PWN to OWN 2008 – Day 3
So I couldn’t just laugh at the MacBook Air with a fully updated Leopard being hacked through Safari and leave it at that. The contest has a day three – which is opened even further when commonly-used third party apps are installed on the laptops for contestants to also use to hack through. Granted, at that point it’s hardly a matter of blaming the operating system author as these are third-party applications written and deployed by completely separate companies making the holes now, and not the OS or the OS-bundled applications.
Still… It’s a chance for a white hat hacker to win a shiny new laptop.
Well, Linux fans will be happy to know that the Ubuntu laptop survived! Congrats to Linux!
But yes, that also means the Windows Vista Ultimate SP1 laptop was cracked! At 7:30pm PST Shane Macaulay from Security Objectives managed to break into the Vista laptop through a third-party application by the name of … dun dun dun … Adobe Flash! I bet right now Adobe execs are saying, “Ooops!” As well they should. Fortunately the security hole is being responsibly reported to Adobe and concealed from the likes of everyone else so as to not tip off hackers as to how Flash made it possible to break into Windows Vista Ultimate with SP1. But all the same, it just goes to show that you can make your operating system as fool proof as you like, but some darn fool is going to make a popular application with its own holes and poof, you’re hacked.
Still, I bet the secure-by-default nature of Linux made the Ubuntu laptop awfully challenging. Even with popular third-party apps installed, no one conquered that mountain this year. Let this be a lesson to Apple and Microsoft. There are right ways to do security. No computer is ever 100% safe. No computer is ever fully secure. But a few simple concepts implemented well can go a long way.
