Risk
3/28/2008
10:53 AM
Keith Ferrell
Keith Ferrell
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Hacker Contest: And The Loser Is... MacBook Air

The hacker contest at this year's CanSecWest Conference in Vancouver has produced a winner... er, a loser. The hack--ee? Pricey, trendy and oh so desirable MacBook Air.

The hacker contest at this year's CanSecWest Conference in Vancouver has produced a winner... er, a loser. The hack--ee? Pricey, trendy and oh so desirable MacBook Air.The first results are in from the hacker contest I told you about last week.

And, as noted in the bMighty ANTenna this morning, the first hacked laptop (of three, each with a different OS -- Mac, Windows, Linux) was a MacBook Air.

A Safari browser vulnerability proved the Air's downfall.

And proved it fast -- the hackers needed barely two minutes to pull off their exploit and walk away with $10,000 -- and the Air.

Two minutes! Barely more time than it took a falling Charlie Rose to smash his face while keeping from smashing his Air.

Apple has been notified of the vulnerability.

The Windows and Linux machines have so far remained unhacked, but that probably won't last long.

Longer than two minutes, though.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.