Security Expert Hacks a Mac in Seconds
12:26 am, March 19th, 2009, Lonnie Lazar
Charlie Miller, principal security analyst at Independent Security Evaluators, used a security exploit in Safari 4 to hack into a MacBook in about 10 seconds Wednesday, winning the Pwn2own contest at the CanSecWest security conference for the second year in a row.
The security hole, which Miller said he discovered last year, allows a remote attacker to gain control of a machine by getting the computer user to click on a malicious URL, as Miller demonstrated.
“It’s not easy, but this worked with one click” from the Safari browser, he said.
The contest is sponsored by TippingPoint, which shares details on the exploit with Apple and develops a patch for it. TippingPoint offers $5,000 for each new exploit demonstrated in the major browsers and $10,000 for each successful exploit in the major smartphones.
Miller also discovered an exploit in the mobile version of Safari shortly after the iPhone was launched in 2007. In addition to the $5000 prize for his efforts Wednesday, he gets to keep the MacBook he used to win the contest.
[CNet]
Posted by Lonnie Lazar in News | Comment on this article
Wasn’t he a Mac security expert?
Didn’t he prepared before the contest, how others browsers performed in that show?
Is there a browser that is immune to attacks?
Ohh! …
Deocliciano Okssipin Vieira, on March 19th, 2009 at 3:02 am
It’s interesting that this can be considered valid in a Beta browser. But useful as now the exploit will be fixed.
Steve, on March 19th, 2009 at 3:23 am
Is it a hack if it needs user input?
John, on March 19th, 2009 at 10:50 am
“In seconds!” the breathless bloggers all write… then right there in the article it says that he discovered it last year; reading more about the contest reveals that he worked on the exploit weeks ahead of time and put it through weeks of testing. So no, he didn’t hack a Mac in SECONDS, he took weeks to hack it after a year of studying the security hole.
And yeah, the exploit relied on someone clicking a suspicious link in an email. Duh.
ItsGene, on March 19th, 2009 at 12:54 pm