Posted: 4/10/2010 10:11:53 AM EDT
|
he Mac Hacker Strikes Again
Andy Greenberg, 04.12.10 Charlie A. Miller loves his Macbook Pro laptop. And his four other Apple PCs, the iPhone he uses daily and two older iPhones he keeps for tinkering. But his relationship with the company that created those gadgets is somewhat more complicated. In March, for instance, the 36-year-old security researcher publicized his discovery of 20 security vulnerabilities in Apple's software. Each would allow a cybercriminal to take over the computer of a user who's tricked into opening a certain PDF attachment or who simply visits an infected Web page using Apple's Safari browser. That haul of bugs is a record even for Miller, who over the last four years has become perhaps the world's most prominent Mac hacker. It may also be definitive proof that Apple devices aren't safe "right out of the box," as the company has claimed for years. "When I first began saying that Macs were less secure than Windows, everyone thought I was an idiot," says Miller. "So I had to prove it again and again and again." In 2007 Miller became the first to hack the iPhone, using a flaw in its Safari browser to remotely gain control of the not-so-smart phone. Six months later he hacked a Macbook Air in two minutes at a competition in Vancouver. Last summer he revealed a method that allowed him to virally hijack the iPhone using text messages spread via a user's contact list. Miller says his latest research doesn't aim to show off his elite hacking skills, most of which he learned over five years as a global network exploitation analyst for the National Security Agency. Instead, he wants to show just how easy it is to find chinks in the armor of commonly used software. Miller used a technique known as "dumb fuzzing" to find flaws in PDF and PowerPoint programs. With a simple five-line algorithm, he repeatedly changed one bit of a file at random and checked to see if the file crashed an application, automatically tweaking and testing again and again. He ran the procedure more persistently than most hackers, leaving his fuzzing program to throw junk information at each target for three weeks before mining the data for exploitable flaws. The results don't look good for Apple: 20 bugs in its Preview application––all of which apply to Safari as well––compared with only 3 or 4 each in Adobe Reader and Microsoft's PowerPoint. "It's shocking that Apple didn't do this first," says Miller. "The only skill I've used here is patience." Apple didn't respond to requests for comment. The company's defenders have long insisted that even if their devices are less secure, they're still safer than other PCs. The reasoning: Cybercriminals don't bother to target Macs because their 8% U.S. market share is too low to make them profitable targets. Still, Macs are being hacked. The risk of targeted cyberespionage attacks aimed at stealing patents, source code or other highly specific data means that market share is only part of the equation. Adriel Desautels, the chief executive of cybersecurity firm Snosoft, buys and sells software-vulnerability data in a growing gray market and says the demand for critical Apple bugs has steadily increased. He's now willing to spend anywhere from $15,000 to $115,000 on information about the right Mac security flaw. Desautels declines to reveal much about his customers but says he screens them to avoid selling vulnerability data to cybercriminals. "In some cases [our buyers] explicitly ask for certain kinds of Mac bugs." Miller has sold bugs, too. In 2005, after he left the NSA, he pawned a Linux vulnerability to a government agency for $50,000. "It's safe to say that when someone pays that much for a bug, they're not going to tell the vendor to patch it," he says. In recent years he has stuck with pro bono public research, which he argues makes software more secure. For all the latest headlines visit Forbes Asia Miller joined a Baltimore company called Independent Security Evaluators in 2007, and his contract hasn't allowed him to sell bugs independently. The 12-person company pulls in $2.5 million a year testing the security of custom-made software. So Miller says his focus has shifted to hacking whatever he likes to use and "whatever gets people ticked off." As for Apple, Miller says the company has learned to accept, if not appreciate, his work. He usually gives Apple weeks of notice before publicly describing its bugs. "They're always very polite," he says. "But I suspect they wish I didn't exist." |
|
Quoted:
to the rest of the world: welcome to the obvious. When your greatest security protection comes from the fact that your product is obscure............that is a poor bet in the computer world. this When they had those obnoxious Justin Long Mac Vs PC ads about how little viruses there are for Macs, to bad they failed to mention thats only because there are so few on the market. Therefore it wasn't as worth it for someone to make a virus for it. As Macs become more prominent on the market there will be more and more viruses made for them. |
|
Quoted:
to the rest of the world: welcome to the obvious. When your greatest security protection comes from the fact that your product is obscure............that is a poor bet in the computer world. +1 What is more likely to be hacked? Pentagon database, or a coffee shop? 
|
|
Quoted:
to the rest of the world: welcome to the obvious. When your greatest security protection comes from the fact that your product is obscure............that is a poor bet in the computer world. Always makes me think of that Family Guy episode where Peter is walking along with the soldiers while dressed in a clown costume: "you guys are stupid, they're gonna be looking for army guys." |
|
I said this in the last thread of this nature. Security is a USER mindset. I've ran Windows without anti-virus and spyware filters for over 6 years now, and guess what? No viruses or spyware. If I'm not getting a bug on a windows machine, I'm pretty confident it will not happen to my mac. |
|
Apple didn't respond to requests for comment. The company's defenders have long insisted that even if their devices are less secure, they're still safer than other PCs. The reasoning: Cybercriminals don't bother to target Macs because their 8% U.S. market share is too low to make them profitable targets. Amazing that I can still get mileage out of this cartoon. 
|
|
Quoted: So all those times that Apple claimed OS X never had a security flaw were lies? Unless my sarcasm detector is broken, I don't recall Apple ever claiming that OSX (or apps that run on OSX) never had a security flaw. It's the users who (often) claim this, not the company itself. |
|
Quoted: to the rest of the world: welcome to the obvious. When your greatest security protection comes from the fact that your product is obscure............that is a poor bet in the computer world. yep. I am patiently waiting for mac to build a decent sized market share and teh hakers start hitting OSX like they do windows. I don't really prefer one or the other except that as a music producer most audio vst writers use pc format (ironic considering mac tries to market themselves as superior in that field) but i can't tell you how big of a smile I will have thinking about all those mac users that try and talk shit because I prefer a PC start getting hit. |
|
The primary security flaw with a MAC is the exact same security flaw that exists with a PC. STUPID USERS period end of story. Until the dumb ass behind the keyboard stops making stupid choices. There will be no hardware or software solutions that will keep your information safe.
|
|
Quoted:
Quoted:
So all those times that Apple claimed OS X never had a security flaw were lies? Unless my sarcasm detector is broken, I don't recall Apple ever claiming that OSX (or apps that run on OSX) never had a security flaw. It's the users who (often) claim this, not the company itself. Your sarcasm meter is functioning.
|
|
Quoted:
Quoted:
to the rest of the world: welcome to the obvious. When your greatest security protection comes from the fact that your product is obscure............that is a poor bet in the computer world. yep. I am patiently waiting for mac to build a decent sized market share and teh hakers start hitting OSX like they do windows. I don't really prefer one or the other except that as a music producer most audio vst writers use pc format (ironic considering mac tries to market themselves as superior in that field) but i can't tell you how big of a smile I will have thinking about all those mac users that try and talk shit because I prefer a PC start getting hit. People used to say the same thing about linux before it became the dominant web server platform. Linux has flaws like anything else, but there isn't the constant buffet of holes like there is with Windows. Market share doesn't create or negate vulnerabilities. Microsoft's problem with Windows is design. They've known all along how to fix this, and they are gradually fixing it as the market allows. The biggest strength of their platform is the huge amount of software available for it, and they're not going to abandon that for security. Their users don't want to abandon it for security. No one wants to buy all new software just so they don't have to run antivirus. Give it another 10 years or so and spyware and viruses on Windows will be just like other platforms, so rare that it might as well not exist. |
|
Quoted: Miller has sold bugs, too. In 2005, after he left the NSA, he pawned a Linux vulnerability to a government agency for $50,000. "It's safe to say that when someone pays that much for a bug, they're not going to tell the vendor to patch it," he says. In recent years he has stuck with pro bono public research, which he argues makes software more secure. So some government agency has a backdoor exploit to some linux vulnerability? I wonder if that means they can compromise any of these systems when they want, without the user being aware. |