Mac Hack Attack
VANCOUVER, B.C. — It took Charlie Miller only two minutes on Thursday to claim top honors in a contest that asked hackers to exploit security weaknesses on laptop computers. Believe it or not, his victim was a Mac.The hacking contest, PWN 2 OWN, is part of the annual CanSecWest conference. This year’s task pitted conference attendees against a MacBook Air, a Sony Vaio loaded with Ubuntu (a version of Linux) and a Fujitsu U810 running Windows Vista. The challenge: Read the contents of a specific file on any of the three machines’ hard drives after breaching the laptop’s security features using a previously undisclosed “0day” attack.
Miller aimed for the Mac right off the bat — a surprising choice due to Apple’s reputation as mostly un-hackable. A researcher possibly best known for being the first to hack Apple’s iPhone last year, Miller was the first contestant to attempt a system breach on any of the machines. On the contest’s first day, the rules stated contestants could attack only over the network, and no one attempted that. However, on the second day, when contestants were allowed to employ contest organizers as their pawns, Miller directed one of the organizers to point the Mac’s browser to a website whereon he had embedded malicious code. Within moments, Miller had control of the machine and victory was his.
For his efforts, Miller received a $10,000 cash prize and custody of the MacBook. He was required to sign a non-disclosure agreement that prevents him from revealing the details of his exploit until contest sponsor TippingPoint can notify Apple about the weakness.
Apple has reason to be worried about Miller’s feat. The only software any of the contestants could use in the contest was what came preinstalled on the laptops, so it appears Miller’s coup exploited a weakness in Apple’s Safari browser.
This year’s contest wasn’t the first in which Apple ended up with egg on its face. Last year, Dino Dai Zovi won by exploiting a vulnerability in QuickTime — another Apple product. Dai Zovi sat out this year’s event.