With Vista breached, Linux unbeaten in hacking contest
The MacBook
Air went first; a tiny Fujitsu laptop running Vista was hacked on the last
day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated
as conference organizers ended a three-way computer hacking
challenge Friday at the CanSecWest conference.
Earlier this week, contest sponsors had put three laptops up for grabs to anyone
who could hack into one of the systems and run their own software. A US$20,000
cash prize sweetened the deal, but the payout was halved each day as contest
rules were relaxed and it became easier to penetrate the computers.
On day two, Independent Security Evaluators' Charlie Miller took the Mac after
hitting it with a still-undisclosed exploit that targeted the Safari Web browser.
After about two minutes work, Thursday, Miller took home $10,000, courtesy of
3Com's TippingPoint division, in addition to his new laptop.
It took two days of work, but Shane Macaulay, finally cracked the Vista box
on Friday, with a little help from his friends.
Macaulay, who was a co-winner of last year's hacking contest, needed a few
hacking tricks courtesy of VMware researcher Alexander Sotirov to make his bug
work. That's because Macaulay hadn't been expecting to attack the Service Pack
1 version of Vista, which comes with additional security measures. He also got
a little help from co-worker Derek Callaway.
Under contest rules, Macaulay and Miller aren't allowed to divulge specific
details about their bugs until they are patched, but Macaulay said the flaw
that he exploited was a cross-platform bug that took advantage of Java to circumvent
Vista's security.
"The flaw is in something else, but the inherent nature of Java allowed
us to get around the protections that Microsoft had in place," he said
in an interview shortly after he claimed his prize Friday. "This could
affect Linux or Mac OS X."
In
a blog posting, TippingPoint said that Macaulay's bug lies in Adobe's Flash
Player and that Adobe is working on a fix.
Macaulay said he chose to work on Vista because he had done contract work for
Microsoft in the past and was more familiar with its products.
Although several attendees tried to crack the Linux box, nobody could pull
it off, said
Terri Forslof, a manager of security response with TippingPoint. "I
was surprised that it didn't go," she said.
Some of the show's 400 attendees had found bugs in the Linux operating system,
she said, but many of them didn't want to put the work into developing the exploit
code that would be required to win the contest.
Earlier, Miller said that he chose to hack the Mac because he thought it would
be easiest target. Vista hacker Macaulay didn't dispute that assertion: "I
think it might be," he said.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
