Security researcher hacks Mac in just under 10 seconds!
It was Charlie Miller's day again! The security researcher known for hacking a Mac in just 2 minutes at CanSecWest's PWN2OWN contest last year - Charlie Miller improved his record by hacking a Mac in just under 10 seconds, at this year's CanSecWest security conference, on Wednesday.
Charlie Miller won $10,000 hacking a MacBook Air last year, but he won a $5,000 cash prize, along with the MacBook he hacked this year. Miller is presently principal security analyst at Independent Security Evaluators.
Just after he won the contest, Miller asserted, "I can't talk about the details of the vulnerability, but it was a Mac, fully patched, with Safari, fully patched. It probably took 5 or 10 seconds."
Miller told that he exploited a security hole Safari to win the contest. He admitted that he had researched and written the exploit before he came to the contest. He disclosed that he discovered the Safari security hole last year. He detailed that the security hole can be exploited by a remote hacker to get control of a computer simply by making a computer user click on a malicious URL. He said, "It's not easy, but this worked with one click (from the Safari browser)."
According to rules of CanSecWest's PWN2OWN contest, the participant research hackers can provide URLs that they intend to use for their hacks or attacks; the most common way used by real attackers to lure the victims to sites hosting malware programs.
Miller said, "I gave them the link, they clicked on it, and that was it. I did a few things to show that I had full control of the Mac." However, he declined to reveal the details of the exploit, as the contest rules prevented him from doing so. He told that he had already informed Apple representatives what he was going to do in the contest. He said, "They're happy because they get free research and get a bug fixed." He said that the contest organizers will share details on the exploit with Apple and develop a patch for it.
Miller had declared "Safari running on the Mac would be the first to fall," two weeks ago. In 2007, he detected a security hole in the mobile version of Safari shortly after the iPhone was launched.
Sponsored by 3Com Inc.'s TippingPoint unit, the PWN2OWN contest awarded $5,000 for each new exploit demonstrated in the major browsers and $10,000 for each successful exploit in the major smartphones. Later in the day at CanSecWest security conference, $15,000 were won by a 25-year-old computer science student from the University of Oldenburg in Germany, for demonstrating hacks in IE 8, Safari, and Firefox.
Terri Forslof, the manager of security response at TippingPoint, told that another researcher later hacked a Sony laptop that was running Windows 7 by exploiting a security hole in IE8. She said, "Safari and IE both went down."