Vista, MacBook Out--Only Linux Left in Hacking Contest
Robert McMillan, IDG News Service Sat Mar 29, 8:00 AM ET
The MacBook Air went first; a tiny Fujitsu laptop running Vista was
hacked on the last day of the contest; but it was Linux, running on a
Sony Vaio, that remained undefeated as conference organizers ended a
three-way computer hacking challenge Friday at the CanSecWest
conference.
ADVERTISEMENT
Earlier this week, contest sponsors had put three laptops up for grabs
to anyone who could hack into one of the systems and run their own
software. A US$20,000 cash prize sweetened the deal, but the payout was
halved each day as contest rules were relaxed and it became easier to
penetrate the computers.
On day two, Independent Security Evaluators' Charlie Miller took the
Mac after hitting it with a still-undisclosed exploit that targeted the
Safari Web browser. After about two minutes work, Thursday, Miller took
home $10,000, courtesy of 3Com's TippingPoint division, in addition to
his new laptop.
It took two days of work, but Shane Macaulay, finally cracked the Vista box on Friday, with a little help from his friends.
Macaulay, who was a co-winner of last year's hacking contest, needed a
few hacking tricks courtesy of VMware researcher Alexander Sotirov to
make his bug work. That's because Macaulay hadn't been expecting to
attack the Service Pack 1 version of Vista, which comes with additional
security measures. He also got a little help from co-worker Derek
Callaway.
Under contest rules, Macaulay and Miller aren't allowed to divulge
specific details about their bugs until they are patched, but Macaulay
said the flaw that he exploited was a cross-platform bug that took
advantage of Java to circumvent Vista's security.
"The flaw is in something else, but the inherent nature of Java allowed
us to get around the protections that Microsoft had in place," he said
in an interview shortly after he claimed his prize Friday. "This could
affect Linux or Mac OS X."
Macaulay said he chose to work on Vista because he had done contract
work for Microsoft in the past and was more familiar with its products.
Although several attendees tried to crack the Linux box, nobody could
pull it off, said Terri Forslof, a manager of security response with
TippingPoint. "I was surprised that it didn't go," she said.
Some of the show's 400 attendees had found bugs in the Linux operating
system, she said, but many of them didn't want to put the work into
developing the exploit code that would be required to win the contest.
Earlier, Miller said that he chose to hack the Mac because he thought
it would be easiest target. Vista hacker Macaulay didn't dispute that
assertion: "I think it might be," he said.
阅读(1148) | 评论(2) | 转发(0) |
