Hacker Gains Root Access to Mac OS X in 30 Minutes

**Untitled @ CE** · 03-06-2006, 09:52 PM

It took a hacker less than 30 minutes to gain root-level access to Mac
OS X, according to a report from ZDNet. The hacker who penetrated the system called the Mac "easy pickings."

The security breach took place on February 22 after a Swedish devotee of the Mac set up a Mac Mini as a server and invited all takers to try to compromise the system's security to gain root-level control. Once a hacker has gained root access to a computer system, the attacker can install applications, delete files and folders, and use the computer for any nefarious purpose.

The competition was over in a matter of hours after a hacker, who asked to be identified only as "Gwerdna," gained access to the server in question and defaced the Web site with a message that read, "This sucks. Six hours later this poor little Mac was owned and this page got defaced."

Gwerdna told ZDNet that it took him a mere 30 minutes or less to gain root control of the Mac. "It probably took about 20 or 30 minutes to get root on the box," Gwerdna said. "Initially, I tried looking around the box for certain misconfigurations and other obvious things but then I decided to use some unpublished exploits -- of which there are a lot for the Mac OS X."

Taking Aim at Macs

Although Gwerdna said that the Mac Mini could have been protected more effectively, he also said that, even had the machine been configured for better security, it would not have stopped him because the vulnerability he exploited has yet to be published and Apple has not released a patch for it.

The winner of the hacking contest went on to say that there is a limitation on what hackers can do with unknown and unpublished vulnerabilities because there are countermeasures that systems administrators can employ to tighten security -- even for unpublished software flaws.

Although Gwerdna said that Mac OS X contains unpatched vulnerabilities that would permit a hacker to infiltrate Apple's operating system, he said that the relatively small number of Macs in use -- in contrast to the vast number of PCs running Windows -- is the reason more hackers do not try to exploit them.

"Mac OS X is easy pickings for bug finders," he told ZDNet. "That said, it doesn't have the market share to really interest most serious bug finders."

Flawed Apples

News of this contest comes on the heels of Macs being hit by two viruses and a critical security flaw. Security experts called the Leap and Inqtana viruses relatively harmless because of their limited scope, but rated the security flaw in Apple's Safari Web browser as critical.

Discovered by Michael Lehn, a graduate student and research assistant at the University of Ulm in southern Germany, the Safari vulnerability could have allowed attackers to disable a Mac computer after tricking the user into accessing a phony Internet site that contained malicious code.

Up until the point that Apple patched the flaw, the Safari browser's default configuration was set to open and run compressed files automatically. Attackers could exploit the flaw when Mac users downloaded files in which malicious software had been disguised to appear as safe.

Apple issued a security update last Wednesday to fix 20 Mac OS X vulnerabilities, including the Web-browser problem and a similar flaw in Apple's Mail client. The update also patched iChat, Apple's instant-messaging application, which now relies on an Apple technology called "download validation" to warn users of unknown or unsafe file types during transfers.

Lessons Learned

"The lesson here is that if we look at Mac OS X and compare it to, say,
Windows XP, we find that, in terms of the number of vulnerabilities, they are actually quite comparable," said Vincent Weafer, senior director at Symantec Security Response.

What might surprise many is that both Apple's Mac OS X and Microsoft's Windows have roughly the same type of vulnerabilities in a similar volume, said Weafer.

But he did say that direct comparisons are not possible because both companies report vulnerabilities and security updates differently -- and Apple ships more applications with Mac OS X than Microsoft does with Windows.

Weafer also said that hackers are not capitalizing on vulnerabilities in Mac OS X to the same degree they are trying to exploit flaws in Windows. Weafer estimated that there are between 100,000 to 200,000 Windows viruses compared to 200 or so Mac viruses.

According to Weafer, the number of Mac vulnerabilities discovered and the possibility they will be exploited will gradually rise as a direct result of an increased interest in Mac OS X. Weafer urged Mac users to make sure they have installed antiviurs and antispyware applications and are updating them regularly.

**Untitled @ CE** · 03-06-2006, 09:53 PM

I couldn't help but laugh when I read that... :shredder:

lifeguard17 · 05-25-2006, 01:12 PM

I am personally not a fan of Mac, more programs run better with Windows than with Mac....

angelic angel · 07-03-2006, 12:29 AM

i agree

angelic angel · 07-03-2006, 12:39 AM

windows is a lot better than mac

Khounvisay @ CE · 07-03-2006, 02:36 PM

They were just trying to find a good hacker to work for them, lol

angelic angel · 07-04-2006, 06:08 AM

do you know that there is a game that teaches you how to hack into systems

Khounvisay @ CE · 07-04-2006, 12:38 PM

Yes, there is also books, and files, and tutorials....

angelic angel · 07-05-2006, 11:06 AM

yup like computing for dummies and stuff like that i think some include a bit of info on hacking im not sure cos i dont read that stuff cos im not a dummy

03-06-2006, 09:52 PM	#1 (permalink)
Untitled @ CE Go Leafs Go!. Join Date: Feb 2006 Location: Canada Age: 22 Posts: 1,559 Gold Bux: 28,709	Hacker Gains Root Access to Mac OS X in 30 Minutes It took a hacker less than 30 minutes to gain root-level access to Mac OS X, according to a report from ZDNet. The hacker who penetrated the system called the Mac "easy pickings." The security breach took place on February 22 after a Swedish devotee of the Mac set up a Mac Mini as a server and invited all takers to try to compromise the system's security to gain root-level control. Once a hacker has gained root access to a computer system, the attacker can install applications, delete files and folders, and use the computer for any nefarious purpose. The competition was over in a matter of hours after a hacker, who asked to be identified only as "Gwerdna," gained access to the server in question and defaced the Web site with a message that read, "This sucks. Six hours later this poor little Mac was owned and this page got defaced." Gwerdna told ZDNet that it took him a mere 30 minutes or less to gain root control of the Mac. "It probably took about 20 or 30 minutes to get root on the box," Gwerdna said. "Initially, I tried looking around the box for certain misconfigurations and other obvious things but then I decided to use some unpublished exploits -- of which there are a lot for the Mac OS X." Taking Aim at Macs Although Gwerdna said that the Mac Mini could have been protected more effectively, he also said that, even had the machine been configured for better security, it would not have stopped him because the vulnerability he exploited has yet to be published and Apple has not released a patch for it. The winner of the hacking contest went on to say that there is a limitation on what hackers can do with unknown and unpublished vulnerabilities because there are countermeasures that systems administrators can employ to tighten security -- even for unpublished software flaws. Although Gwerdna said that Mac OS X contains unpatched vulnerabilities that would permit a hacker to infiltrate Apple's operating system, he said that the relatively small number of Macs in use -- in contrast to the vast number of PCs running Windows -- is the reason more hackers do not try to exploit them. "Mac OS X is easy pickings for bug finders," he told ZDNet. "That said, it doesn't have the market share to really interest most serious bug finders." Flawed Apples News of this contest comes on the heels of Macs being hit by two viruses and a critical security flaw. Security experts called the Leap and Inqtana viruses relatively harmless because of their limited scope, but rated the security flaw in Apple's Safari Web browser as critical. Discovered by Michael Lehn, a graduate student and research assistant at the University of Ulm in southern Germany, the Safari vulnerability could have allowed attackers to disable a Mac computer after tricking the user into accessing a phony Internet site that contained malicious code. Up until the point that Apple patched the flaw, the Safari browser's default configuration was set to open and run compressed files automatically. Attackers could exploit the flaw when Mac users downloaded files in which malicious software had been disguised to appear as safe. Apple issued a security update last Wednesday to fix 20 Mac OS X vulnerabilities, including the Web-browser problem and a similar flaw in Apple's Mail client. The update also patched iChat, Apple's instant-messaging application, which now relies on an Apple technology called "download validation" to warn users of unknown or unsafe file types during transfers. Lessons Learned "The lesson here is that if we look at Mac OS X and compare it to, say, Windows XP, we find that, in terms of the number of vulnerabilities, they are actually quite comparable," said Vincent Weafer, senior director at Symantec Security Response. What might surprise many is that both Apple's Mac OS X and Microsoft's Windows have roughly the same type of vulnerabilities in a similar volume, said Weafer. But he did say that direct comparisons are not possible because both companies report vulnerabilities and security updates differently -- and Apple ships more applications with Mac OS X than Microsoft does with Windows. Weafer also said that hackers are not capitalizing on vulnerabilities in Mac OS X to the same degree they are trying to exploit flaws in Windows. Weafer estimated that there are between 100,000 to 200,000 Windows viruses compared to 200 or so Mac viruses. According to Weafer, the number of Mac vulnerabilities discovered and the possibility they will be exploited will gradually rise as a direct result of an increased interest in Mac OS X. Weafer urged Mac users to make sure they have installed antiviurs and antispyware applications and are updating them regularly. __________________ :happy dance:

03-06-2006, 09:53 PM	#2 (permalink)
Untitled @ CE Go Leafs Go!. Join Date: Feb 2006 Location: Canada Age: 22 Posts: 1,559 Gold Bux: 28,709	I couldn't help but laugh when I read that... :shredder: __________________ :happy dance:

05-25-2006, 01:12 PM	#3 (permalink)
lifeguard17 Senior Member Join Date: May 2006 Location: New Berlin Age: 18 Posts: 224 Gold Bux: 26,994	I am personally not a fan of Mac, more programs run better with Windows than with Mac.... __________________ i love futbol yea!!! berthol

07-03-2006, 12:29 AM	#4 (permalink)
angelic angel Senior Member Join Date: Jun 2006 Location: Australia Age: 18 Posts: 1,109 Gold Bux: 19,073	i agree __________________ kind, intelligent, loving and hot I'm everything your not. :nakedangel:

07-03-2006, 12:39 AM	#5 (permalink)
angelic angel Senior Member Join Date: Jun 2006 Location: Australia Age: 18 Posts: 1,109 Gold Bux: 19,073	windows is a lot better than mac __________________ kind, intelligent, loving and hot I'm everything your not. :nakedangel:

07-03-2006, 02:36 PM	#6 (permalink)
Khounvisay @ CE 36 yr old teenager Join Date: Jun 2006 Location: Greenwood, AR Age: 17 Posts: 469 Gold Bux: 38,353	They were just trying to find a good hacker to work for them, lol __________________ Isn't hate but twisted love? lmao.. I can just see it right now on the news.... "Kid commits suicide after spending 2 hours playing Mario, and loses..." TY....AKA....OWNER

07-04-2006, 06:08 AM	#7 (permalink)
angelic angel Senior Member Join Date: Jun 2006 Location: Australia Age: 18 Posts: 1,109 Gold Bux: 19,073	do you know that there is a game that teaches you how to hack into systems __________________ kind, intelligent, loving and hot I'm everything your not. :nakedangel:

07-04-2006, 12:38 PM	#8 (permalink)
Khounvisay @ CE 36 yr old teenager Join Date: Jun 2006 Location: Greenwood, AR Age: 17 Posts: 469 Gold Bux: 38,353	Yes, there is also books, and files, and tutorials.... __________________ Isn't hate but twisted love? lmao.. I can just see it right now on the news.... "Kid commits suicide after spending 2 hours playing Mario, and loses..." TY....AKA....OWNER

07-05-2006, 11:06 AM	#9 (permalink)
angelic angel Senior Member Join Date: Jun 2006 Location: Australia Age: 18 Posts: 1,109 Gold Bux: 19,073	yup like computing for dummies and stuff like that i think some include a bit of info on hacking im not sure cos i dont read that stuff cos im not a dummy __________________ kind, intelligent, loving and hot I'm everything your not. :nakedangel:

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode