Hasta La Gadget!

This article was written on March 28, 2008 by CyberNet.

…brush your teeth, grab a cup of coffee, email a friend, or hack a MacBook Air. Just like last year the CanSecWest conference is currently going on, and tons of hackers cram in to see who can be the first to hack one of the laptops that are provided. The first nerd person to forcefully gain control of one out of the three laptops not only takes home that laptop, but also receives a worthwhile $10,000 cash prize.

The three laptops that were being attacked were a VAIO VGN-TZ37CN running Ubuntu 7.10, Fujitsu U810 running Vista Ultimate SP1, and a MacBook Air running OSX 10.5.2. On the first day of the contest the rules were kind of strict, and the hackers could only go after the computers over the network. There was a strong stench of failure in the air that day.

Then yesterday they decided to let go a bit and let the hackers direct the contest organizers to a website that they created to run malicious code. Charlie Miller, the first one to hack the iPhone last year, was all over it and almost immediately gained access to the MacBook Air. It took him a whopping 2 minutes to get into the system, but no one knows exactly how he did it because he was forced to sign a nondisclosure agreement. Many expect that the vulnerability lies in Apple’s Safari browser.

In case you’re wondering, contestants like Charlie had to follow these guidelines for their attack:

• You can’t use the same vulnerability to claim more than one box, if it is a cross-platform issue.
• Thirty minute attack slots given to contestants at each box.
• Attacks are done via crossover cable. (attacker controls default route)
• No physical access to the machines.
• Major web browsers (IE, Safari, Konqueror, Firefox), widely used and deployed plugin frameworks (AIR, Silverlight), IM clients (MSN, Adium, Skype, Pigdin, AOL, Yahoo), Mail readers (Outlook, Mail.app, Thunderbird, kmail) are all in scope.

So congrats to Charlie. Apple… get to work! 😉

CanSecWest [via PC World]
Thanks to CoryC for the tip!
Part of the image via bid burglar!

Copyright © 2014 CyberNetNews.com