{"id":552098,"date":"2007-04-24T12:00:12","date_gmt":"2007-04-24T12:00:12","guid":{"rendered":"http:\/\/localhost:8888\/wordpress\/technology\/552098-hacker-breaks-into-mac-at-security-conference.html"},"modified":"2007-04-24T12:00:12","modified_gmt":"2007-04-24T12:00:12","slug":"hacker-breaks-into-mac-at-security-conference","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/technology\/552098-hacker-breaks-into-mac-at-security-conference.html","title":{"rendered":"Hacker breaks into Mac at security conference"},"content":{"rendered":"

In winning the contest, he exposed a hole in Safari, Apple’s browser. "Currently, every copy of OS X out there now is vulnerable to this," says Sean Comeau, one of the organisers of CanSecWest.<\/font><\/p>\n

The conference organisers decided to offer the contest in part to draw attention to possible security shortcomings in Macs.<\/font><\/p>\n

"You see a lot of people running OS X saying it is so secure and, frankly, Microsoft is putting more work into security than Apple has," says Dragos Ruiu, the principal organiser of security conferences including CanSecWest.<\/font><\/p>\n

Initially, contestants were invited to try to access one of two Macs through a wireless access point while the Macs had no programs running.<\/font><\/p>\n

No attackers managed to do so, and so conference organisers allowed participants to try to get in through the browser by sending URLs via e-mail.<\/font><\/p>\n

Dino Di Zovie, who lives in New York, sent along a URL that exposed the hole.<\/font><\/p>\n

Since the contest was only open to attendees in Vancouver, he sent it to a friend who was at the conference and forwarded it on.<\/font><\/p>\n

The URL opened a blank page but exposed a vulnerability in input handling in Safari, Comeau says. An attacker could use the vulnerability in a number of ways, but Di Zovie used it to open a back door that gave him access to anything on the computer, Comeau adds.<\/font><\/p>\n

The vulnerability will not be published. 3Com’s TippingPoint division, which put up the cash prize, will handle disclosing it to Apple.<\/font><\/p>\n

The prize for the contest was originally one of the Macs. But TippingPoint put up the cash award, which may have spurred a wider interest in the contest.<\/font><\/p>\n

One reason Macs have not been much of a target for hackers is that there are fewer to attack, says Terri Forslof, manager of security response for TippingPoint.<\/font><\/p>\n

"It is an incentive issue. The Mac is not as widely deployed of a platform as say Windows," she adds. In this case, the cash may have provided motivation.<\/font><\/p>\n

The contest was a chance for hackers to demonstrate techniques they may have boasted about. "I hear a lot of people bragging about how easy it is to break into Macs," Ruiu says.<\/font><\/p>\n

Some attendees didn’t think it was a coincidence that late on Thursday last week Apple released a patch for 25 vulnerabilities in OS X.<\/font><\/p>\n

Macs have not been targets for hackers and malicious code writers to nearly the degree that Windows machines have historically.<\/font><\/p>\n

That’s in part because there are fewer Macs in use, thus making the potential impact of malicious code smaller than on the more widely used PCs.<\/font><\/p>\n

Also, Apple is "extremely litigious when people do find stuff," notes Theo de Raadt, OpenBSD project leader and an attendee at the conference.<\/font><\/p>\n

He suspects that this will backfire on Apple, which could begin to "look evil" if hackers begin to publish potentially threatening letters from the company.<\/font><\/p>\n

Computing SA<\/font><\/p>\n","protected":false},"excerpt":{"rendered":"

A hacker managed to break into a Mac and win a 10,000 prize as part of a contest started at the CanSecWest security conference in Vancouver.<\/p>\n","protected":false},"author":23,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[17],"tags":[],"class_list":["post-552098","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/552098"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=552098"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/552098\/revisions"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=552098"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=552098"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=552098"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}