MACWORLD: Web flaw yields free MacWorld VIP pass
For the second year running, security researcher Kurt Grutzmacher has found
a way to get a free "Platinum" pass to the MacWorld Conference &
Expo, being held in San Francisco this week.
Thanks to a design flaw in the conference's Web site, he was able to figure
out the special promotional code and award himself a 100 percent discount when
purchasing the show's most
expensive pass.
The problem was that the site was downloading an encrypted version of the promotional
codes to the browser so that it could check for discounts before passing data
to MacWorld's Web server. Site developers may have done this to reduce the time
it takes to process conference applications, but in doing so they introduced
a serious security vulnerability, Grutzmacher said.
Although the promotional codes were encrypted, Grutzmacher used a password-cracking
tool called John the
Ripper to break the encryption and see the discount codes. "I was very
surprised it worked," he said in an e-mail interview.
That's because it was the same technique that yielded a Platinum pass for
the 2007 show. At that time, the show's promoter, IDG World Expo, "removed
all the codes, fixed the site, and said thanks," Grutzmacher said in a
Monday
blog posting showing how he cracked the site. "I gave them a few tips
(don't trust user input, don't give your secret codes to everyone, encryption
is not one-way, etc). Did they listen? Nope."
Grutzmacher ran his test in the weeks prior to the show, and the code he obtained
stopped working on Jan. 7, he said.
Show representatives were not immediately available to comment.
The security penetration tester went down to San Francisco's Moscone Center
on Monday to print up his pass, just to see if his trick worked, but he didn't
actually use it to visit the show. "That would be very unethical,"
he said.
Had he made use of the US$1,895 pass, however, Grutzmacher could have had a
free lunch, access to sessions at the conference, entry into the MacWorld party
and priority access to Steve Jobs' keynote on Tuesday.
"Justin," a commentator on Grutzmacher's blog, said
he reported a similar bug to IDG in 2003.
Grutzmacher said that this is probably not the last we'll hear of this problem.
"I suspect we'll see this again in 2009," he said.
The MacWorld Conference & Expo is run by IDG Wold Expo, an IDG News
Service affiliate.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
Crimeware: Understanding New Attacks and Defenses
By Markus Jakobsson, Zulfikar Ramzan
Published Apr 6, 2008 by Addison-Wesley Professional. Part of the Symantec Press series.
Enter now! | Official rules | Sample chapter
Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures
By Peter Thermos, Ari Takanen
Published Aug 1, 2007 by Addison-Wesley Professional.
Enter now! | Official rules | Sample chapter
