http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/ Engadget Comments for Linux becomes only OS to escape PWN 2 OWN unscathed http://www.engadget.com/media/feedlogo.gif http://www.engadget.com en-us Copyright 2012 Weblogs, Inc. The contents of this feed are available for non-commercial use only. Blogsmith http://www.blogsmith.com/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 2:54PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:57PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
1) All of the hackers had roughly the same skill level
2) All three operating systems were exploitable

So what does that leave? Price and desirability. The macbook air is what, over $2000 with an extra $10000 on top of it? Of course that's going to be hacked first, it's the one that everyone would love to have for free (you all can argue that OS X sucks balls, but I think that the main complaint is price, and when that's out the window then suddenly it becomes very desirable).]]>Mar 29th 2008 3:51PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/..the OS has nothing to do with the 'desirability' except Apple's usual crap.]]>Mar 29th 2008 4:02PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
1. "I hacked all 3 OS's!" would be great bragging rights.

2. Hacking Windows or OSX isn't exactly noteworthy: we hear about it all the time. Hacking Linux would be moreso.

3. Once you have the hardware, you could install whatever you want on it.

4. Even if you didn't want the hardware, you could sell it.

There's a world outside of myspace-land, you know.]]>Mar 29th 2008 4:17PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 4:48PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 4:54PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/LOTS of people use linux, and even if they don't, it's like someone said, hardware is hardware. I'd be more inclined to think that linux IS actually harder to crack.
-Taylor]]>Mar 29th 2008 6:52PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 10:06PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 11:21PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
http://www.flickr.com/photos/foundphotoslj/2131815067/
]]>Mar 30th 2008 12:20AMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 30th 2008 12:46AMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 30th 2008 1:21PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 2:54PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 11:34PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/It seems we have three different OS's for three different types of people, so it's like comparing apples to oranges to banana's.

Macs for those who who dont like fiddling with the innards (a generalization, I admit, but I believe it would hold up under study), *nix for those that do, and Windows somewhere between those two camps. Now arguments could be made that it would seem Vista AND the *nix variant Ubuntu are racing to the Mac side (not very well in at least one case); but nevertheless, we are still dealing with "different strokes for different folks".

In the words of a pop-culture icon of the late twentieth century, "Why can't we all just get along?"

(hypereric now gets off his soapbox) ]]>Mar 30th 2008 9:13AMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 2:55PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Seriously, those machines may be stock and have no sort of protection loaded on them save for the stock firewall.]]>Mar 29th 2008 3:06PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/

/sarcasm]]>Mar 29th 2008 3:52PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 4:30PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Read it again. It was a flash exploit.

They also didn't tell you that it needed UAC to work.]]>Mar 29th 2008 6:09PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 7:24PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 10:51PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 10:59PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 11:00PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 30th 2008 10:23PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 2:58PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:00PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
It's just as much work to hack as it is to get working properly.]]>Mar 29th 2008 3:08PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 4:03PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/ "I hear windows folks still have to download drivers."

Yeah...and *I* hear that's because you can add almost any hardware you want on a Windows based system, or even build one yourself from whatever parts you desire. What a trade off...

"*cough*"

*Ah-Choo!*]]>Mar 29th 2008 6:45PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Stop drinking the koolaid, ok?

Apple cannot and does not make drivers for EVERYTHING. Most of the stuff you don't need a driver for on a Mac, you don't need one on a PC either. But there are thousands of devices for PCs for which there are NO drivers on Macs at all.]]>Mar 29th 2008 6:22PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
But you know - running a package manager for a driver is still 'downloading a driver'...]]>Mar 29th 2008 6:32PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 6:38PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
While OSX may have *nix roots, it is just *nix's bastard child.]]>Mar 29th 2008 7:15PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
I tried putting Linux (Ubuntu) on my PC and there were no drivers for my network card.
What is the use of my PC without a working network card? I want to have my OS work with my hardware, not the other way round.
So, Windows is still the way to go for that. Besides, I mostly use it for games, and Windows, as I've certainly figured out with my Mac, is much much better for games.]]>Mar 29th 2008 9:19PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Back in the nineties, maybe.
On my Ubuntu installation, the only driver I had to download was the proprietary GeForce driver (and it took just a few clicks). Everything else was bundled with the operating system.]]>Mar 29th 2008 10:24PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/"While OSX may have *nix roots, it is just *nix's bastard child."

OS X is UNIX_certified:
"Leopard is an Open Brand UNIX 03 registered product on the Intel platform. It is also the first BSD-based OS to receive the UNIX 03 certification."
http://en.wikipedia.org/wiki/Mac_OS_X]]>Mar 30th 2008 7:13AMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:01PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:34PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
I'm usually not on the side of Microsoft with anything, but this contest is so rigged, it's pathetic. Allowing hackers to install a third party software just so they can say Vista got owned (thus throwing off the fact that this is a Microsoft sponsored event), really sends up red flags to me. And then we have the sensationalistic way this exploit for the MacBook Air was portrayed. All the media outlets wrote it up like this guy just walked in and hacked the Mac in two minutes flat. They all ignored the fact that this guy had to work on this exploit for two weeks straight while using a open source code (WebKit) that's freely available to the public. But anyway, this crap pulled on Vista reminds me of when SecureWorks claimed to have hacked a MacBook by installing third party Wifi drivers.]]>Mar 29th 2008 3:02PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:07PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:17PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://dvlabs.tippingpoint.com/blog/2008/03/28/pwn-to-own-final-day-and-wrap-up

Go Adobe. This just reinforces the notion that typically the weakest link in a platform these days are the applications. MS can control their OS and the default installed MS applications so they can do something about the default security (hence why it wasn't until third party apps were introduced that the rig fell) but they can't really do much about the other applications.

As a side note, the actual conditions to win simply required reading a user accessible file from the drive and transimitting its contents, so UAC (nor the corresponding sudo root access in Linux and the OS X Equivelent) wouldn't do anything to help. The OS maker really can't do anything to stop malware running as the current user from accessing files that the current user can touch.

The purpose of this competition wasn't to access the security of a given platform but to root out new zero day exploits, first in the base OS, then in the default applications, and then in popular third party applications.]]>Mar 29th 2008 3:24PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Well, I'm not so sure that this MacBook Air exploit is a high level security threat. First of all, the hack was done over a crossover cable instead of an open internet connection. I don't think security protocols are in place by default when connecting two MacBooks, but I need more information to verify that that is indeed what happened. These hackers are under NDA, so we might not ever know. I'll be sure to remember NOT to connect my MacBook (if and when I get a Macbook) directly to a hacker's computer in the future.

The second thing that disturbs me about this is the fact that as much grief Apple gets for being closed, the one application that has a significant amount of open source is Safari, and that looks to be the main weakness in this case. More than likely Miller used his access to WebKit's source code to find and exploit a security hole, while had this been in the wild from the get-go, more than likely a third party would have discovered the flaw and closed it before Apple had ever heard about it. That's the beauty of open source. Miller actually held back the exploit so that he could win some money and look like a bad ass, which is contrary to what open source is supposed to be about.

So forgive me if I don't get all excited about this. I would be the first to admit that no operating system is absolutely immune to security problems, but there has to be a reasonable amount of compromise before I start worrying about OS X security. Wake me up when a hacker discovers how to gain access to my machine without my interaction and install malicious programs on my Mac without my Administration password. When that happens, Mac users might be in trouble, at least for the couple of weeks that it takes for Apple to close the hole.]]>Mar 29th 2008 3:42PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Well, on a more favorable note, maybe people will stop insisting that Apple allow Flash on the iPhone. Of course, we all know that won't happen. Apple gets a disproportionate amount of whining cause they "think different."]]>Mar 29th 2008 4:00PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
Allowing things to run with privileges that shouldn't need or have them has been a longstanding reason "Windows security" is a joke. It may be slightly better now, but it seems obvious that it remains a problem.]]>Mar 29th 2008 4:56PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 7:14PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/
I glad you brought this up, because this is exactly why no one should be concerned about OS X security.

Despite whatever exploits are discovered, it is extremely hard to create a virus for OS X because users of Mac OS X don't run with administrator privileges. That means you have to type a password to install or change any critical system software. That minimizes the damage that Web or email-based malware can do. And unlike Windows, there is no compatibility requirement for ActiveX binary code insertion into the user or kernel environment via the Web in Mac OS X.

Furthermore, Mac OS X mail doesn't automatically run attachments. One of the poorest security decisions that Microsoft made was that back in 2000 or so, it configured its Outlook and Outlook Express mail systems to automatically execute script code on incoming HTML email without any user action required. This was one of the big vectors for virus proliferation earlier this decade. Microsoft has since patched that problem, but it remains a headache for the entire Microsoft ecosystem because unpatched systems still exist. Meanwhile, Apple mail systems have never run attachments or HTML code automatically, so this very common vector for virus transmission just doesn't exist in the Apple world.

So in conclusion, it's not whether you can get inside OS X, it's what you can do once you're inside that's important and it ain't a whole lot compared to Windows.
]]>Mar 29th 2008 8:05PMhttp://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/http://www.engadget.com/2008/03/29/linux-becomes-only-os-to-escape-pwn-2-own-unscathed/Mar 29th 2008 3:05PM