"Researcher cracks Mac in 10 seconds"

[deckeda]

IronMac wrote:
Wasn't he already sitting on that exploit for a year?

As for the comment about user education...that's laughable. Good luck consoling yourself with that sort of pablum.

Yeah, he was. He knew about the vulnerability at last year's contest but didn't have an exploit ready at the time. And because no one else discovered it, it went un-reported for a year. Not sure how to take that, but if a bear craps in the woods and no one is around to smell it, is it a "problem?"

As for user education, I do my part, but I know it's a lot easier to sit back and say it can't be done, which of course helps create its own truth.

[JEBB]

Still, it isn't like the perpetual hole in Windows that allows the installation of viruses and other malware by launching the installer thru double clicking or whatever. With Mac OSX and Linux there is the barrier of the required user intervention of providing their password.

Holes like he used are one-offs and are forever sealable with the next security update.

[deckeda]

One thing I found interesting when reading about all of this yesterday is this concept of "sandboxing" applications such that once you get in (via hack/virus/malware/etc.) you can't automatically get out to the filesystem or rest of the OS to do real harm.

I don't pretend to understand exactly how it works, and maybe it doesn't without serious usability compromises (Windows UAC, anyone?.) Miller said Google Chrome works in a sandbox and it was the "most secure" browser as a result. Win7 and IE8 have supposedly moved in that direction as well but then again they fell pretty easily too.

[Blankity Blank]

The second I read about this, I figured I should just have this ready for cut and paste.

"...the under 10 seconds thing was only achieved because Miller simply provided a URL that took the user to the site where the exploit code was hosted. The donkey work had all been done beforehand, in accordance with PWN2OWN rules, which enabled the speed to be achieved.

Miller says that he provided the link, the judges clicked it and he then showed them he had full control of the MacBook concerned.

Windows users need not feel smug, apparently Safari and IE8 on a machine running Windows 7 also fell soon after the winner. "

The usual yawn.

[celliott]

Seems to me that even the best home security set-up is useless if you just open the front door and let someone come in. Isn't that about what this amounts to in the OS arena?