Linux becomes only OS to escape PWN 2 OWN unscathed

After a week full of Red Bulls, Fruit by the Foot and dreams of In-N-Out, the mighty Sony VAIO loaded with Linux stood as the only machine unhacked by the end of the PWN 2 OWN hacking contest at CanSecWest. As you're well aware by now, the MacBook Air on display was seized in two minutes by the presumably well prepared Charlie Miller, and after two full days of work, Shane Macaulay and a few of his 1337 associates managed to crack the Vista rig on Friday. Reportedly, Shane and his pals weren't expecting to do battle with the extra protected SP1 version of Vista, and while the exact loophole won't be divulged, we are told that it was a cross-platform bug that "took advantage of Java to circumvent Vista's security." In the end, it was reported that some folks on hand had discovered bugs in the Linux OS, but many of them "didn't want to put the work into developing the exploit code that would be required to win the contest."

[Image courtesy of TippingPoint]

[bk00 @ Mar 29th 2008 2:54PM]

Ha ha. So essentially nobody bothered hacking the Linux machine because nobody wanted it.

[Greg @ Mar 29th 2008 3:57PM]

Plus, why bother hacking Linux? Who uses it? =p

[John @ Mar 29th 2008 3:51PM]

Yeah, and that's exactly what this is: a contest based on desirability. People say that the MacBook Air is the most vulnerable, but I assume the following:

1) All of the hackers had roughly the same skill level
2) All three operating systems were exploitable

So what does that leave? Price and desirability. The macbook air is what, over $2000 with an extra $10000 on top of it? Of course that's going to be hacked first, it's the one that everyone would love to have for free (you all can argue that OS X sucks balls, but I think that the main complaint is price, and when that's out the window then suddenly it becomes very desirable).

[ethana2 @ Mar 29th 2008 4:02PM]

hardware is hardware. I have three machines that came with XP all running Hardy perfectly.
..the OS has nothing to do with the 'desirability' except Apple's usual crap.

[oGMo @ Mar 29th 2008 4:17PM]

Wow, I'm not sure how you all manage to bump enough braincells together to get your posts typed before shorting out your keyboards with drool.

1. "I hacked all 3 OS's!" would be great bragging rights.

2. Hacking Windows or OSX isn't exactly noteworthy: we hear about it all the time. Hacking Linux would be moreso.

3. Once you have the hardware, you could install whatever you want on it.

4. Even if you didn't want the hardware, you could sell it.

There's a world outside of myspace-land, you know.

[Brian Sexton @ Mar 29th 2008 4:48PM]

Plenty of people use GNU/Linux and more and more are joining them every day. It isn't perfect for every task (e.g., I still use either Mac OS X or Windows for Adobe Creative Suite), but the days of average users having to put up with difficult operating system and application installations and updates are gone. Advanced users who want fine control can still have it, but easy installers, systems such as the Asus Eee PC and Shuttle KPC that ship with GNU/Linux pre-installed, and user-friendly distributions such as Ubuntu, Kubuntu, and Foresight Linux are slowly bringing GNU/Linux to the masses.

[Hugh Newmark @ Mar 29th 2008 4:54PM]

Linux ftw

[Taylor @ Mar 29th 2008 6:52PM]

Hah, that is hilarious because this story was also featured on Slashdot, and everyone in the comments was like "Who wants a windows or OSX machine anyway?"
LOTS of people use linux, and even if they don't, it's like someone said, hardware is hardware. I'd be more inclined to think that linux IS actually harder to crack.
-Taylor

[superfresh @ Mar 29th 2008 10:06PM]

Could someone clear something up for me? What does a picture of two gay guys have to do with this story?

[UKNigel @ Mar 29th 2008 11:21PM]

Those are the guys that brought the Macbook Air.

[Jared @ Mar 30th 2008 12:20AM]

The two guys pictured for the story remind me of this photo:

http://www.flickr.com/photos/foundphotoslj/2131815067/

[Blackstar @ Mar 30th 2008 12:46AM]

Linux. It's more secure, because even hackers don't like typing in terminal windows.

[Wally @ Mar 30th 2008 1:21PM]

Everyone seems to downplay the Linux.

[Sime @ Mar 29th 2008 2:54PM]

lazy bastards...

[E71 @ Mar 29th 2008 11:34PM]

More like BIASED bastards! Guess their favorite OS is Linux.

[hypereric @ Mar 30th 2008 9:13AM]

Although once I guess I was a "fanboi", I have had to reconsider my position.
It seems we have three different OS's for three different types of people, so it's like comparing apples to oranges to banana's.

Macs for those who who dont like fiddling with the innards (a generalization, I admit, but I believe it would hold up under study), *nix for those that do, and Windows somewhere between those two camps. Now arguments could be made that it would seem Vista AND the *nix variant Ubuntu are racing to the Mac side (not very well in at least one case); but nevertheless, we are still dealing with "different strokes for different folks".

In the words of a pop-culture icon of the late twentieth century, "Why can't we all just get along?"

(hypereric now gets off his soapbox)

[Fox @ Mar 29th 2008 2:55PM]

Nice to see that the SP1 upgrade to Vista helped with security exploits.

[Aguiluz @ Mar 29th 2008 3:06PM]

But try adding ZoneAlarm and Firefox+NoScript.

Seriously, those machines may be stock and have no sort of protection loaded on them save for the stock firewall.

[John @ Mar 29th 2008 3:52PM]

Haha, are you sure it was increased security and not that it slowed the system down so much that hackers stopped bothering?


/sarcasm

[Neebs @ Mar 29th 2008 4:30PM]

RTFA...it says there was an exploit in Sun's Java.

[Bryant @ Mar 29th 2008 6:09PM]

"RTFA...it says there was an exploit in Sun's Java."

Read it again. It was a flash exploit.

They also didn't tell you that it needed UAC to work.

[Andir3.0 @ Mar 29th 2008 7:24PM]

So what, why didn't the same Flash hack work in Linux or OSX then?

[Kurian @ Mar 29th 2008 10:51PM]

Bloated JAVA shit. Die already. Most inefficient pathetic excuse for lack of programming skill I have ever seen.

[Rofl @ Mar 29th 2008 10:59PM]

Re: Andir, That's a pretty ridiculous statement based on very little information. Unless the same programming team worked on both Windows and Linux versions of Flash, it's an apples to oranges comparison. Even if they did, it could be simply a coding bug, it's not like they just take the exact same code, compile it in all three platforms and it just works. Even the versions may be different, it may be a bug specific to the current version of Flash installed on that Vista system that may or may not have affected earlier versions (and knowing Adobe, the minor versions of Flash on Mac and Linux probably trail behind Windows due to the size of the relative size of programming teams). Even looking at linux based home routers, bugs are present in some brands and not in others even they use the same codebase. You can't make sweeping generalizations of this nature without any of the details which are still under NDA.

[Rofl @ Mar 29th 2008 11:00PM]

Re: Andir, That's a pretty ridiculous statement based on very little information. Unless the same programming team worked on both Windows and Linux versions of Flash, it's an apples to oranges comparison. Even if they did, it could be simply a coding bug, it's not like they just take the exact same code, compile it in all three platforms and it just works. Even the versions may be different, it may be a bug specific to the current version of Flash installed on that Vista system that may or may not have affected earlier versions (and knowing Adobe, the minor versions of Flash on Mac and Linux probably trail behind Windows due to the size of the relative size of programming teams). Even looking at linux based home routers, bugs are present in some brands and not in others even they use the same codebase. You can't make sweeping generalizations of this nature without any of the details which are still under NDA.

[Andir3.0 @ Mar 30th 2008 10:23PM]

It's clear Rofl, that you have no idea how Flash runs on Linux. It is however, very clear that you support Microsoft with that little knowledge as if it were the truth. (For the record, the same version of flash runs on both...)

[Pro7 @ Mar 29th 2008 2:58PM]

This is why OSX will always be fashion and nothing else.

[puhsitch @ Mar 29th 2008 3:00PM]

Well that's a rather silly thing to say.

[dvsbstrd @ Mar 29th 2008 3:08PM]

And also why Linux will never catch on as a mainstream OS.

It's just as much work to hack as it is to get working properly.

[ethana2 @ Mar 29th 2008 4:03PM]

That made no sense. I hear windows folks still have to download drivers. *cough*

[OddManOut @ Mar 29th 2008 6:45PM]

"I hear windows folks still have to download drivers."

Yeah...and *I* hear that's because you can add almost any hardware you want on a Windows based system, or even build one yourself from whatever parts you desire. What a trade off...

"*cough*"

*Ah-Choo!*

[Jeff Lewis @ Mar 29th 2008 6:22PM]

Gee Ethana - I'm still trying to download a driver for my webcam, my TV tuner cards and my PDA on my Macs.

Stop drinking the koolaid, ok?

Apple cannot and does not make drivers for EVERYTHING. Most of the stuff you don't need a driver for on a Mac, you don't need one on a PC either. But there are thousands of devices for PCs for which there are NO drivers on Macs at all.

[Jeff Lewis @ Mar 29th 2008 6:32PM]

As for linux - well, you don't download drivers - you wait for someone to reverse engineer the hardware, make a half-assed driver, get the source (thus not actually having to 'download a driver') and then install it. Repeat until it's finally stable.

But you know - running a package manager for a driver is still 'downloading a driver'...

[Tony Rayo @ Mar 29th 2008 6:38PM]

OSX is Unix-based people. Why all this *nix vs mac fighting? Now only if OSX was not hardware locked (I know, there are ways around some parts, but more progress would be made if it was legit). Lots of linux programs that aren't already ported to OSX can be compiled under the OS, it would be sweet if we could have Mac apps on non-mac hardware. But aside of hacks and such, I don't see Apple making a move that would pretty much do nothing for them except lose hardware (and possible software) sales.

[zargon @ Mar 29th 2008 7:15PM]

"OSX is Unix-based people."

While OSX may have *nix roots, it is just *nix's bastard child.

[Taylor @ Mar 29th 2008 9:19PM]

I am a Mac and Windows user, I like both my MacBook and my home-made PC equally, so no fanboi comments thanks.

I tried putting Linux (Ubuntu) on my PC and there were no drivers for my network card.
What is the use of my PC without a working network card? I want to have my OS work with my hardware, not the other way round.
So, Windows is still the way to go for that. Besides, I mostly use it for games, and Windows, as I've certainly figured out with my Mac, is much much better for games.

[k99goran @ Mar 29th 2008 10:24PM]

"As for linux - well, you don't download drivers - you wait for someone to reverse engineer the hardware, make a half-assed driver, get the source (thus not actually having to 'download a driver') and then install it. Repeat until it's finally stable."

Back in the nineties, maybe.
On my Ubuntu installation, the only driver I had to download was the proprietary GeForce driver (and it took just a few clicks). Everything else was bundled with the operating system.

[Yours Smugly @ Mar 30th 2008 7:13AM]

@ Zargon:
"While OSX may have *nix roots, it is just *nix's bastard child."

OS X is UNIX_certified:
"Leopard is an Open Brand UNIX 03 registered product on the Intel platform. It is also the first BSD-based OS to receive the UNIX 03 certification."
http://en.wikipedia.org/wiki/Mac_OS_X

[Eric M. @ Mar 29th 2008 3:01PM]

Which flavor of Linux was it? Me

[ssuk @ Mar 29th 2008 3:34PM]

Ubuntu 7.10

[clak @ Mar 29th 2008 3:02PM]

Actually, Engadget dudes, the hackers were allowed to install Flash to exploit Vista. I don't think Java had anything to do with it.

I'm usually not on the side of Microsoft with anything, but this contest is so rigged, it's pathetic. Allowing hackers to install a third party software just so they can say Vista got owned (thus throwing off the fact that this is a Microsoft sponsored event), really sends up red flags to me. And then we have the sensationalistic way this exploit for the MacBook Air was portrayed. All the media outlets wrote it up like this guy just walked in and hacked the Mac in two minutes flat. They all ignored the fact that this guy had to work on this exploit for two weeks straight while using a open source code (WebKit) that's freely available to the public. But anyway, this crap pulled on Vista reminds me of when SecureWorks claimed to have hacked a MacBook by installing third party Wifi drivers.

[Timay @ Mar 29th 2008 3:07PM]

You should be happy that regardless of how long it took that the exploit will be fixed and not used against normal users.

[Adam @ Mar 29th 2008 3:17PM]

Please raise your hands if you do not have flash installed on your system right now...

[josh @ Mar 29th 2008 3:24PM]

Indeed, according the blog post by TippingPoint (the guys running the contest) it was a flash vulnerability: http://dvlabs.tippingpoint.com/blog/2008/03/28/pwn-to-own-final-day-and-wrap-up

Go Adobe. This just reinforces the notion that typically the weakest link in a platform these days are the applications. MS can control their OS and the default installed MS applications so they can do something about the default security (hence why it wasn't until third party apps were introduced that the rig fell) but they can't really do much about the other applications.

As a side note, the actual conditions to win simply required reading a user accessible file from the drive and transimitting its contents, so UAC (nor the corresponding sudo root access in Linux and the OS X Equivelent) wouldn't do anything to help. The OS maker really can't do anything to stop malware running as the current user from accessing files that the current user can touch.

The purpose of this competition wasn't to access the security of a given platform but to root out new zero day exploits, first in the base OS, then in the default applications, and then in popular third party applications.

[clak @ Mar 29th 2008 3:42PM]

@Timay

Well, I'm not so sure that this MacBook Air exploit is a high level security threat. First of all, the hack was done over a crossover cable instead of an open internet connection. I don't think security protocols are in place by default when connecting two MacBooks, but I need more information to verify that that is indeed what happened. These hackers are under NDA, so we might not ever know. I'll be sure to remember NOT to connect my MacBook (if and when I get a Macbook) directly to a hacker's computer in the future.

The second thing that disturbs me about this is the fact that as much grief Apple gets for being closed, the one application that has a significant amount of open source is Safari, and that looks to be the main weakness in this case. More than likely Miller used his access to WebKit's source code to find and exploit a security hole, while had this been in the wild from the get-go, more than likely a third party would have discovered the flaw and closed it before Apple had ever heard about it. That's the beauty of open source. Miller actually held back the exploit so that he could win some money and look like a bad ass, which is contrary to what open source is supposed to be about.

So forgive me if I don't get all excited about this. I would be the first to admit that no operating system is absolutely immune to security problems, but there has to be a reasonable amount of compromise before I start worrying about OS X security. Wake me up when a hacker discovers how to gain access to my machine without my interaction and install malicious programs on my Mac without my Administration password. When that happens, Mac users might be in trouble, at least for the couple of weeks that it takes for Apple to close the hole.

[clak @ Mar 29th 2008 4:00PM]

@Adam

Well, on a more favorable note, maybe people will stop insisting that Apple allow Flash on the iPhone. Of course, we all know that won't happen. Apple gets a disproportionate amount of whining cause they "think different."

[oGMo @ Mar 29th 2008 4:56PM]

Eh. If a user can install 3rd party software that can compromise the system, it's the system's fault (given it was installed on a non-privileged account). You can install all sorts of things on Linux in userland and count on them not having any access beyond what that user has.

Allowing things to run with privileges that shouldn't need or have them has been a longstanding reason "Windows security" is a joke. It may be slightly better now, but it seems obvious that it remains a problem.

[Andir3.0 @ Mar 29th 2008 7:14PM]

You guys know that you can run flash under Ubuntu, right? So why... oh why didn't the same hack work there? Oh, right. The better security model.

[clak @ Mar 29th 2008 8:05PM]

@oGMo

I glad you brought this up, because this is exactly why no one should be concerned about OS X security.

Despite whatever exploits are discovered, it is extremely hard to create a virus for OS X because users of Mac OS X don't run with administrator privileges. That means you have to type a password to install or change any critical system software. That minimizes the damage that Web or email-based malware can do. And unlike Windows, there is no compatibility requirement for ActiveX binary code insertion into the user or kernel environment via the Web in Mac OS X.

Furthermore, Mac OS X mail doesn't automatically run attachments. One of the poorest security decisions that Microsoft made was that back in 2000 or so, it configured its Outlook and Outlook Express mail systems to automatically execute script code on incoming HTML email without any user action required. This was one of the big vectors for virus proliferation earlier this decade. Microsoft has since patched that problem, but it remains a headache for the entire Microsoft ecosystem because unpatched systems still exist. Meanwhile, Apple mail systems have never run attachments or HTML code automatically, so this very common vector for virus transmission just doesn't exist in the Apple world.

So in conclusion, it's not whether you can get inside OS X, it's what you can do once you're inside that's important and it ain't a whole lot compared to Windows.

[John Aubrey @ Mar 29th 2008 3:05PM]

I didn't think Java was built into Vista, but a extra download you need. And didn't they give the computers the standard install and no other software? Seems to be a java problem and not a Vista one.