OSX the first to go down in flames, Vista and Linux standing strong thats just funny with all of OSX's flogging that its so safe and secure.

Fedora or RHEL would have been better contenders because they have more security defense mechanisms by default.

From the Register:

"Charlie Miller, who was the first security researcher to remotely exploit the iPhone, felled the Mac by tapping a security bug in Safari. The exploit involved getting an end user to click on a link, which opened up a port that he was then able to telnet into. Once connected, he was able to remotely run code of his choosing. "

http://www.channelregister.co.uk/2008/03/28/mac_hack/

Do I understand this correctly? An interaction of the user has been required to achieve the goal of hacking?

Also from the description above: "Nobody was able to hack into the systems on the first day of the contest when contestants were only allowed to attack the computers over the network, but yesterday the rules were relaxed so that attackers could direct contest organisers using the computers to do things like visit websites or open email messages."

Is this still hacking? Relying on user interaction can help you to compromize any system.

I always thought this is nothing spectacular because nearly anyone can do such "easy" stuff (faked maintenance websites, faked system alerts etc.). The same techniques could have been used to hack into the Linux and "Vista" boxes as well, just if the user replies to a mail like "Dear Bob, please send me your root password back. thanks!" :-)

Why don't you face reality , there is no common distribution. Your comment amount to another person saying that Toyota are the only cars because they are the most common on is street where they live and the most shown on there TV channels ...

Do you even hear yourself? OS X is BSD, as opposed to Linux. And it's not even OS X that has a problem, it's Safari.

Nobody has said the Mac is invulnerable.

So attacks will no longer be against the platform, necessarily, but more against the applications running on top of them. Browsers, plugins, media players etc. will all be the focus of blackhat activity, and that is disconcerting because it means that vulnerabilities in an application on one platform could be easily transferable to other platforms. A flaw in firefox is often a flaw in firefox Win/OSX/*nix. The flaw in Safari that broke OSX could easily apply to the Windows version as well, hard to know without disclosure yet.

The guy who won this obviously went along to the contest with the knowledge already in hand, which once again raises the argument about these people just wanting their 5 minutes of fame. Maybe Mummy and Daddy didn't pay him enough attention when he was little? Who knows?

To claim a laptop as your own, you will need to read the contents of a designated file on each system through exploitation of a 0day code execution vulnerability (ie: no directory traversal style bugs).

The responsible thing to do with any such knowledge would be to inform the company in question. It seems though that these guys are really only interested in the kudos and making money from it. In some fields it would border on extortion - but when its software they get publicized and win rewards. Go figure.

[...] once the vendor patches the issue. Until then, the actual vulnerability will be kept quiet from the public. This is a required condition of entry into the contest; all entrants must agree to the responsible disclosure handling of their vulnerability/exploit through the ZDI.
[...]
Any vulnerability that the Zero Day Initiative awards a cash prize for, becomes the property of the ZDI, and therefore the winner can not discuss or disclose details of the 0day until the affected vendor has successfully patched the issue. Any discussion of the bug prior to the public disclosure of a ZDI advisory will result in forfeiting of the prize. TippingPoint is collaborating with the vendors to ensure that their response teams will be ready and waiting to receive any and all 0day that comes out of this contest.

I rarely use safari on my mac. I use firefox because I don't like the way safari automatically mounts all of your downloaded content which i think is a huge security risk.

Oh really, so tell me how to you call then what happened to Graduate School of Arts and Sciences last month?

http://www.devicepedia.com/security/harvard-site-hacked-and-then-le.....

Their web site got just hacked and student data were stolen and then exposed to Bittorrent. And guess which system they are running? Oh, oh.... So please don't come up with nonsense.

I mean, come on, who here can believe that he came just like that and pull out an exploit magically. He prepared that exploit well before, he knew about it, and he was just waiting the moment that they relax the exploit methods to show up. No way that i can believe that he was not targeting the mac well before the context begins.

And no way that i can believe that the same thing could not gave been done for linux or windows. I mean there are a lot of researchers looking for exploits in Linux and associated softwares, so i can't believe that no one could not use one exploit and make it work if he/she would really wants it. The point is that the mac was the primarily target during this context, that's a matter of fact. Lets face it, that sounds well more sexy to say that the mac was hacked than to say it for linux or windows.

This context does not prove anything, he just shows that security researchers make their job and that they got more exited when hacking the mac.

Or you can stop trying to find excuses and just accept that OS X + Safari was just easier to crack than Vista + IE7 or Ubuntu + Firefox.

But at the end of the day, if the user is stupid, and doesn't exact some sort of logical thinking while using a PC

I don't agree. Just have a look at the release notes of the upcoming 8.04 release:

It's simply not true that Ubuntu doesn't have a firewall enabled by default, it's called IPtables.

The exploit involved getting an end user to click on a link, which opened up a port that he was then able to telnet into. Once connected, he was able to remotely run code of his choosing. "

I've got to be honest, I'm surprised and *very* impressed that both Vista lasted this long, and that the eventual downfall of the Vista machine was caused by non-MS code.

I'm even more impressed that Ubuntu (which doesn't run a firewall by default, and doesn't use SELinux) is still going.

"Why don't you face reality , there is no common distribution. Your comment amount to another person saying that Toyota are the only cars because they are the most common on is street where they live and the most shown on there TV channels ...

The trend I have been seeing on SELinux going from being seen as a tool to increase security to people arguing that a system is not secure without it is bothersome.

You can't patch a user..

Well, to be honest Mollinneuf was somewhat correct when pointing out that the EeePC has been very successful and probably is about to turn Xandros THE layman Linux distro.

... between the Windows and Linux ? Lack of "mainstream" games and ability to run MS Office 2007 on the latter ?

If that is true, the following observations come to mind:

1) telnet itself is obsolete because of security reasons, and sshd should be off by default in desktop systems (and regular user should not be able to turn it on).

2)Only root should be able to open a port.

3) Even if arbitrary code is executed as regular user, it shouldn't be able to get root account, except, maybe , by privilege escalation.

Privilege escalation is an issue in Linux as well (as discussed in the "fakesudo" thread in Ubuntu forums),

but I think the risk can be avoided if you never su or sudo from your regular user account. Instead, create a new user from whom you su or sudo, and run a lightweight DE with this user in another tty, just to run synaptic and things like that. I'm assuming a user program can run a fake kde session fullscreen, but it can't capture CTRL+ALT+f8. I have to check that one, though.

So, even if it was a vulnerability in Safari, it was the OS fault if this led to a remote root login without the user entering its password. Not to mention that Safari is an Apple program, installed by default in OS-X, so there are no palliatives.

"Well, to be honest Mollinneuf was somewhat correct when pointing out that the EeePC has been very successful and probably is about to turn Xandros THE layman Linux distro.

That wasn't the original poster's point. The guy who broke safari knew about the exploit before the contest but had not informed Apple but waited till the contest.

Uh... you are aware that if an Linux distro were so ill advised as to do this it would break many things? The idea is only root should be able to open privileged ports.

" Privilege escalation is an issue in Linux as well (as discussed in the "fakesudo" thread in Ubuntu forums),

It in theory will stop some privilege escalation attacks, but not all. In general setting up your system like that would be too inconvenient for most normal users (especially of OS X).

Where is it implied that they are vulnerable? I really would like to see where this is stated.

That said, people are still safer with Mac than with Windows. Because the fact of the matter is that, for whatever reason (it doesn't matter), Windows users are the ones under siege.