Linked by Thom Holwerda on Fri 28th Mar 2008 20:39 UTC, submitted by irbis
"An Apple Mac was the first victim in a hacker shoot-out to determine which operating system is the most secure. A former US National Security Agency employee has trousered USD 10000 for breaking into a MacBook Air at CanSecWest security conference's PWN 2 OWN hacking contest. The MacBook was lined up against Linux and Vista PCs - which have so far remained uncracked. Nobody was able to hack into the systems on the first day of the contest when contestants were only allowed to attack the computers over the network, but yesterday the rules were relaxed so that attackers could direct contest organisers using the computers to do things like visit websites or open email messages. The MacBook was the only system to be hacked by Thursday. Miller didn't need much time. He quickly directed the contest's organisers to visit a website that contained his exploit code, which then allowed him to seize control of the computer, as about 20 onlookers cheered him on. He was the first contestant to attempt an attack on any of the systems." There is more bad news for Apple: "If you have Apple and compare it to Microsoft, the number of unpatched vulnerabilities are higher at Apple." Update: The contest is over. Vista got hacked using Adobe's Flash, Ubuntu was left standing.
Thread beginning with comment 307101
To read all comments associated with this story, please click here.
To read all comments associated with this story, please click here.
Member since:2005-07-06
I've got to be honest, I'm surprised and *very* impressed that both Vista lasted this long, and that the eventual downfall of the Vista machine was caused by non-MS code.
Why are you surprised? I do not use Vista and am not particularly impressed with what I have seen of it but it has had a decent security record. Not outstanding, but quite decent, especially for Microsoft.
I'm even more impressed that Ubuntu (which doesn't run a firewall by default, and doesn't use SELinux) is still going.
Again why?
1) Ubuntu has no services listening on an external address by default. This somewhat limits the utility or need for a firewall.
2) SELinux is not a miracle cure acting as the only line of defense on a Linux system. Properly configured SELinux makes a system more secure, no argument there. But if all applications running on the system are patched and do not have known buffer overrun or privilege escalation vulnerabilities then a system without SELinux can still be quite secure. The dire security need for SELinux is predicated on there being exploitable vulnerabilities on a system and an attempt to be made to use the exploit.
The trend I have been seeing on SELinux going from being seen as a tool to increase security to people arguing that a system is not secure without it is bothersome. The absence of SElinux does not make a system inherently vulnerable to attack. SELinux makes a system which has an exploit in need of being patched less likely to be compromised. The key here is the application with the exploit should be patched in any case.
Member since:2005-07-24
The trend I have been seeing on SELinux going from being seen as a tool to increase security to people arguing that a system is not secure without it is bothersome.
Hear! Hear!
I would have further described it as "damned irritating", as well. But you really hit the nail on the head, there.
Member since:2006-01-23
News
Linked by Thom Holwerda on 05/21/13 15:53 UTC
The new WebKit Opera for Android has been released. "Opera 14 for Android is built on top of Chromium 26, with a total overhaul of the UI in native code, making it fit well with the latest Android design guidelines. Go get the build from Google Play or point your browser to m.opera.com, and give it a spin!"
Linked by Thom Holwerda on 05/20/13 22:43 UTC
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.
Linked by Thom Holwerda on 05/20/13 21:50 UTC
PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
Linked by Thom Holwerda on 05/19/13 23:15 UTC
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
Linked by Thom Holwerda on 05/19/13 23:11 UTC, submitted by Drumhellar
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
Linked by Thom Holwerda on 05/18/13 21:06 UTC
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
Linked by Thom Holwerda on 05/18/13 7:37 UTC
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Linked by fran on 05/18/13 1:38 UTC
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Linked by Thom Holwerda on 05/17/13 23:35 UTC, submitted by kragil
Ars nails it: "The answer is that Google did announce what amounts to a fairly substantial Android update yesterday. They simply did it without adding to the update fragmentation problems that continue to plague the platform. By focusing on these changes and not the apparently-waiting-in-the-wings update to the core software, Google is showing us one of the ways in which it's trying to fix the update problem."
Linked by MOS6510 on 05/17/13 22:22 UTC
"It is good for programmers to understand what goes on inside a processor. The CPU is at the heart of our career. What goes on inside the CPU? How long does it take for one instruction to run? What does it mean when a new CPU has a 12-stage pipeline, or 18-stage pipeline, or even a 'deep' 31-stage pipeline? Programs generally treat the CPU as a black box. Instructions go into the box in order, instructions come out of the box in order, and some processing magic happens inside. As a programmer, it is useful to learn what happens inside the box. This is especially true if you will be working on tasks like program optimization. If you don't know what is going on inside the CPU, how can you optimize for it? This article is about what goes on inside the x86 processor's deep pipeline."More News »
Sponsored Links
Member since:
2006-02-01
According to
http://dvlabs.tippingpoint.com/blog/2008/03/28/pwn-to-own-final-day...
the Vista laptop was eventually hacked after the Adobe Flash plugin was installed.
I've got to be honest, I'm surprised and *very* impressed that both Vista lasted this long, and that the eventual downfall of the Vista machine was caused by non-MS code. I'm even more impressed that Ubuntu (which doesn't run a firewall by default, and doesn't use SELinux) is still going.
Combine taht with the embarrassing result for Apple and the whole thing is really eye-opening.