MacBook gets hacked in security conference contest
Zero-day vulnerability in Apple Safari allows hacker to gain access to remote shell to MacBook.
A MacBook running a patched up version of OS X was successfully hacked, using an vulnerability in Safari, as part of a Hack a Mac contest.
The vulnerability was exploited at the CanSecWest conference in Vancouver, Canada, by software engineer Shane Macaulay, who won a laptop for his hacking efforts, and security researcher Dino Dai Zovi, who has been credited by Apple in the past for discovering vulnerabilities in its software.
Dai Zovi, who developed the exploit away from the conference and sent it to Macauly who then applied it, will now be submitting his work in an effort to claim the $10,000 bounty on offer for successfully hacking an element of Apple's operating system.
The hacked MacBook was fully updated with the latest version of Mac OS X and all relevant patches, but had no extra security measures in place.
Matasano Security reports that the vulnerability made use of Java, and so could also lay open other browsers on the platform, including Firefox.
Had nobody successful hacked the two MacBooks that acted as test subjects for the contest, they would have been awarded as prizes for the best speakers at the three-day event.
The contest was overseen by TippingPoint's Zero Day Initiative. TippingPoint, a division of 3Com, works to reward the responsible handling of discovered vulnerabilities in systems and software.
The ultimate law enforcement agency guide to going mobile
Best practices for implementing a mobile device programFree download
The business value of Red Hat OpenShift
Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShiftFree download
Managing security and risk across the IT supply chain: A practical approach
Best practices for IT supply chain securityFree download
Digital remote monitoring and dispatch services’ impact on edge computing and data centres
Seven trends redefining remote monitoring and field service dispatch service requirementsFree download