Mac OS X Security Competition Ends in 30 Minutes 388
ninja_assault_kitten writes "ZDnet is running an article on how a Swedish Mac OS X enthusiast held a competition to prove how good security was on his new fully patched Mac Mini was. Unfortunately, 30 minutes after the competition began, a hacker known as 'gwerdna' had broken in and defaced the website, thus winning the contest.
According to gwerdna, 'Mac OS X is easy pickings for bug finders. That said, it doesn't have the market share to really interest most serious bug finders.'." It's also worth noting a piece that says all the security news is much ado about nothing, in practical terms. The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack.
Why keep SSH on? (Score:4, Interesting)
Re:Why keep SSH on? (Score:4, Insightful)
Re:Why keep SSH on? (Score:5, Informative)
Re:Why keep SSH on? (Score:2, Informative)
Re:Why keep SSH on? (Score:2, Informative)
Perhaps with a desktop Mac (Score:3, Informative)
Not saying there's anything wrong with this, Solaris, FreeBSD, et al are the same, but while SSH may need enabling on a Mac desktop, it does not appear to on a Mac server.
Re:Perhaps with a desktop Mac (Score:5, Informative)
Not saying there's anything wrong with this, Solaris, FreeBSD, et al are the same, but while SSH may need enabling on a Mac desktop, it does not appear to on a Mac server.
Of course SSH is on by default on a Mac Server--it is designed to run, and be configured from first boot, headless. That would be pretty difficult to do if you had no services. Other default services are Apple Remote Desktop, for GUI control, and the Server Admin Suite; even the Apple Server Admin Tools can be port forwarded through SSH if you prefer.
The assumption is that servers will be managed by those with a clue, whereas desktops will not usually be. Also, no Mac desktops are expected to be configured and maintained headless from first boot, whereas you have to specify a video card for an Xserver for it to be graphical at all. I don't think those are unreasonable assumptions to make.
Re:Perhaps with a desktop Mac (Score:3, Informative)
Re:Perhaps with a desktop Mac (Score:5, Insightful)
I think there are probably some also remote-administration services running by default on Server, but don't quote me on that. I know for sure that ssh is not running on regular, consumer MacOS, however. (I just set up a new G5 a few days ago and I had to turn it on manually.)
I think it's also worth pointing out that based on my understanding of the article in question here (the second link in the summary doesn't point to what I think it originally did), ssh wasn't just running on the machine, attackers were allowed to log-in as a non-root user. So really what happened wasn't a cracking in the strict sense, but privilege escalation. Still bad -- and I'm rather annoyed that "gwerdna" or whatever his name was didn't tell us what this great "unpublished and unreported vulnerability" was that he used, but I don't think that it means that any box is compromisable simply by virtue of running sshd.
Re:Perhaps with a desktop Mac (Score:3, Interesting)
Hmm. Maybe we should ask Andrew G?
(Hint: backwards)
Re:Why keep SSH on? (Score:4, Informative)
Re:Why keep SSH on? (Score:3, Insightful)
That's one of the first things you turn off to protect the machine.
Because the goal was to test the mac mini's security, not the ability of the system administrator to secure the box...
Re:Why keep SSH on? (Score:5, Insightful)
SSH is off by default, the admin had to turn it on.
Hackers don't generally have shell accounts -the admin had to set them up.
So if you take steps to make the Mac Mini less secure, then advertise you've done so, it gets hacked. Expect all major tech outlets to cover this new and amazing Mac vulnerability (you think I'm joking?).
Re:Why keep SSH on? (Score:3, Insightful)
Re:Why keep SSH on? (Score:4, Interesting)
Re:Why keep SSH on? (Score:3, Insightful)
Re:Why keep SSH on? (Score:5, Informative)
Somewhere inside of Apple, engineers are shaking their heads at this guy and the damage he's done to the Mac's reputation.
Re:Why keep SSH on? (Score:5, Insightful)
Re:Why keep SSH on? (Score:4, Insightful)
But you need to remember that OS X is not designed for remote, multi-user usage. The features are there, but mostly for adminstrative purposes. The machine is first and foremost a Desktop machine that is intended to keep good guys in and bad guys out.
Also keep in mind that it is incredibly difficult to properly configure a Unix system to be completely secure against users with shell accounts. Such security requires a complete system lockdown, complex partitioning, reassignment of services to non-root accounts, jailing of priviledged services (or equivalent), and several other procedures that I sincerely doubt that this guy performed. (In fact, the article confirmed that he could have locked the system down further, but didn't.)
By handing out shell accounts, he might as well have been handing out the root password to his system.
Re:Why keep SSH on? (Score:5, Insightful)
Re:Why keep SSH on? (Score:3, Insightful)
That excuse would work for Windows if Windows didn't ship with remote vulnerabilities built-in. Unfortunately, it does. Regularly. Without fail.
When someone can prove that OS X has the same problems (which is pretty difficult with zero open ports, and 2 degrees of separation between attachments and executable code) then I'll jump on the "OS X isn't secure" bandwagon. But for now, it remains far more secure than Windows which can be so easily e
Re:Why keep SSH on? (Score:5, Informative)
Which was also not what was compromised. Kind of nice for the GP to switch topics like that.
I want to know more details about this incident.
The machine was a Mac Mini "running a default install of OS X Tiger, plus fink and some decent versions of Apache, MySQL and PHP. Software Update recently updated it to Mac OS X 10.4.5 and fixed some security issues." It's colored orange for some odd reason, and sits on a bookshelf sideways. He, "set up an LDAP server and linked it to the Macs naming and authentication services, to let people add their own account to this machine."
This is all available on his webpage [nyud.net].
Basically, the guy is a moron. He thinks he's proving something by making a Desktop configured machine do server-class work, and then expect it not to get rooted.
Was it a local privelage escalation flaw?
Yes. The exact hole has been withheld, but it probably doesn't matter anyway. In a contest of machine vs. hacker where the owner is doing nothing to stop the hacker (and in fact, inviting him by removing barriers!), my money is on the hacker.
Was it a remote flaw in SSH or Apache? Maybe an SSH password attack?
The guy gives out [nyud.net] SSH accounts. There was no need to penetrate this layer of security, because he left the door wide open.
Re:Why keep SSH on? (Score:4, Funny)
So, to use the most disgusting analogy possible, it was like raping the goatse guy.
Heh heh, I said analogy.
Re:Why keep SSH on? (Score:3, Informative)
Is the standard desktop version of MacOS X configured for that purpose straight out of the box? No. That's why they sell MacOS X Server. OTOH, MacOS X (non-server) is properly configured for its intended purpose and does not ship with a bunch of things turned on that make the machine particularly vulnerable to outside attacks.
RDF defeats all (Score:5, Funny)
I have a feeling that the Reality Distortion Field has already cancelled whatever negative effect this has had
Re:Why keep SSH on? (Score:2)
Re:Why keep SSH on? (Score:3, Funny)
Re:Why keep SSH on? (Score:3, Funny)
And somewhere in Redmond, someone is writing him a cheque.
Re:Why keep SSH on? (Score:2)
Well, I do have shell access to the macs in my University's computer labs. Are you telling me that they're no better than Windows when it comes to privilege separation and preventing a low-privilege user account from taking control over the system? Seeing how many Macs are in multiuser University labs, this might strain the RDF a
Re:Why keep SSH on? (Score:5, Informative)
Yes and no. If your admin locks the machines down tight, then it's quite possible that the Mac servers are more secure than the Windows servers. Left with default settings, they're both highly vulnerable to anyone who already has access to the machine and is determined to find a hole. (Whether it be a buffer overflow in a priviledged service, or a soft link that gave elevated permissions.)
Systems are extremely hard to secure once untrustworthy individuals have access to them. That's why there's a market for products like Trusted Solaris and Trusted Linux. If you need high security against local users, you can't trust anyone. Not even root.
Re:Why keep SSH on? (Score:5, Insightful)
Considering that the picture of the machine posted on the web site (which now seems to be unavailable) showed it sitting on a shelf next to Windows programming books, I'm guessing that his "blind faith" is in something other than Apple, and his motiviation was to generate the misleading buzz that ZDNet and Cnet are facilitating.
Re:Why keep SSH on? (Score:4, Insightful)
Restrict the ip addresses of the computers that can access the ssh connection. Ah, you'll say, then all the attacker has to do is get access to the computer that is on the allowed ip address list. True, but let's say you are a company with the web server www.verigon.com. That's a nice public target running apache, mysql, php, etc. All the things a good lamp server should run. That's going to be the public target.
If I want to ssh in, I first have to connect to a different box. The thing here is that this ssh box (I'll just call it that to save typing) doesn't have to run anything but the os and ssh, thus lowering the number of software packages that can open a vulnerability. Remember, every daemon you run, every piece of software you install, every service that's enabled is another potential whole. The second part to this is that the ssh box is not a big target. It's dns name may be something like comp-1.it.verigon.com or ideally its name isn't even registered in dns. Either way, the bullseye is going to be on www.verigon.com for the casual cracker. Only someone who is specifically interested in my company is going to try to find a way in. The script kiddies will just see that ssh doesn't respond and go on to the next webserver.
Re:Why keep SSH on? (Score:2)
This would have made more sense if they'd installed the version of OSX which is designated as being for servers.
Re:Why keep SSH on? (Score:3, Funny)
Re:Why keep SSH on? (Score:3, Funny)
Re:Why keep SSH on? (Score:3, Insightful)
True, a Mac Mini isn't typically going to be used as a server, but if Apple decides to make some kind of Intel based server, this kind of thing is a HUGE problem.
Re:Why keep SSH on? (Score:5, Informative)
Not necessarily. The mac mini is a desktop and has a lot of software installed on it that would be deemed a security risk in production environment. Ever hear of using a complier to shell out? That is why compilers are usually left off of servers for security reasons. Your average linux/bsd desktop box with all the goodies installed probably would not have lasted much longer.
Re:Why keep SSH on? (Score:4, Insightful)
Turning off functionality because of security is not acceptable. It the OS offers certain features, they should be secure, otherwise, they are flawed. Stop apologizing for Apple computer and its defects.
Cheers,
Adolfo
Re:Why keep SSH on? (Score:3, Insightful)
It is not an open door or window like your analogy suggests. It is a door with a lock. Locks can be picked, but the solution is not to build houses without doors, but to improve and fix the locks on them.
SSH will be insecure only if it is implemented wrongly. Disabling it should not be the solution, just an ugly patch. What should be the alternative if you needed to use SSH on your system?
Cheers,
Adolfo
gwerdna? (Score:5, Interesting)
What kind of hacker do you suppose he is? gwerdna is a pretty poor anagram of Andrew G.
If that's not his name, it's fairly random.
He's been using it since the end of 2004 at least. http://p212.ezboard.com/bnendowingsmirai.showUser
Re:gwerdna? (Score:2, Informative)
gwendra [felinemenace.org]
Re:gwerdna? (Score:2)
Aaah. Memories.
Re:gwerdna? (Score:3, Interesting)
Not related at all, but the other guy that wrote Wizardry, Robert Woodhead, was Trebor.
Mac OS X Security Challenge (Score:5, Interesting)
In response to the woefully misleading ZDnet article, Mac OS X hacked under 30 minutes, I have decided to launch a Mac OS X Security Challenge.
The ZDnet article, and almost all of the coverage of it, failed to mention a very critical point: anyone who wished it was given a local account on the machine (which could be accessed via ssh). Yes, there are local privilege escalation vulnerabilities; likely some that are "unpublished". But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction.
Almost all consumer Mac OS X machines will:
- Not give any external entities access
- Not even have any ports open
The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu (128.104.16.150). The machine is a Mac Mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open. Email das@doit.wisc.edu if you feel you have met the reqiurements.
Re:Mac OS X Security Challenge (Score:2, Funny)
Re:Mac OS X Security Challenge (Score:5, Funny)
Re:Mac OS X Security Challenge (Score:5, Informative)
Dave works and is a rather high profile Mac admin at UWisc.
He should post a signature and a key (Score:4, Insightful)
http://test.doit.wisc.edu/ [wisc.edu] and sign and publish on slashdot an invitation to hack this machine to prove that he's the owner of this machine.
k2r
Re:Mac OS X Security Challenge (Score:3, Funny)
Does Slashdotting the site count ;)
gasmonsoRe:Mac OS X Security Challenge (Score:5, Insightful)
Whilst I agree that this is not the same as a remote exploit, do not underestimate the seriousness of local privilege escalation.
For instance, an unpatched local privilege escalation, used in conjuction with the vulnerability discussed in this article [slashdot.org] could result in a rooted machine - simply from visiting a hostile website (or even a website you visit regularly, that runs IIS and has been hacked itself)
I don't believe (as some pundits seem to) that Mac OS is a Microsoft style security disaster only awaiting the attention of hackers to happen - but I do believe that Mac owners are going to have to start paying a little more attention to security matters then they currently are.
Re:Mac OS X Security Challenge (Score:3, Insightful)
But a much worse issue, would be simply running as a privileged user already (no privilege escalation necessary). So no matter how many local privilege escalation holes OSX has, it's still not as bad for an end user as default installs of windows are.
Comment removed (Score:5, Informative)
Re:Mac OS X Security Challenge (Score:2)
Re:Mac OS X Security Challenge (Score:2)
Re:Mac OS X Security Challenge (Score:4, Interesting)
Re:Mac OS X Security Challenge (Score:4, Interesting)
But the original article makes it look like any Mac OS X machine out on the internet could just get "hacked", and was "easy pickings". Do you, or do you not, agree that the article should have made *some* reference, at least in passing, that people were allowed to have local accounts on the machine? I.e., a way that the vast, vast, vast majority of consumer Mac OS X machines will never be used (to say nothing that they'll probably never have any ports open, either)?
So there's a local privilege escalation vulnerability that, according to the "hacker", hasn't been reported to Apple. So if it's "unpublished", and therefore hasn't (likely) been reported to Apple, what is Apple to do about it?
The article is not fair because it doesn't tell a critical detail about the situation: that LOCAL ACCESS was allowed. If you don't think that's a *huge* omission in this context, I don't know what else to say. The majority of people who read that article will leave with the specific and distinct impression that a Mac OS X machine can be "hacked" just from being connected to the internet. That is patently untrue. I'm simply showing that.
considering (Score:2)
Re:considering (Score:3, Informative)
people set up ssh accounts on the machine and they were supposed to rm -rf the thing and no one has.
if you look on the page people can remotely add accounts to th
Lord, save us from morons (Score:4, Insightful)
Mac OS X security primarily stems from not doing anything stupid by default. Which means that there are no remote services enabled, the system tries to be intelligent about handling executable files (like most Unixes), and super-user functionality is handled by Sudo. But that's not a bullet-proof vest. There's nothing in the system that makes it automagically secure against all attacks. So if you want security, don't turn on those remote services, and don't give out SSH accounts!
Re:Lord, save us from morons (Score:3, Informative)
The guy should feel thankful that the hacker (gwerdna) was nice enough to only deface his site rather than actually "rm -rf
Re:Lord, save us from morons (Score:3, Insightful)
And, apparently, the assumption that you trust all of your local users. So what if most people use Macs for desktops? Plenty of people use them for servers as well, and apparently OS X isn't secure by default for them.
Even in the desktop case alone, you can't seriously consider denying local access to be enough as far as security is concerned. Decent security has multiple levels, and this is a case where one of those lev
Re:Lord, save us from morons (Score:5, Insightful)
This configuration absolutely sucks for a home user.
A home user can't install new software without providing a root (or sudo) password everytime they want to try a software package, they can't update the system configuration from the GUI, they can't start and stop their personal webserver, they can't look at the drive space remaining without having to decode a complex partitioning scheme, they can't do a lot of things that Mac OS X lets them do without interfereing. If Mac OS X *did* restrict these activities, users would balk at the user-unfriendliness and go back to Windows.
So it comes back to a matter of design. It's easy to say, "that should have been secure!", but the costs of making that secure would have been too high for the average home user. Mac OS X's security has been proven to date to be sufficient for what it was designed to do, and has been shown to be at least as secure (perhaps moreso) than your average FreeBSD or Linux desktop. Show me the beef of the problem (i.e. everyday machines being compromised on a scale similar to Windows) and I'll agree with you that Mac OS X is insecure for its intended purpose. Until then, however, I'm going to go with the fact that this guy wasn't thinking straight.
Plenty of people use them for servers as well
Which is why Apple produces OS X Sever Edition.
and apparently OS X isn't secure by default for them.
You show me a server situation that involves hundreds of anonymous, remote logins to a system without any lockdown of the services to move it from a home server to a full-blown webserver, and I'll agree with you. I, personally, can't think of such a situation. Some webhosts provide SSH access, but they certainly don't run a default Linux or FreeBSD installation unless that distribution has been preconfigured for the security they need.
Local access IS important! (Score:5, Insightful)
Re:Local access IS important! (Score:3, Insightful)
I would like to know the guy's methods also, but apparently he's not revealing how he accomplished the escalation (although he does make some rather ridiculous-seeming claims that it would still work against a locked-down machine, which implies remote root-ability).
I agree that local priv escalation exploits are a problem, but they're a different sort
Re:Lord, save us from morons (Score:2)
If I bought OSX, I'd do it so that I could have a server, and maybe give things out to other people. If all it takes is one remote exploit (such as, for instance, giving out ssh accounts) to allow any manner of local exploit, then its not secure! Se
Re:Lord, save us from morons (Score:2)
Funny. Sourceforge gives out SSH accounts to anyone and their dog.
The whole *point* of unix permissions is to allow local users a shell account without worrying about your webtree etc.
OSX is not fit to be a server.. that's about the long and short of it.
Re:Lord, save us from morons (Score:5, Informative)
Indeed. And every once in a while, Sourceforge gets hacked [sourceforge.net]. And they have a trained staff of admins who attempt to very carefully lock down the systems and separate the user logins from the systems that run web services and code repositories. (Which is why you can't blow away your own code tree. You have to ask SF to do it.)
The only thing that's funny here (which isn't even funny) is that an inexperienced admin made his box 100% public without taking the standard precautions that every admin worth his salt would take. He blindly trusted that his Mac would be configured to do something it wasn't designed for, and he got burned. Well, DUH. I had a friend who's RedHat Linux box was remotely rooted several times without the attacker being given a shell account. Does that mean that Linux sucks at security?
Security in small numbers (Score:2, Interesting)
Since "hacking" and all the other activities that end in "-ing" and often start with a "ph" are no longer fun pastimes for geeks but actually became a hunting ground for very money oriented very well organized criminal organisations, security is in small numbers: An attack has to hit as many targets as possible. Maximize your output. And, well, if there are potentially 100 Linux b
Re:Security in small numbers (Score:2)
Re:Security in small numbers (Score:2)
Or if you have information that someone else wants. Or you've made enemies with someone who wants to cause you harm. Or if your system has common vulnerabilities that might be exploited by bots, viruses, or worms. Or...
Re:Security in small numbers (Score:2)
Confused About Their Motives (Score:3, Insightful)
And who gains from this publicity? It would seem like sponsoring a hacking competition that took MORE than 30 minutes (seemingly the goal of such an event) would be good for Apple, but then why leave the system more vulnerable at the start of the contest? And if it was really sponsored by an anti-Apple group posing as an pro-Apple group, why have the hacker claim that Macs are essentially "small pickin's"?
It just doesn't make sense...
If you want a secure computer... (Score:2, Interesting)
The only trend to security is that there isn't any financial motivation to hack small-potatoes.
Re:If you want a secure computer... (Score:2)
you don't understand why the Mac got hacked. even disconnecting the internet does not help if you're giving people accounts on your machine, it just means only people in the same room as you can take part in the competition instead of anyone else on the internet.
if you want a secure computer without learning how to be a linux admin, then just buy a Mac and don't go out of your way to have it hacked.
local account = assumed root access (Score:5, Interesting)
It like giving physical access to a machine. If you give physical access to any linux machine, its not hard to log onto it. (this is why you lock up the machines!)
local SSH is probably more common than we think (Score:2)
Didn't we just have a discussion over how people leave their wireless AP open for anyone to use? I don't think the SSH agent is on by default, and I think that the firewall blocks it by default, but that doesn't mean this is always the case. Given the reality of modern setups, where cable modems and wireless gives untrusted parties direct acess to the
Re:local SSH is probably more common than we think (Score:2)
It would be like asking the Pentagon for a username on their server, because hey, it isn't root, you can't do any damage. No admin in their right mind would do it.
Stock Mac OS has never once had remote exploit! (Score:2, Informative)
Despite many high profile web sites and servers using OS9 for many years, not one database entry in the large BugTraq database documents a remote exploit for standard Mac OS in the history of the internet, even whith a common web server running on it.
Even the US Army used macs exclu
Re:Stock Mac OS has never once had remote exploit! (Score:3, Insightful)
You're describing an OS that hasn't been sold in 4-5 years, will not run on any currently-produced hardware, and because it is closed-source and nonstandard, cannot be easily used with the vast majority of modern server applications, languages, and tools being used these days.
I have faithfully used the mac for 15 years and I agree there were some strong security benefits to the classic OS. At the same time, when I am working as an admin and/or developer these days I want recent versions of MySQL and PH
RTFM guys... (Score:2, Informative)
Here's a salient quote:
"The rm-my-mac challenge was setup similar to how you would have a Mac acting as a server -- with various remote services running and local access to users... There are various Mac OS X hardening guides out there that could have been used to harden the machine, however, it wouldn't have stopped the vulnerability I used to gain access.
"There are only limited
Re:RTFM guys... (Score:3, Insightful)
Wrong. He was using OS X, not OS X Server. Running a little website behind a firewall is probably safe with OS X. Handing out shell accounts on a desktop os?
From his site: It runs a default install of Mac OS X Tiger, plus fink and some decent versions of Apache, MySQL and PHP. Software Update recently updated it to Mac OS X 10.4.5 and fixed some security issues.
Default install of Mac OS X Tiger.
Apple has a serv
Doors unlocked, windows open (Score:5, Funny)
So SSH was on and accessible? Dumb move. Like saying "I dare you to steal my jewelry from my bedroom -- oh, and my house is unlocked with the windows open."
But maybe people WANT something to be stolen. Many years ago, the garbagemen (sanitation workers) in NYC went on strike, and garbage was piling up in the streets. A relative of mine in Brooklyn still managed to get rid of his: he put it in big boxes, wrapped the boxes in gift paper with bows, and left them in his car with the doors unlocked. They always got stolen.
How this applies to the story, I dunno, but I still think it's funny.
Re:Doors unlocked, windows open (Score:4, Insightful)
My ISP, Panix, will gladly sell you a shell account. You can SSH into it, or telnet, if you don't care. And yet, they're not rooted every 30 minutes. Or, ever.
If giving someone SSH access is 30 minutes away from giving them root, that's not secure.
Re:Doors unlocked, windows open (Score:4, Insightful)
There have been SELinux security competitions that gave out SSH access as root and the boxes remained quite safe. There do exist standards of security which make your standards look remarkable poor and forgiving. Good security does exist, and pretending that it doesn't does not make you any more secure.
Jediiah.
andrewg = gwerdna (Score:3, Informative)
Grammar facism (Score:3, Insightful)
Start your biased counters now... (Score:2, Insightful)
What to have some fun? Count how many post show up that try to make excuses
for the Mac. Man, if this were a windows box, I assure you that 99% of the
the post would be slamming MS w/o a second thought.
Although people want to point out that they shouldn't have allowed people to
have a SSH connection, you need to keep in mind that an SSH connection was
allowed because they thought the config was secure enough to handle it.
I do give them kodos for allowing the hack contest to take place. The best
way t
Kodos is not yours to give... (Score:5, Funny)
Kang [wanadoo.fr] might have something to say about that.
This was of very little worth (Score:2, Funny)
This "test" was silly and unrealistic, at best.
Here's a "real" test:
1) Turn on brand new Mac Mini
2) Update to latest rev of OS
3) Try to hack it from the Internet, without knowing its IP address.
Good frackin' luck!
Why so many apologists? (Score:2, Insightful)
I'm disturbed by the attitude that anything but a remote exploit against an ideally (not typically or justifiably) configured box is meaningless or misleading.
What good is a door if it's welded shut? Wouldn't a proper lock be more useful?
Security should be about maximizing functionality securely, not limiting it.
Re:Why so many apologists? (Score:4, Informative)
What good is a door if it's welded shut? Wouldn't a proper lock be more useful? Security should be about maximizing functionality securely, not limiting it.
Ideally, any user should be restricted to the behaviors intended by the administrator and there should be no local privilege escalations. Realistically, however, this does not really happen except in a few special cases of extremely security oriented OS's. The first line of defense is how many services you have, think of them as gates in a castle. The second is the firewall, how many gates are open for business. The third is the username/password, do the guards know you and will they let you in. These guard against most threats except for someone who can impersonate someone else or insider threats who have access but want more access. In this case the "hackers" was given legitimate access to come in through the open gate. (A gate the admin specifically had to open and using the username and password the admin gave them.)
Once inside there is still security, but it is much, much less. On the average Windows machine at this point there is no security at all and even on a well secured Windows machine there are thousands of unpatched privilege escalation exploits. At this point on either a Mac OS X desktop or the average Linux machine a knowledgeable security person will be able to gain admin access. That is a sad fact, but it is the case for the vast majority of systems. Exceptions might be a locked down OpenBSD box running jails, an SELinux box, or some other specialized ultra-secure OS running virtual machines. Very few people run those machines as desktops and those that due generally don't have the best experience because they sacrifice a lot of usability to gain that level of security.
This "test" was no surprise to anyone with a clue. That is exactly what would be expected to happen. Also, some of the better security guys out there can definitely gain remote access to machines using unpublished vulnerabilities. If they really want in they will get into the average OS X or Linux box. So what are we talking about here? Well obviously this is still much better than Windows, but not impregnable. What it does is make you pretty safe from automated worms and your average script kiddie, which far outnumber the knowledgeable crackers out there.
Ideally, all desktop OS's would be locked down more tightly. They would do more security auditing and they would implement ACLs, VMs, or jails for all remote access and all applications. Some day perhaps they will. But for right now it is not a big concern, simply because market does not call for it. Not many people really have data that needs to be kept secure against experts and those that do have specialized OS's to use. Of course they can't run photoshop or World of Warcraft and the users would not trust their internet connection to talk to WoW servers anyway using all closed source. That is a task better allocated to a regular desktop, not a locked down, ultra-secure server. And that is what this "test" has shown. OS X is a desktop and if you bypass all the primary security on it, it will not stand up to a cracker from the inside like OpenBSD might. Of course anyone who really cares already knew that.
No need to turn off ssh. (Score:3, Insightful)
Astroturfing? (Score:5, Interesting)
The whole article seemed to culminate in the following information: some guy said if Macs were more popular they would have a worse record than "other operating systems." It seems to be comparing OS X to Linux, but it isn't entirely clear what the baseline is for their eval of Mac OS.X and it also doesn't clarify what exactly makes these OSs different. Also, the web site defacement isn't proof that the person with an unprivileged account acquired superuser privileges to do anything other than deface the web page. I don't doubt it could have happened, but maybe it did and maybe it didn't...
Also, giving people LDAP accounts on the machine is really cheating. Maybe some noobs get a boner when someone fuzzes the hell out of a box from a local account until they get some fuzz escalated **BORING**. If they really wanted to throw down the gauntlet, then we would see Mandatory Access Control [freebsd.org] implemented on OS X . The big difference is that the MAC policies would be enforceable at the Mach [stepwise.com] MK level (on Mach ports, tasks, processes...), and OS X would be the ONLY OS with a security policy interface that could come close to usable for average people.
multi-platform hack (Score:3, Interesting)
How long would this contest lasted on Windows? (Score:3, Informative)
If you need to give potentially hostile users shell, you want them in a FreeBSD jail at a minimum.
I challenge you to hack me! (Score:2, Funny)
Re:I challenge you to hack me! (Score:2)
Re:The only way.. (Score:2, Insightful)
You forgot to lock the door and remove the keyboard, mouse and monitor.
Re:The only way.. (Score:2)
Re:Mac user ignorance (Score:3, Insightful)
Oh, wait, 99.9% of Mac users are blissfully ignorant of what security defaults to change to make their system more hacker-friendly.