Can a Mac be hacked? - Page 2 - Tilted Forum Project Discussion Community

Willravel · 03-03-2008, 09:49 AM

Quote:

Originally Posted by RonRyan85

I am using the iMAC browser (Safari) to read YAHOO Email and Google
Email.

RonRyan

Have you upgraded to Safari 3.0?

seretogis · 03-14-2008, 09:25 PM

willravel: formerly Super Psychologist, now Super Hacker? Hilarious!

ubertuber · 03-14-2008, 09:34 PM

Quote:

Originally Posted by RonRyan85

I am using the iMAC browser (Safari) to read YAHOO Email and Google
Email.

RonRyan

If the problem happens again, try making a test user account on your computer. Then log into the email account using safari on the test account.

Willravel · 03-14-2008, 09:47 PM

Sorry, I missed this:

Quote:

Originally Posted by vanblah

That's not "hacking" into Windows.

I was using the term "hacking" somewhat liberally. The threat was about getting her daughter's IP. I provided a method that could end in you having the IP of the person who threatened her.

I'm not talking about accessing his computer or anything, simply using basic trickery to turn the tables.

Daemon1313 · 03-19-2008, 11:26 AM

Quote:

Originally Posted by Shauk

at the end of a day, a computer is a computer, they're all vulnerable in some way or another. It just takes someone who's smart and has a reason to hack you to make it happen.

That pretty much sums the whole thing up. Any computer can be hacked. It just takes enough motivation and know-how.

Quote:

Originally Posted by willravel

Apple offered $25,000 for anyone who could hack Mac OS X. The offer was open for something like 2.5 years. Not one person collected. There was a rumor of a hydra, but it was debunked.

That's odd, when they did this at CanSecWest last year Dino Dai Zovi did it in 9 hours for the $10,000 prize they offered.

FYI, Secunia posted over 200 security vulnerabilities for OS X last year.

connyosis · 03-29-2008, 12:53 PM

Can a Mac be hacked? Why yes, yes it can...

The question shouldn't be IF a system (Mac, Windows, Linux, *BSD...) can be hacked, but how fast or easily.

Cynthetiq · 03-29-2008, 01:54 PM

Quote:

Gone in 2 minutes: Mac gets hacked first in contest
IDG News Service 3/27/08

Robert McMillan, IDG News Service, San Francisco Bureau

It may be the quickest $10,000 Charlie Miller ever earned.

He took the first of three laptop computers -- and a $10,000 cash prize -- Thursday after breaking into a MacBook Air at the CanSecWest security conference's PWN 2 OWN hacking contest.

Show organizers offered a Sony Vaio, Fujitsu U810 and the MacBook as prizes, saying that they could be won by anybody at the show who could find a way to hack into each of them and read the contents of a file on the system, using a previously undisclosed "0day" attack.

Nobody was able to hack into the systems on the first day of the contest when contestants were only allowed to attack the computers over the network, but on Thursday the rules were relaxed so that attackers could direct contest organizers using the computers to do things like visit Web sites or open e-mail messages.

The MacBook was the only system to be hacked by Thursday, however, the word on the show floor is that the Linux and Vista systems will meet with some serious challenges on Friday.

Miller, best known as one of the researchers who first hacked Apple's iPhone last year, didn't take much time. Within 2 minutes, he directed the contest's organizers to visit a Web site that contained his exploit code, which then allowed him to seize control of the computer, as about 20 onlookers cheered him on.

He was the first contestant to attempt an attack on any of the systems.

Miller was quickly given a nondisclosure agreement to sign and he's not allowed to discuss particulars of his bug until the contest's sponsor, TippingPoint, can notify the vendor.

Contest rules state that Miller could only take advantage of software that was preinstalled on the Mac, so the flaw he exploited must have been accessible, or possibly inside, Apple's Safari browser.

Last year's contest winner, Dino Dai Zovi, exploited a vulnerability in QuickTime to take home the prize.

Dai Zovi, who congratulated Miller after his hack, didn't participate in this year's contest, saying it was time for someone else to win.

By late Thursday, Apple engineers were already working on patching the issue, said Aaron Portnoy, a TippingPoint researcher who is one of the contest's judges.

Miller's $10,000 payday may sound sweet, but it's not the most Miller has been paid for his work. In 2005, he earned $50,000 for a Linux bug he delivered to an unnamed government agency.

Last year's contest winner, Dino Dai Zovi, exploited a vulnerability in QuickTime to take home the prize.

Dai Zovi, who congratulated Miller after his hack, didn't participate in this year's contest, saying it was time for someone else to win.

Shane Macaulay, who was Dai Zovi's co-winner last year, spent much of Thursday trying to hack into the Fujitsu Vista laptop, at one point rushing back to his Vancouver area home to retrieve a file that he thought might help him hack into the system.

But it was all in vain.

"It's one thing to find a vulnerability, it's another thing to make working exploit code," said Terri Forslof, TippingPoint's Manager of Security Response.

Forslof said that a number of "high quality" researchers have said that they will attempt to hack the machines on Friday, the last day of the conference.

She expects both systems to be hacked on Friday, when contest rules will be further eased, and hackers will be able to attack popular third-party software that can be installed on the systems. "I don't think we'll have to take any home," she said.

Bob McMillan is Senior writer for the IDG News Service.

wow.. 2 minutes....damn.

Willravel · 03-29-2008, 02:27 PM

It wasn't actually 2 minutes. The website was authored earlier and then it took two minutes to get to the site and then infect the computer.

Wasn't this story already flagged as inaccurate on Digg?

connyosis · 03-29-2008, 02:45 PM

Quote:

Originally Posted by willravel

It wasn't actually 2 minutes. The website was authored earlier and then it took two minutes to get to the site and then infect the computer.

Wasn't this story already flagged as inaccurate on Digg?

Well that still is pretty bad. A visit to a malicious website and your computer can be infected within minutes.
Anyhew, my point wasn't to bash Macs, simply that any system can (most likely) be hacked given enough time. There is no such thing as a flawless operating system.

MSD · 03-29-2008, 06:43 PM

Quote:

Originally Posted by willravel

No problema. The proof of PeerGuardian was when MSD asked me why I had 900 IPs in the past month I'd used to visit TFP.

I don't know how many it is these days, I ran a search and the browser timed out after 20 minutes of waiting for a response.

Quote:

Originally Posted by Martian

And it doesn't matter how good of a 'hacker' I am, I simply can't break into a properly secured system. The rules don't let me. Since it's difficult to impossible, then, to fool the system, most of the attempts to crack a box are aimed at the user, who is relatively easy to fool. Kevin Mitnick was mentioned above. The man is a god amongst geeks. He's a geek superstar. And even he was noted more for his social engineering abilities than any prominent technical skills.

This can't be overstated. The user is always the weakest point of a properly secured system. The strongest safe in the world won't help you if I'm looking over your shoulder and writing down the combination as you turn the dial, or I can just convince you to tell me what it is.

Daemon1313 · 03-31-2008, 10:52 AM

Quote:

Originally Posted by willravel

It wasn't actually 2 minutes. The website was authored earlier and then it took two minutes to get to the site and then infect the computer.

Wasn't this story already flagged as inaccurate on Digg?

Cause we all know Digg is an accurate source of reality.

You are correct though it was actually 2 minutes into day two when the contestants could have some interaction with the computers (i.e. browsing to webpages).

The Vista laptop was cracked 7 hours into day 3 when the laptops were installed with "popular" 3rd party software. If I remember correctly it was a flaw in Flash that was exploited.

The Ubunutu Linux laptop had not cracked at the end of the competition.

Redlemon · 03-31-2008, 12:32 PM

My thought on the "2-minute hack": I think it shows that the "security through obscurity" model is somewhat at play for the Mac. There were no Day-2 exploits of the Windows machine, because the exploits used to get into Windows were already in the wild, and therefore not eligible for this contest.

Of course, I haven't read closely enough to back up this opinion.

Shauk · 04-16-2008, 02:29 AM

i find it hilarious that a mac was the 1st one hacked though.

I'mma have to check out ubuntu, my co-worker is very pleased with it

Martian · 04-16-2008, 02:48 AM

Quote:

Originally Posted by Shauk

i find it hilarious that a mac was the 1st one hacked though.

I'mma have to check out ubuntu, my co-worker is very pleased with it

Ubuntu (and Linux in general) is great if you don't need any Windows software. That means games, any proprietary Windows stuff that there's no Linux equivalent for, stuff like that. If you like to play computer games on your computer, Ubuntu isn't really worth using; Battle For Wesnoth gets old after a while.

Also be aware that there is no Linux distro that is as user friendly as Windows. Ubuntu is nice because everything's slick and easy to use, but you're still going to need to know how to compile and set up cron jobs and all that fun stuff. It's a steep learning curve if you're not familiar with the environment.

jewels · 04-16-2008, 03:40 AM

By the way, we never did get hacked.

I was more fascinated by this 4chan organization, threats and the supposed powers thereof.

It's been very interesting to read all these related posts though.

Shauk · 04-16-2008, 05:04 AM

Quote:

Originally Posted by Martian

Ubuntu (and Linux in general) is great if you don't need any Windows software. That means games, any proprietary Windows stuff that there's no Linux equivalent for, stuff like that. If you like to play computer games on your computer, Ubuntu isn't really worth using; Battle For Wesnoth gets old after a while.

Also be aware that there is no Linux distro that is as user friendly as Windows. Ubuntu is nice because everything's slick and easy to use, but you're still going to need to know how to compile and set up cron jobs and all that fun stuff. It's a steep learning curve if you're not familiar with the environment.

eh, i'm used to doing command line stuff on our unix servers at work, just basic stuff but enough to get started.

but yeah, XP/Vista (depending on the DX I suppose) are the gaming O/S's I'm aware, I've only been using computers for like 10 years /rib

Martian · 04-16-2008, 05:08 AM

Quote:

Originally Posted by Shauk

...I've only been using computers for like 10 years /rib

So has my mother.

There's definitely an OS shock type of thing when switching. I wouldn't want you to go over for the wrong reasons, is all. If you're familiar with a Unix environment you should be more or less okay, and Ubuntu is pretty easy to use.

Synaptic is going to be your best friend. I know it's mine.

Shauk · 04-16-2008, 06:58 AM

Quote:

Originally Posted by Martian

So has my mother.

oooooh touche

03-14-2008, 09:25 PM	#42 (permalink)
seretogis Huggles, sir? Location: Seattle	willravel: formerly Super Psychologist, now Super Hacker? Hilarious! __________________ seretogis - sieg heil perfect little dream the kind that hurts the most, forgot how it feels well almost no one to blame always the same, open my eyes wake up in flames Last edited by seretogis; 03-14-2008 at 09:55 PM..

03-29-2008, 12:53 PM	#46 (permalink)
connyosis Psycho Location: Sweden - Land of the sodomite damned	Can a Mac be hacked? Why yes, yes it can... The question shouldn't be IF a system (Mac, Windows, Linux, *BSD...) can be hacked, but how fast or easily. __________________ If atheism is a religion, then not collecting stamps is a hobby.

03-31-2008, 12:32 PM	#52 (permalink)
Redlemon Devoted Donor Location: New England	My thought on the "2-minute hack": I think it shows that the "security through obscurity" model is somewhat at play for the Mac. There were no Day-2 exploits of the Windows machine, because the exploits used to get into Windows were already in the wild, and therefore not eligible for this contest. Of course, I haven't read closely enough to back up this opinion. __________________ I can't read your signature. Sorry.

04-16-2008, 03:40 AM	#55 (permalink)
jewels Eponymous Location: Central Central Florida	By the way, we never did get hacked. I was more fascinated by this 4chan organization, threats and the supposed powers thereof. It's been very interesting to read all these related posts though. __________________ We are always more anxious to be distinguished for a talent which we do not possess, than to be praised for the fifteen which we do possess. Mark Twain

03-29-2008, 02:27 PM	#48 (permalink)
Willravel ... a sort of licensed troubleshooter.	It wasn't actually 2 minutes. The website was authored earlier and then it took two minutes to get to the site and then infect the computer. Wasn't this story already flagged as inaccurate on Digg?

04-16-2008, 02:29 AM	#53 (permalink)
Shauk Confused Adult Location: Spokane, WA	i find it hilarious that a mac was the 1st one hacked though. I'mma have to check out ubuntu, my co-worker is very pleased with it