OSNews

It's worth remembering that when it came to attacks based directly at the platform rather than applications running on it, there were no contenders which bodes well for the default security posture of all three platforms.

Was this a case of OSX really going down, or was it related entirely to the flaw in Safari that opened the system to remote access?

I think it's an important distinction because this is the direction the blackhats are moving in. The days of open ports in Windows are over, even Microsoft has taken to a more responsible security design. Linux and OSX already had a natural advantage in this area. So attacks will no longer be against the platform, necessarily, but more against the applications running on top of them. Browsers, plugins, media players etc. will all be the focus of blackhat activity, and that is disconcerting because it means that vulnerabilities in an application on one platform could be easily transferable to other platforms. A flaw in firefox is often a flaw in firefox Win/OSX/*nix. The flaw in Safari that broke OSX could easily apply to the Windows version as well, hard to know without disclosure yet.

It's good that we have a choice of secure platforms to use, but now there is the whole issue of needing ISV's to take the same security approach that the OS vendors have often been forced to take, otherwise it will all be for naught. The platform can certainly help minimize the damage a rogue app exploit can occur in a cross-platform app, but it's still an issue that will need to be addressed.

As much as I'm tempted to giggle at bit at the fact that OSX was the first to go down, I don't think it's Apple the OSX vendor that should be blushing. It's Apple the software company that should be concerned, but that could just as easily have been Adobe or someone else. In fact, I was kind of expecting it to be Adobe with all of the flash issues they've had lately.

Anyways, will be interesting to watch and see what happens over the rest of the contest.

From the Register:

"Charlie Miller, who was the first security researcher to remotely exploit the iPhone, felled the Mac by tapping a security bug in Safari. The exploit involved getting an end user to click on a link, which opened up a port that he was then able to telnet into. Once connected, he was able to remotely run code of his choosing. "

http://www.channelregister.co.uk/2008/03/28/mac_hack/

Latest update, from the third day:

"2:30pm PST Update: Its been two hours so far, and both Vista and Ubuntu laptops are still standing. Stay tuned..."

Check for more updates here:

http://dvlabs.tippingpoint.com/blog/2008/03/28/pwn-to-own-final-day...

Yeah, I agree, and this is a worse threat, in my opinion, because few applications have the scrutiny that the OSes have.

I don't know, when webkit is considered to be a core api, it needs to be treated as such. same with ie on windows. or with khtml on kde.

Firefox is just another app as far as the os is concerned.

Standing strong? Nobody TRIED to hack them.

You'll see that they were, on each day they relax the rules if they can't hack them. It's kind of like trying to shoot a target at shorter and short range.

Yup, OSX sucks hard!

Let's see how quickly I get modded down for this

Well - according to the site the next one was Vista. They used a 0day exploit in adobe flash and cracked Vista.

Ubuntu was the surviver of the contest as far as I understood.

Seems Linux still is the most safe OS - at least in this contest. Too bad they did not included the BSD flavors and things like Solaris, but I am very pleased with this outcome...

No...they knew of vulnerabilities in Linux. Nobody wanted to go through the effort to do it.

The glitzy got hacked first.