Apple's iPhone, Safari on Mac exploited at annual hacking contest - Page 4

Originally Posted by geekdad

Now this was the first post that made sense!!!
read this article http://www.pcworld.com/businesscente...n_contest.html

The iPhone was hacked in seconds......Windows 7 machine was compromised in about 2 minutes I believe this year..... so no one platform is safe....assuming you will not get compromised because you are on a Mac is sticking your head in the sand.
Any platform can get hacked at anytime..... and not just by a virus....Most of them by malicious code from a website.......so everyone is vulnerable.....unless you don't connect to the outside world that is.......

Originally Posted by Quadra 610

MIller took advantage of brute-force techniques and called it hacking.

Too funny.

Originally Posted by Quadra 610

Which is nearly half the web.

But I'm sure that sticking to CNN and Disney will keep you perfectly safe.

I can't off the top of my head think of any site that will compromise OS X, or that is even remotely a threat. There's a good chance that none even exist at this point, which would be par for the course when it comes to OS X.

Originally Posted by DaveGee

Okay lets be a little adult about this...

The went 'after' Apple because it has the best 'in the wild' track record when it comes to security AND Apple has no quams about boasting that fact.

Going after ANY Microsoft product?!?! Perhaps a project that the 'preschoolers' might find mildly challenging but if you notice nobody gets too much 'street cred' for boasting their latest attack on Microsoft... UNLESS perhaps the OS was just release or 'newly patched' to be 'even more secure!'

Linux is so open its not even worth talking about... It's like bragging you stole a boat load of cash when in fact you simply took a few pennies form the 'need a penny' container at the 7-11.

So yes.. the SUPER SPOTLIGHT is clearly shown on hackers who tackle Apple products and ... rightfully so...

BUT as others have already pointed out... this crap is done EVERY YEAR but these folks and yes somehow another year ticks by without an significant* virus, worm or trojan making assaults OS X based systems or devices.

* I used 'significant' simply because I couldn't with a 100% certainty say nobody on a Mac based system was ever attacked or infected by a virus in the past year while running its native OS (OS X and/or iPhone OS) not dual booting or virtual machines running alternate OS... That kinda crap clearly wouldn't count!

Historically, the competition has required competitors to use the newest version of the browser and operating system. Perhaps aware of this, Apple released Safari 5.0.4 a day ahead of the competition, patching some 60 security holes in the browser. However, this year the rules have been altered: the configuration was frozen a week ago, hence the competition being run against Safari 5.0.3. Under the new rules, pwning (and hence owning) only needs to succeed on the frozen version. However, to receive prize money (in addition to the hardware), the flaw must also exist in the newest release.

Originally Posted by cmf2

It gives people an incentive to find vulnerabilities and report them so they can be patched.

Originally Posted by Brian Green

I would just like to know why it is that these people are so good at finding these holes, and yet Apple seems so bad at spotting them beforehand? Is it that the people in security at Apple are not looking thoroughly enough?

I know that Apple has a real-world track record that is admirable, but are the people who actually write this software not the least bit shamed by the fact that a couple of people can compromise their system within seconds? I know they just hired a guy that used to work for the NSA. It would appear that Apple is at least trying to make security important, yet these holes are there for these people to exploit in these contests and Apple doesn't have a clue they existed prior?

Why is it that we aren't issued security updates after these contests with literature stating that each one of these holes has been successfully patched and won't be exploited again? I know we just had a Safari update, but I'm not sure if they fixed the holes these people exploited.

I know I'm naive when it comes to the software writing and patching thing. I trust the folks at Apple to have some bright people who prevent this sort of thing from happening. Do those bright people even remotely have egos? Do they not hang their heads in shame knowing that despite their best efforts, their "best" was beaten in five seconds? If they are using websites to get into the Macs that are malicious, why is it that Apple doesn't have a thing in Safari that detects this and stops it from happening in the first place? How do the people at Apple who are supposed to look for these holes (if there are such people) justify that for the last three years, they haven't been successful in staving off the attack?

Maybe Lion will be better. Maybe they see that gaining market share means gaining a target for their users as well. Seeing Apple get its @$$ handed to it every single year is getting flat out depressing when these people are laughing it up that Apple is apparently full of holes.