Tech press TechTardiness abounds. It is no surprise that certain dimwits blundered their reporting of the Pwn2Own contest at CanSecWest. My net compatriot Daniel Eran Dilger covered it laudably today in his article:
PWNED! Vincenzo Iozzo and Ralf Philipp Weinmann - iPhoneCongratulations to all the hackers and thank you for making it clear that Internet surfing can be dangerous no matter the operating system or web browser. Details of each zero day hack are not published until they have been addressed by the companies or groups in charge of affected programs and operating systems. When the Mac OS X hacks have been published, I'll report them and provide links here.
PWNED! Charlie Miller - Safari [on Mac OS X 10.6]
Nils - Safari (Prize Claimed) [on Mac OS X 10.6]
PWNED! Peter Vreugdenhil - Internet Explorer 8 [on 7ista]
MemACCT - Internet Explorer 8 (Prize Claimed) [on 7ista]
Anonymous - Nokia
Anonymous - iPhone (Prize already won)
PWNED! Nils - Firefox [on 7ista]
Java exploits are also well known at this time, indicating the need to also turn off Java while surfing the net, except again at trusted websites. What a shame.
Pwn2Own 2010When the contest starts, you can follow the results at TippingPoint's blog HERE. The favorite to lose this year is Microsoft Internet Explorer, either or both versions 7 and 8. Here is the schedule posted by ZDNet:
BY AARON PORTNOY
MON 15 FEB 2010 16:41PM
The TippingPoint Zero Day Initiative (ZDI) is proud to announce that the annual Pwn2Own contest is back again this year at the CanSecWest security conference held in Vancouver, BC on March 24th 2010. As the contest name implies, if you successfully exploit a target you get to keep it along with a ZDI cash prize and related benefits. This is our 4th year running and to commemorate we have increased the total cash prize amount to $100,000 USD. If you're unfamiliar with the past history of this competition check out the archived 2008 and 2009 blog entries.
Day 1:ZDNet also reports that a number of mobile devices are part of a second set of hacking contests:
Microsoft Internet Explorer 8 on Windows 7
Mozilla Firefox 3 on Windows 7
Google Chrome 4 on Windows 7
Apple Safari 4 on Mac OS X Snow Leopard
Day 2:
Microsoft Internet Explorer 7 on Windows Vista
Mozilla Firefox 3 on Windows Vista
Google Chrome 4 on Windows Vista
Apple Safari 4 on Mac OS X Snow Leopard
Day 3:
Microsoft Internet Explorer 7 on Windows XP
Mozilla Firefox 3 on Windows XP
Google Chrome 4 on Windows XP
Apple Safari 4 on Mac OS X Snow Leopard
Apple iPhone 3GSApple, apparently in preparation for Pwn2Own, released Safari v4.0.5 on March 10, 2010. It patched 16 security vulnerabilities. You can read about it HERE and HERE. Six patches were specifically for the Windows version of Safari. The other ten patches affected both Mac and Windows versions of Safari. Nine of the patches were specifically for WebKit, which is an Open Source project used in a number of web browsers, including Safari, OmniWeb, Chrome, Shiira, Midori, S60, Android and the Palm Pre web browser. Four of the patches patched the ImageIO used in the version for Windows. Does this cover the gamut of security vulnerabilities in Safari? The hackers at Pwn2Own consistently have surprises up their sleeves.
RIM Blackberry Bold 9700
A Nokia device running Symbian S60 (likely the E62)
A Motorola phone running Android (likely the Droid)
The general concept of the contest is to gather contestants and provide them with a hacking events schedule well ahead of time. The contestants typically come to the contest prepared with a specific hack or set of hacks they will use on the target computers via interaction with the accompanying web browser. This year the contest is somewhat different in that each successive day will include the hacking of older versions of Internet Explorer with older versions of Windows. But the general contest provides three days of hacking using three pairings of web browsers and operating systems. Day 1 does not allow any access to applications on the target computer. Day 2 allows what I call 'LUSER sabotage' access to the target computers via default installed applications for each operating system. Day 3 provides popular third party applications on each computer that can be used as part of 'LUSER sabotage' hacking.
In years past the FUD mongering contingent have danced around like village idiots pointing out how quickly Macs have been hacked on Day 2. In reality, the speed of any hack is nearly irrelevant. This is due to the weeks of preparation provided to all contestants, who presumably have already proven their zero day hacks before the contest has begun. What is relevant is the existence of the hack and how much 'LUSER sabotage' is required to apply it.
Just to keep this issue hot on the burner:--
Much as I very much like the idea of what MacScan is 'supposed' to do, it FAILs.
1) If you want to detect all the 'malware' on your Mac, you have to run the thing OVER and OVER and OVER. One run is never enough. That's crap programming. And yes folks: I personally have been telling them this for YEARS and YEARS and YEARS. Then they do nothing to improve their detection engine. Instead they post friendly little notes asking for more feedback. Right.
2) Their list of Trojan horses has NEVER been adequate. Right now there are 4 types of Mac OS X Trojans with a total of 22 different strains. MacScan does NOT detect all of them. So what's the point?
3) It claims to find 'spyware', but there is NO illicit spyware for Mac OS X. Not a one. Everything MacScan detects is 'legal' spyware that is freely sold commercially or as shareware to be used by employers or owners of computers in order to keep track of where their users are going and what they are doing with their computers, particularly useful for parents who care about their children. Detecting such stuff can be very useful if someone has secretly installed one of these things on your Mac for nefarious purposes. But this stuff is NOT malware.
4) It is debatable whether tracker cookies are malware. At worst they are a violation of your personal privacy. So turn on the setting in your browser that prevents downloading 3rd party cookies and turn off the setting in Flash that allows any site to put cached data on your computer. You're done. That's for free. It doesn't require MacScan.
I seriously hope MacScan can actually, factually improve and become a useful product that does what it says. But for now it is junkware, not worth paying for, well worth ignoring in favor of real anti-malware applications like VirusBarrier, ClamXav, and iAntiVirus.
If author Kevin van Wyk had extensive experience with computer security, this article might have been of interest. Unfortunately, the article is incomplete, contains some significant errors and entirely skipped obvious security concerns:
1) He sez: "Neither operating system includes anti-virus protection by default."Bullshite. 10.6 has a malware detection system running by default with signatures for some Trojans. However, it is fair to say that this is an extremely limited and immature anti-malware system. Hopefully Apple will pursue it further in the future. Mac OS X Server has incorporated ClamAV for many years. It would be good to see it moved into the client version as well. However, it must be noted that getting Mac OS X malware signatures incorporated into ClamAV is extremely difficult, partly due to the anti-Mac culture over at the project site. Thankfully, the author of ClamXav for Mac has made some headway in this respect.
2) He sez: "Neither system is immune to viruses, and we certainly have plenty of examples of this fact."Bullshite. There never have been ANY viruses for Mac OS X, period. There are, however, Trojan horse malware for Mac OS X, all of which require LUSER behavior in order to be installed. Most likely Mr. van Wyk simply does not know proper malware terminology. BTW: There are currently 21 known Trojans for Mac OS X compared to 100s of thousands of various malware for Windows.
3) He entirely skipped the security history of both operating systems. Windows 7 has been cracked from out in the wild several times at this point. Mac OS X has never been cracked from out in the wild without user assisted sabotage. Plus there is the fact that Windows in general has over 10,000x more malware of all varieties than Mac OS X. (That simple fact blows the 'security via obscurity' myth to hell. It also indicates that Mac OS X is by nature profoundly more secure than any Windows system).
4) The article ends on a pointlessly wimpy note: "I remain a firm believer that I’m safer on Snow Leopard than I would be on Windows 7."
No one has to 'believe' Mac OS X is the safer. The facts prove Mac OS X is vastly safer than Windows 7.5) He completely left out security dangers caused by non-system software. On Apple's side this includes Safari and most of all QuickTime. On the Windows side thi
s includes Internet Explorer, well known to be the single worst web browser on the market, as well as ActiveX and JScript, both of which are wide open security holes begging for hackers and crackers to enter any Windows machine. Microsoft also deliberately provide only an archaic and hobbled version of Java as a retaliation against their losing their J++ abomination lawsuit from Sun Microsystems. Whereas, Apple provide a much more up-to-date and secure version of Java.
6) He left out the fact that Windows 7 does have superior memory address protection (Address Space Layout Randomization, ASLR) over Mac OS X 10.6, which helps fend off some buffer overrun system pwning. Hopefully Apple will take memory address protection more seriously in 10.7.
--
"More and more malware is discovered every day. Macintosh computers face threats from viruses, Trojan horses, worms and more."Incorrect! There are ONLY Trojan horses for Mac OS X. Period. The End. If you believe otherwise, you've been duped.
"VirusBarrier X6, the Lowest-Priced Mac Antivirus"No. FREE would be 'The Lowest-Priced Mac Antivirus', and there are a few of those to choose from. See below.
"... simply visiting a booby-trapped web page can compromise your Mac."This has never happened on Mac OS X in the wild or in a 'Crack A Mac' competition without an account user providing deliberate sabotage assistance. However it 'could' happen if a JavaScript or Java security hole wasn't patched in your web browser or operating system. (Readers of my posts know what contempt I have for the state of JavaScript).
