4 ms·

Taking down the Mac gets you the best laptop and the most press. Simple. It would be different if the other OS/browsers didn't go down too, but because the Mac

by YooLi 16y ago

Taking down the Mac gets you the best laptop and the most press. Simple. It would be different if the other OS/browsers didn't go down too, but because the Mac is always first to go just means it's the most desirable target.

kenjackson 16y ago
I think the $15,000 cash prize and PR with being first, regardless of OS/browser, plays larger than the delta between getting a high PC laptop and a MBP. And it's not like they don't already have Macs -- that's how they developed their OS X exploit. UPDATE: It's actually a MacBook Air 13", not MBP. The other laptops are ASUS G73SW and Alienware M11x.
trotsky 16y ago
Taking down chrome would definitely get you the most trade press by far. Just sayin'
latch 16y ago
I can see how you associate it being the least secure with it being the most awesome. I don't see what could go wrong with your ability to take some legitimate and important criticism about something you like and turn it into something awesome about said thing. Mac's always go down quickly in these contests. The people who make it happen often say that its considerably easier. edit: Charlie Miller: "It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier." - http://www.zdnet.com/blog/security/questions-for-pwn2own-hacker-charlie-miller/2941 http://www.zdnet.com/blog/security/questions-for-pwn2own-hac...
- icarus_drowning 16y ago
  The existence of the vulnerability itself is now obvious-- no one is arguing against it. (And thus, I don't think anyone's arguing that a fully-patched OS X system is fully impenetrable). But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. Personally, I'm quite sure that the Windows machines are at this point far more secure, simply because Microsoft takes so much battering by being in the dominant position. But I wouldn't use this as evidence for it. EDIT: Question about your quote-- later in that article, Miller suggests that there is no "randomization" in OS X, while this year's article says his exploit bypassed ASLR in OS X-- is this a new feature in OS X that wasn't present in 2009?
  - recoiledsnake 16y ago
    >Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. >But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. That's just weak, the prizes were $15,000 even for IE8 and Google was offering $20K. How many Macbooks can you get for $15K or $20K ? http://www.computerworld.com/s/article/9207939/Google_bets_20K_that_Chrome_can_t_be_hacked http://www.computerworld.com/s/article/9207939/Google_bets_2... The easiest way to get a lot of Macbooks would be to exploit the easy software to hack and just buy them from the store.
    - trotsky 16y ago
      Historically this was more of a factor though - it's definitely something Miller has mentioned as being a part of his decision making. The prize structure has changed a lot: in 2009 Tipping Point offered $5,000 + the machine, in 2010 it was $10,000 + the machine and now it's $15,000 + the machine.
      - recoiledsnake 16y ago
        The other laptops have been decent too. The Chrome netbook would be a novelty to show people and Alienware/Sony VAIO machines are not bad at all.
    - YooLi 16y ago
      You're looking at it wrong. Why spend $1200 on an Air of the $15000 when you can keep the whole $15k and get an Air. You get $15k with both, difference is if you want the Air on top of that or not.
  - latch 16y ago
    It's my understanding that ASLR has been in OSX since 10.5, but its a poor (in comparison) implementation. Interestingly, the recently released iOS 4.3 has it. I really don't think that these security researchers as prioritizing based on winning a $1200 laptop. Given that this competition is time-based, I'd, again, say that they prioritize based on speed.
- rbanffy 16y ago
  > I can see how you associate it being the least secure with it being the most awesome In fact he associated the fact of being the most awesome and generating the most media coverage with the fact it would be the first to fall, regardless of how secure or not the computer is.
- tzs 16y ago
  Wait...are you under the impression that the hacks are developed on the spot when the challenger steps up to the computer? In fact, they are developed far in advance. The order the browsers fall is determined by the order the challengers get to demonstrate their hacks.
wisty 16y ago
That's simply not true. Macs are often said to be easier to take down. However, a vulnerability on the Mac isn't worth as much (on the black-market) as a vulnerability on Windows. So people keep trying to break Windows. Even if you tried to sell a Mac vulnerability, the people who make botnets wouldn't be interested, as they can buy Windows vulnerabilities instead. pwn2own is the only show in town where a Mac vulnerability is worth roughly the same as a Windows one.
statictype 16y ago
but because the Mac is always first to go just means it's the most desirable target I suppose being the easiest target couldn't possibly be a reason, could it? You're one of those people that cause others to label Mac users as zealots suffering from cognitive dissonance, aren't you?

by YooLi 16y ago

kenjackson 16y ago

I think the $15,000 cash prize and PR with being first, regardless of OS/browser, plays larger than the delta between getting a high PC laptop and a MBP. And it's not like they don't already have Macs -- that's how they developed their OS X exploit. UPDATE: It's actually a MacBook Air 13", not MBP. The other laptops are ASUS G73SW and Alienware M11x.

trotsky 16y ago

Taking down chrome would definitely get you the most trade press by far. Just sayin'

latch 16y ago

I can see how you associate it being the least secure with it being the most awesome. I don't see what could go wrong with your ability to take some legitimate and important criticism about something you like and turn it into something awesome about said thing. Mac's always go down quickly in these contests. The people who make it happen often say that its considerably easier. edit: Charlie Miller: "It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier." - http://www.zdnet.com/blog/security/questions-for-pwn2own-hacker-charlie-miller/2941 http://www.zdnet.com/blog/security/questions-for-pwn2own-hac...

icarus_drowning 16y ago
The existence of the vulnerability itself is now obvious-- no one is arguing against it. (And thus, I don't think anyone's arguing that a fully-patched OS X system is fully impenetrable). But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. Personally, I'm quite sure that the Windows machines are at this point far more secure, simply because Microsoft takes so much battering by being in the dominant position. But I wouldn't use this as evidence for it. EDIT: Question about your quote-- later in that article, Miller suggests that there is no "randomization" in OS X, while this year's article says his exploit bypassed ASLR in OS X-- is this a new feature in OS X that wasn't present in 2009?
- recoiledsnake 16y ago
  >Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. >But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. That's just weak, the prizes were $15,000 even for IE8 and Google was offering $20K. How many Macbooks can you get for $15K or $20K ? http://www.computerworld.com/s/article/9207939/Google_bets_20K_that_Chrome_can_t_be_hacked http://www.computerworld.com/s/article/9207939/Google_bets_2... The easiest way to get a lot of Macbooks would be to exploit the easy software to hack and just buy them from the store.
  - trotsky 16y ago
    Historically this was more of a factor though - it's definitely something Miller has mentioned as being a part of his decision making. The prize structure has changed a lot: in 2009 Tipping Point offered $5,000 + the machine, in 2010 it was $10,000 + the machine and now it's $15,000 + the machine.
    - recoiledsnake 16y ago
      The other laptops have been decent too. The Chrome netbook would be a novelty to show people and Alienware/Sony VAIO machines are not bad at all.
  - YooLi 16y ago
    You're looking at it wrong. Why spend $1200 on an Air of the $15000 when you can keep the whole $15k and get an Air. You get $15k with both, difference is if you want the Air on top of that or not.
- latch 16y ago
  It's my understanding that ASLR has been in OSX since 10.5, but its a poor (in comparison) implementation. Interestingly, the recently released iOS 4.3 has it. I really don't think that these security researchers as prioritizing based on winning a $1200 laptop. Given that this competition is time-based, I'd, again, say that they prioritize based on speed.
rbanffy 16y ago
> I can see how you associate it being the least secure with it being the most awesome In fact he associated the fact of being the most awesome and generating the most media coverage with the fact it would be the first to fall, regardless of how secure or not the computer is.
tzs 16y ago
Wait...are you under the impression that the hacks are developed on the spot when the challenger steps up to the computer? In fact, they are developed far in advance. The order the browsers fall is determined by the order the challengers get to demonstrate their hacks.

wisty 16y ago

That's simply not true. Macs are often said to be easier to take down. However, a vulnerability on the Mac isn't worth as much (on the black-market) as a vulnerability on Windows. So people keep trying to break Windows. Even if you tried to sell a Mac vulnerability, the people who make botnets wouldn't be interested, as they can buy Windows vulnerabilities instead. pwn2own is the only show in town where a Mac vulnerability is worth roughly the same as a Windows one.

statictype 16y ago

but because the Mac is always first to go just means it's the most desirable target I suppose being the easiest target couldn't possibly be a reason, could it? You're one of those people that cause others to label Mac users as zealots suffering from cognitive dissonance, aren't you?