One year after Mac hack contest, Linux and Vista may be tested
82493
One year after launching a controversial Macintosh hacking contest, the promoters of the CanSecWest security research conference are thinking about giving hackers another shot at cracking the Mac. Only this time, they&#39;re looking to broaden the field.Last year, show organizers invited attendees to hack into a Macintosh laptop with the successful hacker winning the computer and a cash prize. But this year, they&#39;re talking about giving attendees three targets to choose from. &quot;We&#39;re thinking of having a contest where we have Vista and OS X and Linux ... and see which one goes first,&quot; said Dragos Ruiu, the principal organizer of CanSecWest.Last year, security researcher Dino Dai Zovi spent a sleepless night hacking his Mac in order to take the prize at the show&#39;s first PWN to OWN contest.&#160;Dai Zovi found a QuickTime bug&#160;that allowed him to run unauthorized software on the Mac once the computer&#39;s browser was directed to a specially crafted Web page.Dai Zovi split the contest prize with a friend at the show, Shane Macaulay, who helped him pull off his attack. Macaulay got to keep the Macbook Pro while Dai Zovi pocketed the $10,000 put up by 3Com&#39;s Tipping Point division in exchange for technical details on the bug.It turned out that the QuickTime bug affected the Windows operating system too, but Ruiu said that Dai Zovi&#39;s hack helped change the way the industry thinks about the Mac OS, which has a reputation for being far more secure than Windows. &quot;We were trying to point out that there was a security issue with Mac stuff here, and everybody was trying to play ostrich.&quot;Ruiu and Dai Zovi say that last year&#39;s contest helped kick off a flurry of Mac-related security research, but according to TippingPoint Manager of Security Response Terri Forslof, it also illustrated a security industry truism: &quot;Given enough time and motivation, everything can be broken,&quot; she said. &quot;When TippingPoint agreed to purchase whatever vulnerability was used to win the contest for $10,000, it added an appropriate level of motivation. That&#39;s how it works.&quot;Shortly after last year&#39;s contest, Gartner published a research paper warning that such challenges are &quot;risky endeavors&quot; that could put sensitive vulnerability information out in the public domain.That hasn&#39;t stopped CanSecWest from pressing forward with this year&#39;s event.Ruiu isn&#39;t certain that he&#39;ll run the three-way hacking contest this year. That&#39;s because he also has a grander, top-secret hacking contest idea that may or may not pan out, he said.Either way, he promised &quot;an interesting spectacle.&quot;
29086
Several security features in the Mac's new OS are incomplete, say researchers.
618526
Windows Vista was hit by significantly fewer publicly disclosed security flaws in its first year than Windows XP and open source rivals were, the software giant says.
627103
A proof-of-concept exploit for a TCP/IP flaw that affects Windows Vista and XP has security researchers ringing alarm bells, with one saying it could "be one of the biggest [vulnerabilities] of 2008."
21235
By this time next year, virtualization users may have their own industry-sanctioned benchmarking software for evaluating various virtualization environments.
511916
A vulnerability in OpenOffice could allow attackers to remotely execute code on computers running Windows, Linux or Mac OS.
268614
A new virus targeting Mac OS X is not expected to cause much trouble. But malcode experts said it should serve as a warning to those using alternatives to Microsoft that their machines are not attack-proof.
378809
Leopard introduces lots of new apps and interface features to Mac OS X. Can Vista match up?
468680
Bad reviews won't hurt Vista. Neither will the Mac. Or Linux.
143389
This QuickTime buffer overflow vulnerability appears to be different from a similar vulnerability patched by Apple in December 2007.
402174
(InfoWorld) - Apple Computer will soon be a member of the "month of bugs" club. On Jan. 1, two security researchers will begin publishing details of a flood of security vulnerabilities in Apple's products.Â Their planÂ is to disclose one bug per day for the entire month, they said Tuesday. The project is being launched by an independent security researcher, Kevin Finisterre, and a hacker known as LMH, who declined to reveal his identity. Some of the bugs "might represent a significant risk," LMH said in an e-mail interview. "Others have a lower impact on security. We are trying to develop working exploits for every issue we find." The two hackers plan to disclose bugs in the Mac OS X kernel as well as in software such as Safari, iTunes, iPhoto and QuickTime, LMH said. Some of the bugs will also affect versions of Apple's software designed to run on Microsoft Corp.'s Windows operating system, he added. LMH was one of the brains behind the recent Month of Kernel Bugs project, which exposed flaws at the core of several different operating systems. It was inspired by an earlier effort, called the Month of Browser Bugs, which was kicked off in July. This latest Apple project is being launched to raise awareness of security vulnerabilities in Apple's products and to "stomp smugness," Finisterre said via e-mail. While the Macintosh is generally considered to be more secure than the Windows PC, many security researchers believe that this reputation is not attributable to any superior security practices on the part of Apple. They say attackers have been deterred by the Mac OS X's more secure Unix kernel and the product's less widespread adoption. Apple enthusiasts and security researchers have been at odds since last August, when David Maynor and Jon Ellch claimed to have discovered a flaw that affected Apple's wireless device drivers. They played a video at the Black Hat conference demonstrating how this flaw could be used to run unauthorized code on a MacBook. However, their claims have been slammed because the demonstration used a third-party wireless card rather than the one that ships with the MacBook, and because the two hackers still have not published the code used in their attack. LMH said the Apple community's negative response to Maynor and Ellch's claims played a role in the decision to launch the Month of Apple bugs. "I was shocked with the reaction of some so-called 'Apple fans,'" he said. "I can't understand why some people react badly to disclosure of issues in their system of choice. ... That helps to improve its security." A similar effort to disclose flaws in Oracle's software had to be abandoned before it was ever launched last month. The man behind the Week of Oracle bugs, Cesar Cerrudo, of Argeniss Information Security, said he pulled the plug when it became clear that the project could damage the relationship between one of his customers and Oracle. "This customer realized that they could have had serious business problems, so they changed their mind and asked to cancel it," he said via instant message on Tuesday. LMH said he didn't expect any legal problems from Apple. "I keep talking to a guy from the Apple security team and I'm willing to help whenever necessary," he said. "I'm far away from any illegal activity." Apple, for its part, did not seem to be upset with the project. "WeÂ always welcome feedback on how to improve security on the Mac," said Anuj Nayar, an Apple spokesman. Â
699435
A researcher has posted proof-of-concept code for a zero-day flaw within Mac OS X dealing with its handling of disk image (.dmg) files. The issue causes a memory corruption vulnerability that could allow attackers to execute arbitrary code.
336518
Mac OS X 10.4.8 fixes several flaws that could lead to remote code execution, the company says.
260362
Adobe Systems and Symantec are planning to ask European Union regulators to take action against Microsoft's forthcoming operating system, Vista, which the companies believe has features that undercut rivals.
447903
This Quicktime buffer overflow vulnerability appears to be different from a similar vulnerability  patched by Apple in December 2007.
302277
Both Windows and Mac versions of the multimedia program have a buffer overflow flaw that puts users at risk.
207716
Now that Microsoft has officially unveiled its new Vista operating system for businesses, it is likely that corporate users will begin testing the OS over the next year to see how it fits into their environments.