Hijacking a Macbook in 60 Seconds or Less

**Doctor Feelgood** · Posted: Thu, 03 Aug 2006 08:53:34 Post Subject:

Haha!

And I do agree with this from the article, too...

mrweasel · Posted: Thu, 03 Aug 2006 09:27:11 Post Subject:

I call Bullsh!t

anytime they do a "video" demo as opposed to a liv e demo, you know something's up. Besides anyone can configure a mchine to be hackable to prove their point.

BeerCheeze · Posted: Thu, 03 Aug 2006 10:22:42 Post Subject:

Yea... Keep thinking that. These guys did this at Blackhat. It has been confirmed.

Matter of fact one of the guys I work with was there.

mrweasel · Posted: Thu, 03 Aug 2006 11:45:42 Post Subject:

I bet that is patched today....and besides, they found the same holes in Windows boxes, but they just wanna pick on us Mad

That's okay, we'll get even!

acruxksa · Posted: Thu, 03 Aug 2006 13:34:57 Post Subject:

**Doctor Feelgood** · Posted: Thu, 03 Aug 2006 13:38:09 Post Subject:

There is a follow up on that BLOG today...

http://blog.washingtonpost.com/securityfix/2006/08/followup_to_macbook_post.html

Hellfire · Rated XXX Joined: 05 Aug 2003 Posts: 3473

I love this comment from today's update (assuming it's accurate):
...that over 200 vulnerabilities have been discovered for OS X in the past two years while fewer than a hundred have been discovered for XP in that time. The XP vulnerabilities have been successfully exploited while those for OS X have not.

It's obvious why the Xp exploits are used, and not the OS X ones have not...why would somebody want to work on an exploit for 10-15% of the machines, when they could do it for 70% of the computers Razz

thePMG · Rated XXX Joined: 24 Apr 2004 Posts: 393 Location: Germany

BeerCheeze · Posted: Wed, 09 Aug 2006 22:12:16 Post Subject:

Sorry guys... I was there at Defcon. This is real. Call BS all you want and stick your head into the sand and pretend it doesn't exist. But it does.

It actually has NOTHING to do with the Mac, or Windows. It's a driver issue. The way drivers interact with the system is they have Ring 0 level access (kernel mode).

Why a video? Simple... they asked the question in the audience.. "How many people right now have a scanner running?" There was a murmured laugh, and a hand or two raised (trust me more should have). And THAT is why they did it on video, it's because if they would have done it live, the exploit would have already been in the wild.

The people that we're showing this were legit security people. Also trust me... you don't pull the BS at that level that is required at Blackhat and/or Defcon. You WILL get called on it.