Contest rm-my-mac brought down in less than six hours

By Justin Mann on March 6, 2006, 2:02 PM
If you follow Apple, you'll remember that various security demonstrations they've had for OS X and Macs in general. The most recent one, in which a contest to break the security of a machine was held, won. And in under 30 minutes at that. In this particular demonstration, all the users were given local accounts on the machine, which typically makes system compromise much easier, but the speed at which it was brought down and had the web page for the contest deface is most definitely humbling. The contest didn't even last a day, and was defeated by and as of yet unpublished security vulnerability.

"It probably took about 20 or 30 minutes to get root on the box. Initially, I tried looking around the box for certain misconfigurations and other obvious things, but then I decided to use some unpublished exploits--of which there are a lot for Mac OS X," Gwerdna told ZDNet Australia.
Though this might seem a bit embarassing, this is probably one of the best ideas the IT industry as a whole can use - allow anyone access to a particular machine with the goal of bringing it down, for reward. What a way to use the collective mind power of thousands of people to help "bug test" a system. Enterprise companies have used a similar tactic for many years, hiring someone on the outside to probe them externally, looking for exploits. Sort of like a security audit.




User Comments: 5

Got something to say? Post a comment
sngx1275 said:
While it definately doesn't look good, its not near as bad for the average OS X user as it initially seems.[quote]It runs a default install of Mac OS X Tiger, plus fink and some decent versions of Apache, MySQL and PHP...I set up an LDAP server and linked it to the Macs naming and authentication services, to let people add their own account to this machine. That way, they will all be able to enjoy the beauty of Mac OS X Tiger. And, of course, get a better chance of rm'ing it![/quote]Average users don't have that stuff installed or turned on, ssh is disabled by default. One thing that I imagine will be "fixed" in 10.5 Leopard is that the software firewall will probably be turned on by default. There is a firewall now, but its disabled by default.
DragonMaster said:
ROFLMAOCongrats Apple! [quote]There is a firewall now, but its disabled by default.[/quote]Wow! How safe!
sngx1275 said:
New challenge issued in response to the sensationalistic journalism as the first one has been reported.[url]http://test.doit.wisc.edu/[/url]Also DragonMaster, it wasn't until SP2 was avaiable for WindowsXP that the firewall was enabled by default. Also no ports are open on a default install of OSX Tiger.
DragonMaster said:
[quote]Also DragonMaster, it wasn't until SP2 was avaiable for WindowsXP that the firewall was enabled by default. [/quote]I never told Windows was safe also. If you compare them to some popular Linux distros I used, it's nothing. (The Linux installations practically force you to use the highest security level. They say that almost every other levels are a bad choice.
Mictlantecuhtli said:
[b]Originally posted by DragonMaster:[/b][quote]The Linux installations practically force you to use the highest security level. They say that almost every other levels are a bad choice.[/quote]Many Linux distributions I've seen have had a default firewall configuration allowing all output access. Fortunately, unlikely with Windows' builtin firewall, there's a way to block that.
Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.