Search:  

 
 
   News
newer
story category Can't find a flaw? Create one!
Mac Wi-Fi flaw exposure bogus
(old news - 11:38AM Sunday Aug 20 2006)
tags: security · Mac
Tipped by Karl Bode See Profile
A few weeks back a story concerning the discovery of a Wi-Fi vulnerability, demonstrated on a MacBook Pro at a black hat conference, gained lots of traction. At the convention, hackers Jon "Johnny Cache" Ellch and Dave Maynor demonstrated how to take over any Apple MacBook if its wireless card was turned on, even if the owner isn't connected to a wireless network. However, as David Chartier over at tuaw.com points out, it was, shall we say, not quite true. As it turns out, the presenters now admit they modded the laptop, since the original driver that ships with it was not vulnerable to attack.

Related:
  1. First Worm for Mac OS X
  2. BBR Users Get Macworld Privacy Issue Corrected
  3. Hack My Mac, Please
  4. Hack My Mac, Please
  5. Symantec: Apple Security Risk Rising
  6. Apple Silencing Wireless Hackers?
  7. Friday Evening Links
  8. Friday Evening Links
Forums » Can't find a flaw? Create one!
view: topics flat text 
Post a:

ropeguru
Premium
join:2001-01-25
Hollywood, FL
clubs:

NO!! Tell me it isn't so...

Blackhatters lying and cheating???
--
FWD#: 223611
XknightHawkX

join:2003-02-13
Morton, IL
clubs:

Re: NO!! Tell me it isn't so...

I don't care what they did to hack the system. The fact is no OS is completely safe from being hacked. Even if they cheated now someone down the line will find out how to hack the OS. There will never be a completely safe system.

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA

Re: NO!! Tell me it isn't so...

said by XknightHawkX See Profile :

I don't care what they did to hack the system. The fact is no OS is completely safe from being hacked. Even if they cheated now someone down the line will find out how to hack the OS. There will never be a completely safe system.
While I agree with you're assertion that no OS is completely safe and that the "shoulda got a Mac" crowd live under a false sense of security that could largely be the direct result of the relative obscurity their OS exists in; we don't need people confusing the issue by making stuff up or exaggerating the real world implications of a flaw. All that does is make the "Mac's are impervious" crowd even more sure of themselves.
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:

Re: NO!! Tell me it isn't so...

said by Combat Chuck See Profile :

"the relative obscurity their OS exists in"
hahahah
--
DEATH TO 'ZOG'

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA

Re: NO!! Tell me it isn't so...

said by M A R K See Profile :

said by Combat Chuck See Profile :

"the relative obscurity their OS exists in"
hahahah
The fact that there are more windows machines than Mac OS machines is funny?
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:

Re: NO!! Tell me it isn't so...

said by Combat Chuck See Profile :

said by M A R K See Profile :

said by Combat Chuck See Profile :

"the relative obscurity their OS exists in"
hahahah
The fact that there are more windows machines than Mac OS machines is funny?
Not at all, the fact that you think OSX hides in obscurity is.
--
DEATH TO 'ZOG'

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA


edit:
August 20th, @09:29PM

Re: NO!! Tell me it isn't so...

said by M A R K See Profile :

Not at all, the fact that you think OSX hides in obscurity is.
You can pretend that the hax0rs are beating down the doors to hack macs or you can live in reality. The reality is that the people looking to exploit systems for profit could care less about macs because there's a whole lot more windows systems out there; the amount of time spent by all people worldwide looking for exploits in macs is going to be just a drop in the bucket compared to Windows. That's not a knock against your precious overpriced offwhite PC's, it's a simple fact of life. Now calling a mac an overpriced offwhite PC...that is a knock against Macs, all 5% of them.
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:

Re: NO!! Tell me it isn't so...

said by Combat Chuck See Profile :

said by M A R K See Profile :

Not at all, the fact that you think OSX hides in obscurity is.
You can pretend that the hax0rs are beating down the doors to hack macs or you can live in reality. The reality is that the people looking to exploit systems for profit could care less about macs because there's a whole lot more windows systems out there; the amount of time spent by all people worldwide looking for exploits in macs is going to be just a drop in the bucket compared to Windows. That's not a knock against your precious overpriced offwhite PC's, it's a simple fact of life. Now calling a mac an overpriced offwhite PC...that is a knock against Macs, all 5% of them.
You win
--
DEATH TO 'ZOG'

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:

Click for full size
said by Combat Chuck See Profile :

said by M A R K See Profile :

Not at all, the fact that you think OSX hides in obscurity is.
You can pretend that the hax0rs are beating down the doors to hack macs or you can live in reality. The reality is that the people looking to exploit systems for profit could care less about macs because there's a whole lot more windows systems out there; the amount of time spent by all people worldwide looking for exploits in macs is going to be just a drop in the bucket compared to Windows. That's not a knock against your precious overpriced offwhite PC's, it's a simple fact of life. Now calling a mac an overpriced offwhite PC...that is a knock against Macs, all 5% of them.
And one more thing, you seem to be acting like a dick. All i did was comment on your words. I know all well that OSX is open to attacks if the time was taken.

But you seem to think i'm some kind of Mac nut. Your comments are foolish too

"My precious machine" "Over Priced"

Find me a pc with the following specifications for $1300:

»www.apple.com/imac/whatsinside.html

Now read it all carefully. And also understand your getting software that blows any shit way that comes with Windows XP. And if there is something i need thats XP only thats ok too, Ill just run XP in a window on my desktop. So i kinda get 2 computers for the price of one. Or even 3, i can run Linux in a window too. I can do anything you can to and more. And even with all that i don't feel the need to attack you, ill just let you be you.
--
DEATH TO 'ZOG'
mlundin

join:2001-03-27
Mishawaka, IN

Re: NO!! Tell me it isn't so...

I can build that machine and better for right at a grand and you've still got $300 to put whatever OS (or OS's) you want on it.

Mchart
Tech Control

join:2004-01-21
Gurnee, IL
·RoadRunner Cable
·AT&T Yahoo


edit:
August 20th, @11:18PM

1.) I can build an equivalent spec PC system for about 1/4 less of the price.
2.) I dont care about mac os. I dont need it, end of story. If your expecting me to buy a mac so I can bootcamp it to run PC games, your nuts. I would rather spend nearly $500 less on a PC, and not even have to deal with the mac.
3.) Good luck upgrading that thing. My PC that uses nearly the same hardware and cost $500 less will last more then a year.

If you reply with something along the lines with - 'But your PC cant run macos lawl!' refer to point #2.

M A R K
St. Ides Heaven
Premium
join:2001-06-15
Long Island
clubs:


edit:
August 21st, @12:36AM

Re: NO!! Tell me it isn't so...

said by Mchart See Profile :

1.) I can build an equivalent spec PC system for about 1/4 less of the price.
2.) I dont care about mac os. I dont need it, end of story. If your expecting me to buy a mac so I can bootcamp it to run PC games, your nuts. I would rather spend nearly $500 less on a PC, and not even have to deal with the mac.
3.) Good luck upgrading that thing. My PC that uses nearly the same hardware and cost $500 less will last more then a year.

If you reply with something along the lines with - 'But your PC cant run macos lawl!' refer to point #2.
Horse shit, you do you and ill do me. The only un-ugradable part of my iMac is the video. And sure that sucks. But as for RAM, HD, CPU, Optical what ever, ill get all of it on new egg. And also, i would love to know why people hate Mac so much? What exactly do you dislike about it?
--
DEATH TO 'ZOG'

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA


edit:
August 21st, @01:54AM

Re: NO!! Tell me it isn't so...

said by M A R K See Profile :

And also, i would love to know why people hate Mac so much?
I don't hate Mac's. It's just a platform. The problem is the marketing which has caused it's users to form an irrational emotional attachment to the platform. Any anger I have regarding it is largely a result of constant belittling of other platforms "inferiority" by mac users while each new mac iteration becomes increasingly more PC like (the 20% markup and years of crap about the Power architectures superiority don't help).

At this point it is an IBM compatible with some DRM-like mechanism that allows it to run OSX.
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

cableties
Premium
join:2005-01-27
Levittown, PA

Re: NO!! Tell me it isn't so...

Please please folks! Enough with the My PC is better than your mac, or My mac is better than any PC or I can build this cheaper than that. A computer is a tool. (deep breath. hold. exhale. relax)

With regards to Combat Chuck, I agree! It is the marketing and zealots that I dislike about the mac. (I've been support to mac users for over 13 years and I KNOW about macs and their users).
It is almost elitist how mac users favour themselves. And its also immature how PC users taunt them. And the irony, which is still killing (sic amusing) me, is that Macs were considered toys and gaming machines, where PCs were tools of trade. Hmmm, macs are in the greater percentile for designers and science, where a game (quake) is what a PC is spec'd against. Would I have thought Apple to adopt intel? Rather I would have thought Apple to adopt AMD.

(insert rant about how the OS has gotten more slick and bloated...lacks self-healing features, is wide open to exploit and is still slow for the amount of memory you throw at it...and I am talking about BOTH Vista and 10.4/10.5)

If it works, if it does what you want it do, and repeatedly without problems, then so be it. If it is too much, then why buy it?

tapeloop
Triceratops - 130 dollars per bbl
Premium
join:2004-06-27
Airstrip One

Re: NO!! Tell me it isn't so...

Time from thread start until fanboy flames: seven posts. C'mon guys, you're slipping.

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA

said by M A R K See Profile :

All i did was comment on your words.
Sooooo...what exactly was I doing then? I think my response to you was fairly civil considering. I mean it's taking all my willpower to not point out that you proved my point by posting the specs and that I don't care about a crappy day-planner and worse than FrontPage webpage maker......oops.
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

MoeDumb
"America Si, Obama No."
Premium
join:2002-09-23
Bronx, NY


edit:
August 20th, @10:58PM

said by Combat Chuck See Profile
All that does is make the "Mac's are impervious" crowd even more sure of themselves.
And you hate that confidence, don't you?

The truth is Mac owners don't say "Macs are impervious"; it's PC users who put those words in our mouths.

Nevertheless that's pretty much proven to be the case thus far, hasn't it?
--
"tick...tick...tick..."
»www.jtf.org/

Combat Chuck
Too Many Cannibals
Premium
join:2001-11-29
Verona, PA

Re: NO!! Tell me it isn't so...

said by MoeDumb See Profile :

And you hate that confidence, don't you?
No, I find it quite amusing frankly.

said by MoeDumb See Profile :

The truth is Mac owners don't say "Macs are impervious".
Yeah they do. Many of them are the hacked and spyware infested windows users that know nothing about their computer and click yes on every dialog that you are currently recruiting to your side via recent Apple advertising. A slowly growing veritable time bomb should the black hats choose to target Mac OS en-mass. They are also the same people posting here saying this whole thing is a non issue because for most users there's no need for a 3rd party Wifi adapter.

said by MoeDumb See Profile :

Nevertheless that's pretty much proven to be the case thus far, hasn't it?
Which doesn't surprise me at all in the same way that people who live out in the country can leave their doors unlocked and not worry about it.
--
Early to rise, early to bed;
Makes a man healthy but socially dead.

operagost

join:1999-08-02
Phoenixville, PA
What, exactly, is your point? Perhaps I should not go outside because there is no place I can go and be completely safe from being mugged.

hayabusa3303
Over 200 mph
Premium
join:2005-06-29
clubs:
·RoadRunner Cable
·QuantumVoice
·ViaTalk
·Vonage

Mac vs pc.

Goes to show you a mac is still better then a windows machine when it comes to hackers.

Also is shows you that third party software still needs improvement over mac software.
--
8-14-2006 Family's loved and behold cat named "hayabusa" past away. He will be forever missed. 6 1/2 years old.

anonMacLover

@cox.net

Re: Mac vs pc.

Goes to show you the Mac OS isn't as secure as most think, 3rd party driver or not, it still became insecure. If the OS was truly secure, it wouldn't have let the 3rd party driver create such a hole.
BIGHUSKER

join:2002-01-20
Minneapolis, MN

said by hayabusa3303 See Profile :

Goes to show you a mac is still better then a windows machine when it comes to hackers.

Also is shows you that third party software still needs improvement over mac software.
Do you even know what a "hacker" is? As obtuse as your first sentence is, I doubt it.

hayabusa3303
Over 200 mph
Premium
join:2005-06-29
clubs:
·RoadRunner Cable
·QuantumVoice
·ViaTalk
·Vonage

Re: Mac vs pc.

said by BIGHUSKER See Profile :

said by hayabusa3303 See Profile :

Goes to show you a mac is still better then a windows machine when it comes to hackers.

Also is shows you that third party software still needs improvement over mac software.
Do you even know what a "hacker" is? As obtuse as your first sentence is, I doubt it.
How many virus per mac vs pc? Mac wins your point is?
BIGHUSKER

join:2002-01-20
Minneapolis, MN

Re: Mac vs pc.

said by hayabusa3303 See Profile :

said by BIGHUSKER See Profile :

said by hayabusa3303 See Profile :

Goes to show you a mac is still better then a windows machine when it comes to hackers.

Also is shows you that third party software still needs improvement over mac software.
Do you even know what a "hacker" is? As obtuse as your first sentence is, I doubt it.
How many virus per mac vs pc? Mac wins your point is?
How many viruses on a properly secured machine? None. Sorry, but PCs don't all fit into the perfect little box you imagine they do.

Doctor Dan
Weapons Of Masturbation
Premium
join:2001-10-20
Papiopolis

Perhaps they should change the name of the conference...

...to "Ass Hat."

- Dan

knightmb

join:2003-12-01
Franklin, TN
·Comcast
·Vonage
·Speakeasy

The flaw is still there of course.....

The flaw was suppose to be in the device drive and it still is, just not the default one the mac came with. It's still a valid problem they demonstrated, which is, don't let the OS give too much trust to a device driver.

If plugging a USB drive into a windows laptop gave you full control of it all of a sudden, expect a lot of media coverage for that. Then later of course, they show they "modded" the USB drive to exploit some kind of USB device driver related code for Windows and every yells fake.

This isn't the time to yell fake. It's still a valid problem for the Mac (and Windows and everything else that gives device drivers root access).

So.... points for bringing up problem, sure. Minus points for "rigging" the test to make it look spectacular, certainly. The problem still exist though and anything as easy as “plug it in real fast and take over” is still a major problem for Mac user that is using the same chipset they demonstrated with. The real problem this bring up, when “that” chipset is finally found out, how many Mac users will bother to upgrade the software to defend against it? Will it be part of a Mac update? How will Microsoft respond if the same chipset is available for a Windows machine?
yabos

join:2003-02-16
Ingersoll, ON

Re: The flaw is still there of course.....

Device drivers are loaded into the kernel so that's how the flawed driver can be exploited to gain root access. Plus they had to install a rootkit first before they could even exploit the 3rd party driver. The problem with their demo was they said how every Mac was vulnerable which wasn't true since it's highly unlikely they'd be using this 3rd party wireless card. All Apple laptops have built in wireless cards so there's not much of a need to use another card.

Since they say the same problem can happen on Windows, how many Windows users will update their drivers? Microsoft doesn't usually distribute 3rd party drivers and neither does Apple.
wowok1234

join:2004-07-25
Chicago, IL


edit:
August 20th, @12:38PM

My view...

My view....

There are only a few mainstream chipsets for 802.11, and even fewer come with Mac drivers. There's Ralink, TI, Broadcom, Atheros, Intersil, and Atmel. This pretty much covers perhaps 98% of all wireless cards for computers. Out of these, Mac OS X includes support for Atheros and Broadcom chipsets, since that is what Apple uses for wireless built into its computers.

While this is a serious issue, consider that most Macs sold since 2003 have had wireless built-in, and Macs since 2000 have had a slot for an Apple-made wireless card. This includes both the desktop line and the notebook line. How likely is it that an average Mac user would purchase a 3rd party (non-Apple) wireless card, plug it into their computer, and install the drivers for it? Not very likely, although there are a few geeks out there that would go for something cheaper. Most people would go for something that is supported by Apple.

Also note that the default for Mac OS X is to ask the user for permission before joining any open wireless AP.

Morac

join:2001-08-30
Riverside, NJ
·Comcast

Re: My view...

quote:
Also note that the default for Mac OS X is to ask the user for permission before joining any open wireless AP.
Just of note, that the flaw does not require the user to connect to an AP so it doesn't matter if Mac OS X asks permission or not. If it means anything Windows XP SP2 puts up the same warning.

insomniac84

join:2002-01-03
Schererville, IN

Not news.

Even if there was an exploit here, Not enough people use macs for this to be considered news.
DarnellP

join:2004-10-12
Las Vegas, NV

Re: Not news.

Obviously DSLR disagrees with your narrow-minded opinion....

See 6 replies to this post

MacSux

@mchsi.com
Good point.

sporkme
drop the crantini and move it, sister
Premium,MVM
join:2000-07-01
Netcong, NJ

said by insomniac84 See Profile :

Even if there was an exploit here, Not enough people use macs for this to be considered news.
While everything is just up in the air now since we can't trust these folks, keep in mind that they did originally just use a Mac for "wow factor". They claimed that it was a "universal" vulnerability that could target windows as well.

foo65536

@cox.net

a bright idea...

look. these guys modded the software to give themselves an entry point to the macbook. so no, there is no vulnerability in the mac drivers that has been exposed - yet. all drivers must run in kernel level. how else do you think that the mac os x modified bsd kernel could access the devices? think, people. vulnerability? no. cheap trick? of course.

Michieru
zzz zzz zzz
Premium
join:2005-01-28
Miami, FL
·Speakeasy

...

I am sick of these news article's. To put it as clear as possible anyone who thinks there system is completely secure has bird shit up in there head. No matter if it where local or remote your system remains vunerable somehow in one way or the other.

Apple only has the more secure reputation over the fact that so far they been keeping up with security updates. Or does nobody read the details of all those security updates?

Buffer overflows, arbitary code execution, those are holes Apple or some customer found that reported it to them. You can say Mac OS X is more secure because there update period is more frequent or because of it's core. But no matter which way you look at it there is always a way to escalate privilages.

Plus before I get the rant of millions of mac fanboys saying I am some hater, I own three macs and go back all the way to OS9 (Yes I started late) but I am a mac user nevertheless.

Frankly I frown upon those who think OS X is invincible. You can call it because of market share or what ever crap conspiracy theory you grabbed out of your ass. You won't be convincing me.

By the way hackers are intelligent individuals who you should be thankful too because they created important breakthroughts in technology that probably a company could not think of.

What you should be worried about is crackers or the script kiddies.

End rant.

N3OGH
They both suck, we're so screwed
Premium
join:2003-11-11
Philly burbs
·Verizon Online DSL

Re: ...

Whoa whoa whoa whoa whoa...

Don't be so quick to speak the truth around here, it's been known to be dangerous.

It's no secret that I have a Mac (1.83 MBP), and I also run a home made Windows box.

That said, it's always been my opinion that anything made by man can be cracked by man. From the lock on your front door, to copy protection on software, to hardware and operating systems. Unless it's handed down from god himself, there's always someone out there with a few more brain cells to rub together (or time on his hands) to find a way to exploit it.

Given the ranker that can often result when dyed in the wool Windows users bust heads with hardcore Mac users, it really does surprise me that someone hasn't taken the time to launch a major exploit on the Mac platform just for the "HAW-HAW" effect of it. This leads me to believe that Mac OS-X is more than just the unwitting beneficiary of "obscurity". If I were smart enough (I'm not) to write a virus for the Mac that would put the hardcore Mac folks in their place, why wouldn't I? Folks write viruses for more than just a quick buck. There's a lot of pride involved in it. Imagine the street cred the guy who wrote that Mac Virus...

Everything else aside, I've said this before. You like your computer, I like mine. Who gives a crap what OS you run or what OS I run. It's my computer, I'll run whatever I like on it. Go have fun with your computer, I'll have fun with mine, and life goes on.

After all it's just a COMPUTER, not your wife's honor or something....
raye
Premium
join:2000-08-14
Orange, CA

They never said it was a flaw in Apple OSX!!!

I was at the presentation, and part of it can be viewed at youtube.com/watch?v=H2oxrqs9T2s

The speaker says MORE THAN ONCE THAT THIS IS NOT AN EXPLOIT AGAINST APPLE, BUT AGAINST THE THIRD PARTY WIRELESS CARD.

Since many of us use third party wireless cards (i.e. Linksys, etc), that have firmware associated with them, it may be possible to compromise the card, thereby gaining access to the computer's OS.

toadlife
Premium
join:2004-05-03
Coalinga, CA
·AT&T Yahoo

Someone help me out here

Where the hell do the Securworks people admit to falsifying anything? In the story here, and the links from it, I can find nothing.

In every article and interview I've ever seen, the Secureworks people make it clear that they used the third party wireless card.

sporkme
drop the crantini and move it, sister
Premium,MVM
join:2000-07-01
Netcong, NJ

Re: Someone help me out here

said by toadlife See Profile :

In every article and interview I've ever seen, the Secureworks people make it clear that they used the third party wireless card.
One of their earlier claims was that they were going to demonstrate on the built-in wi-fi card but that Apple "leaned on them".

BuriedCaesar
It's Not Polite To Stare.

join:2004-03-27
Richardson, TX
·AT&T Yahoo

Re: Someone help me out here

AND they've stayed mum on what sort of "leaning" it was, if it even happened ... which of course leaves the masses (us) to speculate the veracity of the claim (as I just did). However, Apple has responded at least to something. See my post up above for the link.
--
That was preposterous! Utter Nonsense! Totally unsupportable drivel! You can't be serious!....Um, what did you say?

BuriedCaesar
It's Not Polite To Stare.

join:2004-03-27
Richardson, TX
·AT&T Yahoo

Gruber nails it...

John Gruber has nailed the lid shut on this one - well, okay - he screwed down one corner that can be reopened with a simple question he says remains unanswered, but he has put to rest the remaining salient issues that this whole episode has wrought:

»daringfireball.net/2006/08/curious_case

It's a long read - but well-worth it if you wish to see how this whole thing has transpired to date (at least how he sees it).
--
That was preposterous! Utter Nonsense! Totally unsupportable drivel! You can't be serious!....Um, what did you say?

elias
Premium,VIP
join:2000-07-24
Miami, FL
clubs:

External USB Wireless Card

The other thing is that they were using an external USB wireless card, when the laptop has its own built-in wireless. Furthermore, the vulnerability in the external card was on all platforms.
--
My Webmaster Gig | Crunching the Midnight Oil
Forums » Can't find a flaw? Create one!


Saturday, 06-Sep 15:12:18 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 9 years online! © 1999-2008 dslreports.com.