University of Wisconsin MacOS X Hack Challenge Options

[Dogmeat]

http://apple.slashdot.org/apple/06/03/07/1324256.shtml

Apparently the MacOS box they've set up has been slashdotted to death, but they're basically claiming the ZDNet article that said MacOS X could be h4x0r0r0r0r00reDDDDddd in 30 minutes was false.

[pebkac]

http://test.doit.wisc.edu/

There were no successful access attempts of any kind, including during the 38 hour duration of the test period, nor have their been any claims of success. The host is still the same host and configuration used for the test.

Also:

The ZDnet article, and almost all of the coverage of it, failed to mention a very critical point: anyone who wished it was given a local account on the machine (which could be accessed via ssh). Yes, there are local privilege escalation vulnerabilities; likely some that are "unpublished". But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction.

[Hartmann]

I like what Molly Wood wrote:

OK, so first there was a Mac OS X hacking contest, and this guy was all, "w00t, I totally hax0rd it in 30 minutes, I am hecka l33t!" And then a University of Wisconsin systems engineer organized a new challenge that was actually a challenge--in the sense that he didn't give anyone a local account on the machine, just like you wouldn't if, you know, it were your Mac. And no one breached that bad boy in some 38 hours of trying. I feel the only appropriate response here is "snap."

[impala454]

there's a difference between hacking a box that some dude sets up purposely to be more secure, and what an everyday user will have hosing their system up.

[pysex]

there's a difference between hacking a box that some dude sets up purposely to be more secure, and what an everyday user will have hosing their system up.

if you turn any kind of remote access off on your mac you're practically invulnerable

[Hartmann]

there's a difference between hacking a box that some dude sets up purposely to be more secure, and what an everyday user will have hosing their system up.

There's also a difference in giving someone a basic user account, having them up their permissions and someone brute-forcing their way in.

[Seeker]

So if you get access to the Mac box you can own it, the problem in this case is getting an account. He'd have to try all the default accounts, run brute-force dictionaries on accounts, figure out if any trusted IPs are allowed and spoof them, hijack the session between a legal user and the Mac box, or find a buffer overflow in some service that's running to let him in remotely.

Either way I'm sure it can be done by someone with enough persistance and know-how. The question is, who cares enough to even try?

[impala454]

if you turn any kind of remote access off on your mac you're practically invulnerable

yeah right

[impala454]

The question is, who cares enough to even try?

bingo

[zetec]

if you read the zdnet arcticle, the hacker A ) used an unpublished exploit, and B ) the box they set up to h4x0r had no extra security hardening, it was more on a user-level than a server level


get your shit right.

[Hartmann]

if you read the zdnet arcticle, the hacker A ) used an unpublished exploit, and B ) the box they set up to h4x0r had no extra security hardening, it was more on a user-level than a server level


get your shit right.

And to top that off it was an exploit in the user permissioning code. What bothers me is that Apple has made no comment on fixing the exploit even though they apparently know what the problem is.

[prefix]

Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community.

Hahahaha, that's funny. So this contest wasn't official? Anyway, most people probably didn't even know about the test so the results were probably mediocre anyway.