Slashdot Log In
Hacker Publishes Notorious Apple Wi-Fi Attack
Posted by
Zonk
on Wed Sep 19, 2007 06:39 AM
from the ponying-up dept.
from the ponying-up dept.
inkslinger77 writes "It's been about a year since David Maynor claimed to have found a way to take over a Mac using a flaw in a Wireless driver. He's now published his work for public scrutiny. Maynor had been under a nondisclosure agreement, which had previously prevented him from publishing details of the hack, but the NDA is over now and by going public with the information, Maynor hopes to help other Apple researchers with new documentation on things like Wi-Fi debugging and the Mac OS X kernel core dumping facility."
Related Stories
[+]
Apple: Apple Denies Wi-Fi Flaw, Researchers Confirm 267 comments
Glenn Fleishman writes "Apple tells Macworld.com that the Wi-Fi exploit demonstrated at Black Hat 2006 in a video doesn't show a flaw in their hardware or software. A third-party USB adapter with different chips and drivers was used, and Apple says the two researchers haven't provided Apple with code or a demonstration showing a working exploit on Apple equipment. The researchers added a note at their Web site confirming that only an unnamed third-party adapter was used. This doesn't mean the researchers have no flaw to show, but rather that their nose-thumbing at Apple users who were too secure in their security was misplaced, at least at present. The researcher's claim that they were providing information to Apple now seems off-base, too."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Link to the actual paper (Score:5, Informative)
Here's a link to the actual paper [uninformed.org].
And here's the important part:
Responsible disclosure (Score:4, Informative)
Re:Responsible disclosure (Score:4, Insightful)
Parent
Really good sleuthing (Score:3, Interesting)
First he bombards the network with random packets. Then the actual packet in question may not cause a crash for up to 5 minutes. Then he tracks down which packet it was and how using the contents of that packet he can use another packet to set up a code execution exploit.
Really good work. And no cookie for Apple whose driver choked on data.
Re:Really good sleuthing (Score:5, Informative)
Unfortunately, the opposing storm of FUD was just as bad, making it appear that the whole wireless vulnerability was a hoax, when in reality it was probably one of the more important general WiFi/driver vulnerabilities in recent memory. The choice of how to disclose was extremely poorly managed, and to make statements to the effect that you essentially wanted to stick it to Mac users when working under the guise of a supposedly professional and reputable security firm was what caused the problems. He embarrassed the hell out of SecureWorks by ending up with a firestorm of press that was massively bad PR for Apple.
So what, you say? It was bad press for Apple, and ONLY Apple. No other vendor of manufacturer got nailed by this in any substantive way. With Apple having such low marketshare, how is it fair for only Apple to be targeted in press articles about this? Not Maynor's fault? No, not exactly, but some of his initial choices for handling are absolutely what led to the situation. I'm sure he had little idea this would occur and just got caught up in the world between security research and disclosure on one side, and corporations and mainstream media on the other.
Parent
Re: (Score:2)
>
> This affected more than the just the chipsets and drivers in use in Apple laptops. It could be used in the same fashion on any affected chipset,
> potentially under various drivers on multiple OSes. The MacBook was just chosen as a point of principle to show that Macs, too, can be
> vulnerable to such attacks. This was noted in the initial coverage in the IT press at the time, but was quickly ignored in favor of a neverending
> flow of sensationalist articles claiming that
Re: (Score:2, Informative)
Apple denied the problem existed because - and I'm not saying this can be proven, but it's what was said at the time - Maynor couldn't show Apple engineers who were at the conference how the exploit worked with the MacBook'
Re: (Score:3, Insightful)
As opposed to..?
I don't know if you've been keeping up, but an awful lot of vulnerabilities are triggered by providing 'just data' to the target.
NDA? (Score:2)
Re:NDA? (Score:5, Informative)
Parent
Re:NDA? (Score:5, Funny)
Parent
Re: (Score:2)
Re: (Score:3, Informative)
Re:NDA? (Score:5, Funny)
Parent
This WASN'T an "Apple WiFi hack"! (Score:4, Insightful)
That's the whole point of why people took issue with this, and it's still being perpetuated here!
The way it was presented, even if Maynor didn't intend it as such, especially in all of the press coverage - first IT press, then mainstream, CNN, hundreds of local papers via AP, you name it - was that it was an "Apple" WiFi hack only, and that anyone could easily and quickly completely take over your MacBook remotely.
The stories just got repeated and regurgitated over and over, even though it was a flaw that affected a lot more than Apple; indeed, the most interesting thing about the vulnerability was its universal nature and applications!
Also, in the initial reports, Maynor and Ellch hid the brand and vendor of external wireless adapter they used for the demo because of, according to them, "responsible disclosure", but then had no problems saying the exploit worked identically on a stock MacBook. So if it was important to hide the brand of the wireless adapter they used for the demo, why was it not equally important to hide the fact that the chipset in a MacBook was vulnerable? How is it fair for this to appear as an exploit affecting only Apple, appearing under headlines like "MacBook hacked in 30 seconds - remotely via wireless!"
Given that Mac users apparently needed to have "lit cigarettes stuck in their eyes" - and whether that was a joke or not, I don't see how that's professional coming from someone who is a "security researcher" presenting findings under the guise of what purports to be a professional security outfit - it appeared that the choice to use a MacBook for the demo and the ensuing firestorm of publicity was done exactly for that reason.
Would this have been news if they had used a Dell or Lenovo laptop running Windows or Linux, even if they also still said that this affected multiple platforms, including Mac OS X?
Re: (Score:2)
Linux folks readily admit when kernel modules have bugs in serious need of repair. Windows users pretty much accept poor security as a fact of daily life.
But Mac users... They would call a dead pixel a "feature intended to relieve eye-strain from prolon
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Insightful)
The whining over how "awful" the black level on the new iPod Touch is, the "I'm unimpressed," attitude every time Apple releases something, simply because the mac rumors community builds every announcement up to be the second coming... Much of the Apple Faithful are disappointed when it's only revolutionary.
Apple fanatics are vicious to Apple. They devour their god, and their bloated bellies are never full.
Parent
Re: (Score:2)
Re: (Score:2, Insightful)
You know Dave, I'm really disappointed in this reaction and the reaction of most others in the Mac community on this news.
To address your point first: The hack was an Apple WiFi hack. It was presented that way because that was the news. The fact one could use the same exploit as a basis of a means to hack other operating systems was really not news - Windows is hackable, everyone knows that, and even GNU/Linux doesn't have a reputation for being invulnerable. Meanwhile Mac OS X, the operating system with
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Insightful)
I'm not apologizing for the behavior of the Mac fanboys afterward, and I already said that [slashdot.org] in one of my other posts.
But the very initial coverage stated that other WiFi drivers for similar chipsets on other platforms were already proven vulnerable. This wasn't some pie-in-the-sky theoretical claim; it was specifically stated that drivers Linux and Windows WERE vulnerable to the SAME exploit mechanism, and that the MacBook was chosen to just show that "Macs can be vulnerable too".
FUDing the story they way they did was wrong, but the damage was already done. If this were on Windows or Linux, this NEVER would have gotten picked up in the mainstream press. I say "mainstream" because that is an important distinction. The story was covered with none of the technical nuance or accuracy required, and left MILLIONS more people with the impression, even if only in passing, that "MacBooks" could be owned wirelessly in 30 seconds. Not any laptop. Not Windows. Not Linux. Just MacBooks.
If you can tell me how that's fair to Apple or how that helps Apple users, I'd appreciate it.
Also, I will say that the FUD reaction from the fanboy crowd did NOT help Apple users, and in fact did lasting damage to the Mac security situation. But if you can explain to me how the coverage, or saying that smug Mac users need lit cigarettes jammed in their eyes, or making it appear that the vulnerability ONLY affected MacBooks, or hiding the third party wireless card they used in the initial demo because of "responsible disclosure", but then immediately turning around and saying the integrated wireless in a MacBook was identically vulnerable - if you can explain to me how any of those "helped" the Mac community, I'd appreciate it.
Parent
Re: (Score:2)
Don't whitewash Maynor (Score:5, Informative)
Maynor did everything he could to destroy his own credibility.
He misrepresented the nature of the vulnerability. Not because he was under an NDA, mind you, but because
[OSX was promoted as] being free of the viruses and malware that plague Windows,
It still is. Because it still is free of them. Not because it's "invulnerable" (people who talk about it being invulnerable - pro or con - shouldn't be trusted... and that includes you), but because it's a competently designed UNIX based OS that takes advantage of layered security. There's some aggravating design flaws that are bigger problems than a fixable bug in Wifi (yes, really), but the bottom line is that it's got a fundamentally more secure design than Windows in many areas that really matter, and THAT has a huge effect.
and even GNU/Linux doesn't have a reputation for being invulnerable
Wrong. Linux has been promoted as being a virus free haven for Windows users for at least as long as OS X has, and it's been pushed harder. And, yes, it ALSO has the advantage of a good traditional UNIX design.
But if Maynor REALLY wanted to show off, he'd have attacked OpenBSD.
and suddenly Maynor found there was a massive hole in that
So? People find holes in OSX regularly. And I mean ACTUAL holes unique to OS X, not holes shared by a lot of common devices. ACTUAL cases of the SAME KIND of hole (buffer overrun), even. This is not a "massive hole in OS X" at all, and if he hadn't turned around and (a) attacked Apple specifically, and (b) refused to disclose the bug itself (and I don't believe in an NDA that would have kept him from telling Apple about a buffer overflow in a Wifi driver), nobody would have said boo to him.
But he didn't act responsibly. He wanted to grandstand and he wanted to hurt Apple, specifically. I mean, he said he had a grudge against Apple right there on his web page. That's not responsible, and has nothing to do with any NDA. Even it's not actually lying and even arguably not honest, it sure ain't honorable.
So here we have someone who's acting irresponsibly, and implying he's being paid to find security holes he's not allowed to talk about (and he still hasn't explained that bit), and who's specifically targeting one company... what kind of reaction should he expect?
Parent
Re: (Score:3, Interesting)
Considering it was a third party wireless device, it would only be logical that Macs would be the least affected by this hack, because very few Mac users (less than 1%?) would ever bypass the built in wireless for a third party solution. So this hack is more of a danger to Windows machines, which are far more likely to be sold without built-in wireless,
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Interesting)
Some Apple fans got a bit rabid. Not because a security flaw was found - there have been a good number of those since OS X started, and resposible disclosure has never caused users to go apeshit before - but because of the way the flaw was publicised without any real information. On top of that, he made that crack about stabbing Mac users in the eye with a pencil. What was that about? Who says these things and expects no reaction whatsoever?
Then he started saying he'd had death threats. Still haven't seen the threats and apparently they were serious enough to publicise but not enough to call the police in. I lost touch with the story when it seemed to be just poor reporting with low information content and pissy blog wars.
And now a secret NDA is up and he can talk about it. Well, good for him. It's about a year too late, but there's still publicity to be made I see.
Parent
Re: (Score:3, Interesting)
Granted, I certainly think he was trying to maximize the publicity and that statement certainly set the stage for the reaction that was to come. However, at least to me (and I'd assume many others) it was the reaction which was a bit surreal and made it interesting.
And now a secret NDA is up and he can talk about it. Well, good for him. It's about a year too late
I have seen many saying the same basic thing in response to this release
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Insightful)
DM: We found an attack which affects OS X and demonstrated it at a security conference. Also, you Mac users deserve a lit cigarette in your eyes.
AS: Give us details or admit you're lying!
DM: No details, because someone (aside, stage whisper hey George Ou - tell everyone it's Apple) won't let me speak. Legal eagles make me go hush now.
AS: You're a dirty liar! What's all this about using a non-Apple WiFi card? This proves you engineered a fake hack!
DM: I'd love to tell you why you're all wrong, but can't because I'm being leaned on by a company I can't name. I wonder who could be doing that..? Besides, someone sent me an anonymous email with a vague threat, which proves Mac users are all rabid dogs.
AS: Put up or shut up. Admit you're lying!
DM:...
A year passes, seasons come and go, the planet traces a circle of about 450M km around the Sun, people fall in and out of love, some are born, some die, interests change and people forget the whole thing.
DM: Hey everyone! It turns out I can talk now because an NDA (won't say who with, but you can probably guess) is over! My reputation is intact because here are all the documents I've held onto for a year! But I don't care what any of you think.
AS: O... kay... Would've been nice to know this all back then, and if you played it better you may have looked less like a publicity-seeking asshat and more like a responsible researcher with real information. The flaw was real, but you never reported it to Apple, Microsoft or any other OS vendor. People suspect the NDA was with Atheros but you haven't even said this much. It's still very suspicious, and you've never accounted properly for the use of that WiFi card.
And why did he sign an NDA and then play it up for the crowds so much? He knew he couldn't talk, but he dropped hints and made veiled references. Wouldn't the right thing, the responsible thing, have been to not make lots of public statements about something he signed an NDA not to detail?
Maynor played the publicity game with a hand he couldn't reveal for a year. By the time he could show his hand, the game had ended and everyone else had left the table. We all moved on. He could've done things a lot better, but he seems to have wanted shock and awe. It still stinks, and he's in no way off the hook for the farrago that whole incident became.
Parent
Re: (Score:2)
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Insightful)
Okay, but that's not entirely in context. Yeah, a lot of Apple Folk aren't going to care about this anymore for one reason and one reason alone; at this point, it is irrelevant to most end users. Why? Well, the vulnerability has since been patched; the only thing that drudging something like this up does is spread more garbage about the "insecurity" of the Macbook, OS X, etc. The story, as it is and as it was, is more about OS X than the actual bug that was found in that chipset/driver. It's true; OS X may only be mentioned once, but it's THE brand name mentioned, and when it comes down to it, a lot of journalists are looking for the quickest way to attach a name to an item.
Truth be told, I doubt that many actual publications could run a full story on Maynor's findings because simply put, he's getting way too technical. A responsible publication would opt to not publish, as they really can't do much more than associate the flaw (wiFi hack) with the name (Apple). Unfortunately, we don't always have the most responsible journalists.
I think that Apple folk have some what of a right to be pissed at his presentation method. If he thinks that he needs to stick it to the Apple folk for believing that they don't need to live in constant threat of their computers being overtaken by *insert virus/malware of the week*, fine, but truthfully, at that point, releasing data and associating it with Apple is just douchebaggery and somewhat sullies the reputation of the researcher, who should theoretically be above such nonsense. (Before anyone comments, yes, calling his actions douchebaggery or using the word in general sullies my reputation, but I'm not presenting as an expert is the difference)
What Maynor has is a wonderful research project; I just wish he'd understand that he messed up a little in his choice of actions when citing Apple in specific. Demonstrating the effect on just one more laptop model (Dell D620, for example), would have made all his problems go away.
Parent
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Insightful)
From my reading various stories at the time, I'd put the conversation more like this:
Maynor: I have this way that I can hack any Mac in 30 seconds, using stock Apple hardware and a normal install of OSX. I'm doing this because all Mac users are horrible people and morons who deserve to be tortured. By the way, I'm only going to demonstrate this using 3rd party hardware and 3d party drivers. And I won't disclose any details. And this hack also works on other platforms who have the same hardware and drivers, but let's not talk about that...
People with any sense: Um.... WTF are you talking about. Your methods are suspicious, your comments are inflammatory, and if you're a decent security expert, you should disclose enough information so that people can fix the bug. We don't trust you.
A couple random people: This guy's an asshole and a liar.
Anti-Mac crowd: Look at all the Apple fanboys, foaming at the mouth. They're insane!!!
Maynor: I won't respond to anything people are saying, because... um... I'm not allowed to.
People with any sense: Ok, screw it. You're being useless so we'll ignore you.
Some random Mac user: You suck. Shut up and die.
Maynor: But pay attention to me!!! I'm getting death threats!!!
People with any sense: What the hell is wrong with you?.
Anti-Mac crowd: Look at all the Apple fanboys, foaming at the mouth. They're insane!!!
...Months pass...
Maynor: Ok, now I'm allowed to talk about all this, so I'll inform you all that I was disclosing a bug that was fixed a long time ago, and that has already been documented.
People with any sense: Whatever... This isn't really a story anymore.
Anti-Mac crowd: Look at all the Apple fanboys, foaming at the mouth. They're insane!!!
Parent
Re: (Score:2)
The NDA does bother me. I think he should have at least been able to say. This card has a security i
The reaction was AFTER the news coverage (Score:5, Insightful)
That was AFTER it had already been picked up by the press, including mainstream non-IT press, under sensationalist headlines, and with no mention in the article that anything BUT Apple's new flagship portable was affected.
This was in the first two days before there was any rabid or insane reaction that anyone in any of these news outlets knew about (except for maybe Krebs at the Washington Post, who seemed determined to give this story legs at any cost).
The story ran under headlines like "New Mac laptops vulnerable" and "MacBook hacked in 30 seconds - wirelessly". The story ran not only in the traditional IT rags, which sometimes had the journalistic accuracy to also say the vulnerability could affect other hardware platforms and OSes just the same, but in national mainstream press outlets, including AP, which gets picked up by hundreds and hundreds of local news papers and other local media, and gets seen by millions more people than will ever see anything in Network World or The Register.
All at a time when more people than ever were considering a move to Mac OS X after the switch to Intel. Their only takeaway as they scanned the morning paper or caught a segment on the local morning news? That the "MacBook" can be "taken over" in "30 seconds", wirelessly, and all without you knowing. Hmm, might as well stay with Windows after all.
So yeah...as I already noted in another post [slashdot.org], the reaction from the Mac crowd was even worse, FUDing the story into oblivion. However, the initial coverage wasn't because of that. At all. In any way, shape or form. It was because a security vulnerability affecting Macs is interpreted by many to be BIG NEWS, whether they're the kind of journalist (as a few in the IT press are) who want to trumpet negative Apple stories, or just simply some guy at AP who sees it as a unique story. NONE of the original coverage, which was the only substantive coverage and what had already caused the damage, was because of the Mac fanboy reaction. Rather, it was the opposite.
Parent
Re:This WASN'T an "Apple WiFi hack"! (Score:5, Informative)
My cynical suspicion is that he hadn't gotten the exploit to work on the MacBook stock WiFi card at the time, and rather than wait until he could and risk being "scooped", he tried to bluff.
Even more cynically, it's possible he had nothing on Apple at the time, later reverse-engineered his exploit from Apple's patch, and the exploit on the third-party card was something else entirely.
Parent
Re: (Score:3, Interesting)
Re: (Score:2)
My cynical suspicion is that he hadn't gotten the exploit to work on the MacBook stock WiFi card at the time, and rather than wait until he could and risk being "scooped", he tried to bluff.
Well I don't know whether that's true, but I just think the choice is curious. I don't know why I got modded "flamebait". It's just strange to make part of the point of your demonstration be that Apple's stock hardware is vulnerable but refuse to demonstrate using Apple's stock hardware. I was hoping that, in hindsi
Re: (Score:2)
But the vulnerability they discovered was a general one, and they explicitly stated that it could be applied to affected WiFi drivers and chipsets under other OSes, including Windows and Linux. Their discovery resulted in patches for this flaw in various WiFi drivers on various OSes. They picked Apple to make the point that "Macs can also be vulnerable" to such things.
So while the Apple exploit is specific to Apple, it is an applicati
Simpsons Quote (Score:2, Funny)
Okay, I changed "week" to "year."
Correct me if I'm wrong.. (Score:3, Informative)
So what happened? The original story was a lie? The new story doesn't have their facts straight? IF this guy hacked an AirPort driver, like the NEWEST link claims, then this is a story. However, since the past year has been filled with nothing but discrediting proof that he hacked a third-party adapter, and his video shows him inserting a third party wireless USB adapter, then I would have to guess that the Apple AirPort wireless adapter was never, and still isn't, threatened by hacking.
Re: (Score:2, Interesting)
Re: (Score:2)
When does Jon "Daringfireball" Gruber apologize? (Score:3, Interesting)
It was true. He owes them a laptop...
Re: (Score:3, Insightful)
In any case, he set a time frame for taking the challenge that ended just over a year ago at this point.
No, this really doesn't earn them any apology from him.
Re: (Score:2)
Re:When does Jon "Daringfireball" Gruber apologize (Score:2)
Re: (Score:2)
The challenge was for Maynor and Ellch to hack a fresh out of the box MacBook using their wifi exploit a year ago. They didn't accept the challenge and so they don't deserve a laptop.
Apple's track record is contradictory to the lie.. (Score:5, Informative)
And i have a very very hard time believing that Maynor is telling the truth about that because Apple has an incredible track record on not only accepting information, but giving credit where credit is due to people that find problems and exploits
Here are 28 examples between 10.4.1-10.4.3 [blogspot.com] where Apple gave credit to security researchers, organizations, and individuals.
So, Maynor found something, acted very suspiciously, made lame comments, hid information, and blamed Apple for all of it.
He's a choad.
Re: (Score:2)
Re: (Score:3, Interesting)
Only open source systems like Unix can be made reasonably secure.
Ahemm... the flaw is not platform or OS related. It is related to a specific series of Wifi chips and drivers, regardless of which OS is installed on the host computer.
This flaw can be exploited on Unix, Linux, BSD, Windows, OS X. If the Olsen-twins made an OS using the same hardware and code base for network drivers, their Olsen-twin-OS would have the same flaw as well. In fact, the wide application of this flaw is the main reason it is truly newsworthy.
I politely recommend reading the article, and st
Re: (Score:2, Informative)
Re: (Score:2, Insightful)
Anyone who creates a real self-propegating worm for OSX that infects end-users' machines would be revered as a god among men, or at least among Windows fanboys. The fact that a year later after Maynor's exploit and two years after the first smarmy "I'm a Mac" ad nobody has done it tell me there's more to OSX se
Re: (Score:2)
Or it could just be that nobody cares enough to invade New Zealand...