3 ms·

The existence of the vulnerability itself is now obvious-- no one is arguing against it. (And thus, I don't think anyone's arguing that a fully-patched OS X sys

The existence of the vulnerability itself is now obvious-- no one is arguing against it. (And thus, I don't think anyone's arguing that a fully-patched OS X system is fully impenetrable). But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. Personally, I'm quite sure that the Windows machines are at this point far more secure, simply because Microsoft takes so much battering by being in the dominant position. But I wouldn't use this as evidence for it. EDIT: Question about your quote-- later in that article, Miller suggests that there is no "randomization" in OS X, while this year's article says his exploit bypassed ASLR in OS X-- is this a new feature in OS X that wasn't present in 2009?

recoiledsnake 16y ago
>Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. >But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. That's just weak, the prizes were $15,000 even for IE8 and Google was offering $20K. How many Macbooks can you get for $15K or $20K ? http://www.computerworld.com/s/article/9207939/Google_bets_20K_that_Chrome_can_t_be_hacked http://www.computerworld.com/s/article/9207939/Google_bets_2... The easiest way to get a lot of Macbooks would be to exploit the easy software to hack and just buy them from the store.
- trotsky 16y ago
  Historically this was more of a factor though - it's definitely something Miller has mentioned as being a part of his decision making. The prize structure has changed a lot: in 2009 Tipping Point offered $5,000 + the machine, in 2010 it was $10,000 + the machine and now it's $15,000 + the machine.
  - recoiledsnake 16y ago
    The other laptops have been decent too. The Chrome netbook would be a novelty to show people and Alienware/Sony VAIO machines are not bad at all.
- YooLi 16y ago
  You're looking at it wrong. Why spend $1200 on an Air of the $15000 when you can keep the whole $15k and get an Air. You get $15k with both, difference is if you want the Air on top of that or not.
latch 16y ago
It's my understanding that ASLR has been in OSX since 10.5, but its a poor (in comparison) implementation. Interestingly, the recently released iOS 4.3 has it. I really don't think that these security researchers as prioritizing based on winning a $1200 laptop. Given that this competition is time-based, I'd, again, say that they prioritize based on speed.
darren_ 16y ago
ASLR was in 10.5 and 10.6 but it's not a good implementation at all (in particular the dynamic linker isn't randomized, and has plenty of useful code in it to play with, rendering the randomization basically pointless). Most ASLR bypasses are when someone's found an application that includes one or more images that was compiled without randomization support and thus has a predictable load address and code to use; with OS X you get one for free in every application by default. 10.7 is supposed to have better ASLR, haven't investigated yet though.

recoiledsnake 16y ago

>Did Safari fall first because it is the least secure, or because it is the hardware everyone wants to win? It really is difficult, if not impossible to tell. >But the fact that the winner gets to keep the hardware certainly has a lot to do with which target they choose to attack. That's just weak, the prizes were $15,000 even for IE8 and Google was offering $20K. How many Macbooks can you get for $15K or $20K ? http://www.computerworld.com/s/article/9207939/Google_bets_20K_that_Chrome_can_t_be_hacked http://www.computerworld.com/s/article/9207939/Google_bets_2... The easiest way to get a lot of Macbooks would be to exploit the easy software to hack and just buy them from the store.

trotsky 16y ago
Historically this was more of a factor though - it's definitely something Miller has mentioned as being a part of his decision making. The prize structure has changed a lot: in 2009 Tipping Point offered $5,000 + the machine, in 2010 it was $10,000 + the machine and now it's $15,000 + the machine.
- recoiledsnake 16y ago
  The other laptops have been decent too. The Chrome netbook would be a novelty to show people and Alienware/Sony VAIO machines are not bad at all.
YooLi 16y ago
You're looking at it wrong. Why spend $1200 on an Air of the $15000 when you can keep the whole $15k and get an Air. You get $15k with both, difference is if you want the Air on top of that or not.

latch 16y ago

It's my understanding that ASLR has been in OSX since 10.5, but its a poor (in comparison) implementation. Interestingly, the recently released iOS 4.3 has it. I really don't think that these security researchers as prioritizing based on winning a $1200 laptop. Given that this competition is time-based, I'd, again, say that they prioritize based on speed.

darren_ 16y ago

ASLR was in 10.5 and 10.6 but it's not a good implementation at all (in particular the dynamic linker isn't randomized, and has plenty of useful code in it to play with, rendering the randomization basically pointless). Most ASLR bypasses are when someone's found an application that includes one or more images that was compiled without randomization support and thus has a predictable load address and code to use; with OS X you get one for free in every application by default. 10.7 is supposed to have better ASLR, haven't investigated yet though.