think about 45 minutes on that one?

Regards,
Star Traveler

[Golden Eagle]

Is that enough proof for you?

Proof enough of what? That you have an unknown Windows exloit? Hardly! My guess is neither does reznikj, nor will you ever. So you've got the rest of your life to prove me wrong.

[Star Traveler]

You said -- "So you've got the rest of your life to prove me wrong."

I don't have to. I've already done it -- the same way that "gwerdna" did with his unknown exploit on the Mac. We've both proved it -- one for the Mac and one for the Windows.

Regards,
Star Traveler

[Golden Eagle]

I've already done it -- the same way that "gwerdna" did with his unknown exploit on the Mac.

You haven't proven anything, and seem to be pretty high in the stars at this particular moment. Let me know if/when you return to earth.

[DemosCrash]

He took the OS X client (not Server) and started running various server services. With OS X the default install is everything off, which wasn't this test case. You need to follow good procedure when you start turning things on. OS X makes that bit easy.

So, obviously, whatever services he turned are fundamentally insecure if they can be hacked that easily. What services are they?