MacDailyNews - Where Mac news comes first

 MacDailyNews Poll

Deal of the Day

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Sat, Nov 07, 2009 - 09:04 PM EST  —  AAPL: 194.34 (+0.3099, +0.16%)  |  NASDAQ: 2112.44 (+7.12, +0.34%)

Apple Mac remains ‘unhacked’ as University of Wisconsin’s Mac OS X Security Challenge ends
Wednesday, March 08, 2006 - 08:42 AM EST

The testing period for the Mac OS X Security Test is now closed. "Originally, the online event was scheduled to end on Friday. But because of the enormous attention, the time for the challenge has been cut short and will now end Tuesday at 10 p.m. PST, Schroeder said," Joris Evers reports for CNET News. "Schroeder plans to sift through the log files of the Mac and publish anything interesting, he said in the phone interview. 'I know it is disappointing that it will be ending early to a lot of people.'" Full article here.

In response to the woefully misleading ZDnet article, Mac OS X hacked under 30 minutes, by Munir Kotadia () the academic Mac OS X Security Challenge was launched Monday morning by The University of Wisconsin's Dave Schroeder. The ZDNet FUD piece failed to mention that local access was granted to the Mac OS X system and left some readers with the false impression that any Mac OS X machine connected to the Internet can be taken over in just 30 minutes. As Schroeder notes, the Mac OS X "machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction."

So, with a real Mac OS X challenge sitting online, 30 minutes came and went, folks. Long ago. The Mac OS X remained "unhacked" for the entire 38-hour testing period.

Schroeder's notes from 11:59pm CST last night:
• The response has been very strong, and the test has illustrated its point.
• Traffic to the host spiked at over 30 Mbps.
• Most of the traffic, aside from casual web visitors, was web exploit scripts, ssh dictionary attacks, and scanning tools such as Nessus.
• The machine was under intermittent DoS attack. During the two brief periods of denial of service, the host remained up.
• The test machine was a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, had two local accounts, and had ssh and http open with their default configurations.
• There were no successful access attempts during the 38 hour duration of the test period.

More info here.

[Thanks to MacDailyNews Reader "Judge Bork" for the heads up.]

[UPDATE: 9:12am EST: Added CNET info and link.]

Advertisements:
Apple's brand new iPod Hi-Fi speaker system. Home stereo. Reinvented. Available now for $349 with free shipping.
Apple's new Mac mini. Intel Core, up to 4 times faster. Starting at just $599. Free shipping.
MacBook Pro. The first Mac notebook built upon Intel Core Duo with iLife ’06, Front Row and built-in iSight. Starting at $1999. Free shipping.
iMac. Twice as amazing — Intel Core Duo, iLife ’06, Front Row media experience, Apple Remote, built-in iSight. Starting at $1299. Free shipping.
iPod Radio Remote. Listen to FM radio on your iPod and control everything with a convenient wired remote. Just $49.
iPod. 15,000 songs. 25,000 photos. 150 hours of video. The new iPod. 30GB and 60GB models start at just $299. Free shipping.
Connect iPod to your television set with the iPod AV Cable. Just $19.

Related MacDailyNews articles:
Mac OS X 'unhacked' over 24 hours and counting in genuine security challenge - March 07, 2006
University of Wisconsin launches bona fide Mac OS X Security Challenge - March 06, 2006
Mac OS X 'hacked in under 30 minutes?' Why Mac OS X security is all the rage recently - March 06, 2006
Spate of recent Mac security stories signal that Microsoft, others getting nervous - March 06, 2006
Apple Mac OS X clearly offers superior security over Microsoft Windows - March 02, 2006
Apple Mac OS X has a lot more vulnerabilities than Windows XP? - February 28, 2006
Enderle: Security vendors see Apple as next big opportunity - February 28, 2006
As Apple Mac grows in popularity, will security issues increase? - February 27, 2006
The Idiot's Guide to Mac Viruses For Dummies 101 - February 24, 2006
Wired News: 'Mac attack a load of crap' - February 22, 2006
Report: Apple developing fix for automatic execution of shell scripts - February 21, 2006
Ars Technica: Fears over new Mac OS X 'Leap-A' trojan pointless - February 20, 2006
Atlanta Journal-Constitution asks: Is 'Mac virus' all just propaganda from Mac haters? - February 20, 2006
Mafiasoft: Microsoft to charge $50 per year for security service to protect Windows - February 07, 2006
ZDNet Australia publishes latest Mac OS X security FUD article - January 26, 2006 (Kotadia)
IDC: Apple Mac 2005 U.S. market share 4% on 32% growth year over year - January 20, 2006
Analysts: Apple Mac's 5% market share glass ceiling set to shatter in 2006 - January 09, 2006
ZDNet Australia publishes latest Mac OS X security FUD article - September 09, 2005 (Kotadia)
Joke of the month: Gartner warns of Mac OS X 'spyware infestation' potential - March 30, 2005 (Kotadia)
Symantec warns about Mac OS X security threat - March 21, 2005 (Kotadia)

Bookmark and Share

Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: = registered.
Unregistered users: Feedback from multiple usernames are subject to deletion. Off-topic and posts from suspected astroturfers will be removed.

Mar 08, 06 - 08:54 am Comment from: Ampar

And this will get very little notice by "mainstream" online press outlets. It's too positive. So many tech. analysts are too wrapped up in their own cognitive dissonance.

Mar 08, 06 - 08:58 am Comment from: Jeff

OK, let's make sure the Media outlets hear about this result.

Mar 08, 06 - 09:00 am Comment from: jay

Other than what I presume would be the loss of use of the Mini for the test (or would it?), does anyone know why it ended after only 38 hours? I would have liked to have seen the results at 38 days or longer. And I agree, it'll be intersting to see what press coverage this test gets.

Mar 08, 06 - 09:03 am Comment from: R

Mini computer, big cojones.

Mar 08, 06 - 09:04 am Comment from: ZDnet

They have been exposed as the agenda drive org. that they are.....

Mar 08, 06 - 09:05 am Comment from: carlo

ZDnet you are nothin but big, fat, stinky beatches baby!!!!!

Mar 08, 06 - 09:09 am Comment from: Macs King

The test ended because it was drawing so many hits and sucking bandwidth like crazy, the University IT dept had to be going nuts with all the activity.

From info I got at the site their bandwidth usage was roughly equal to streaming native DV out to the Internet, 3.75 Megabytes per second.

There were also getting hammered by a couple of DoS (denial of service) attacks.

The good news is, nobody was able to mod the mini and even with all the traffic slamming it the machine never went down.

Pretty amazing for a $499 computer running a stock OS without any 3rd party protection software.

Lets have a Reality Check on this, get a University to put up a Windows box and see if it can be exploited!

Mar 08, 06 - 09:10 am Comment from: andy

and...breathe

Mar 08, 06 - 09:13 am Comment from: Nuclear Kid

Loving It!

Mar 08, 06 - 09:14 am Comment from: war

The theory that the media is too easy on Apple can now be laid to rest because we all know this story won't see the light of day. It is only when supposed security "flaws" are found that the media cares. I wish people would realize that mac users aren't zealots they just have to defend their platform from obvious media bias.

Mar 08, 06 - 09:15 am Comment from: cedreca

Now, let's see if Cnet or ZDnet will even mention this results.
This in contrast with other studies that show that the average Windows XP PC will be hacked in their firts 30 mins online.
Anti-Mac advocates shouldn't throw stones at our ceiling when their's is made of glass, and a cheapone at that...!

Mar 08, 06 - 09:16 am Comment from: MacDude

None of the black hats truly responded because of the conditions of the test.

Only a fool gives up their secrets.


Dave Schroeder created this publicty stunt and to insure it succeeded he came right out and stated it would be monitored, ip's recorded and Apple told of any successful hack methods.

Really fine way to temp people who really know what their doing.

Jacka$$.

Mar 08, 06 - 09:17 am Comment from: Ampar

I suffered from a DOS attack a long time ago. And switched to the Mac! (back when DOS meant amber screens, command lines, some pretty clever ASCII art and 300 baud was the norm)

Mar 08, 06 - 09:19 am Comment from: Drunk Cheney

Take that CNET. You and your phony stories - anti-Mac and Pro Windows selves.

I think it's time for CNET to eat some crow.

Mar 08, 06 - 09:23 am Comment from: Ampar

How do you temp people? Force them to take part time jobs?

Mar 08, 06 - 09:25 am Comment from: jay

Macs: Thanks.

Mar 08, 06 - 09:33 am Comment from: idiot

macdude is an idiot...
you have to sign up to get on there..
im sure some guy who could hack osx was just like.. no.. cant do it.. gotta look out for my pride.
Right!

Mar 08, 06 - 09:37 am Comment from: Macaday

MacDude - you are one big joke.

Go away.

Mar 08, 06 - 09:43 am Comment from: jay

The ZDNet stunt was for bragging rights, not an attempt for monetary gain, which is always the excuse given for a lack of interest in trying to crack OS X, as there are fewer machines out there to crack and exploit for monetary gain.

If the temptation to be the first to successfully compromise OS X using a fairly real-world scenario isn't tempting enough for the blackhat community, what the hell does it take?

Mar 08, 06 - 09:48 am Comment from: MacMania

Kudos to UW!

So much for the Mafiasoft lapdog, FUD rakers!

I now very, very skeptical of anything I read in newspapers and other journals, on ANY topic. Who knows what their agenda is?

raspberry

Mar 08, 06 - 09:53 am Comment from: MacMania

Dear MDN,

Can you please go Web 2.0 like Digg.com so we can KILL bullshit from the trolls like "MacDude"?

With all the ad revenue you get, it should be feasible.

Cheers!
MacMania

Mar 08, 06 - 09:57 am Comment from: Marty

Your being conned.

Think about it most Mac users upgrade their operating system from a previously insecure version.

Right?

Mar 08, 06 - 10:00 am Comment from: jay

Marty, you're right; I did, anyway. It was known as XP Pro.

Mar 08, 06 - 10:03 am Comment from: macromancer

CNet is actually reporting this story and mentioning the earlier test was rigged to be too easy, which surprises me.

I was just reading it but I had to leaf by two other FUD stories to get to it, One titled "You hate your iPod" and "MacBook Pro comes up short" in order to get to it.

CNet is nothing more than a Microsoft FUD machine and anything they say should be taken with a grain of salt.

Mar 08, 06 - 10:03 am Comment from: Affy

Yeah, they could have had a stock standard PC with all the MS dross included sitting beside the Mini and see what happened?

Mar 08, 06 - 10:04 am Comment from: john

Ahhhh.mmm.... just as I thought. Put a real test out there and suddenly that easy 30 minute hack job became impossible! I myself had no doubt that no one would get in even if he left the test go on until the end of the year!

So much for the myth ZDNET story that OSX is not secure. Maybe next time they'll get all the facts before they write there fairy tales!

Mar 08, 06 - 10:07 am Comment from: MacDude

There were also getting hammered by a couple of DoS (denial of service) attacks.

The whole University network got slammed because of a "Slashdot effect."

It happens a lot because of all the hit traffic that site recieves daily.

http://apple.slashdot.org/article.pl?sid=06/03/07/1324256&from=rss

Mar 08, 06 - 10:15 am Comment from: RJS

What happens to Windows XP "out of the box" in 38 hours? Nice to see a comparison... Is there one around?

Mar 08, 06 - 10:22 am Comment from: MacDude

Can you please go Web 2.0 like Digg.com so we can KILL bullshit from the trolls like "MacDude"?

Your the troll, I was making a valid point that the test was flawed.

If you want to be moderated to death go to Apple Discussions or go to MacSlash and listen to the echos.

Echos don't click ads.

Mar 08, 06 - 10:29 am Comment from: doPi

Can you please go Web 2.0 like Digg.com so we can KILL bullshit from the trolls like "MacDude"?
MacMania

Let it be MM, it allows freedom of expression so that you too can say whatever you want regardless if we agree with you or not-
Does the term :democratic" ring a bell?

Mar 08, 06 - 10:31 am Comment from: Literate

The ZDNet article did not "fail to mention" that local access was given. It's mentioned in the second freakin' paragraph!

For those who didn't read the actual article (probably quite a lot of people judging from all the responses), the second paragraph reads:

"Participants were given local client access to the target computer and invited to try their luck."

MDN, any idea what local client access means? It means they were given a local account. Any UNIX sys admin with half a brain should have caught that.

So everyone please, stop saying that they didn't mention that local access was given. That disclaimer is in the first 100 words.

MDN Magic Word "final"

Mar 08, 06 - 10:41 am Comment from: iDon't

MacDude made a valid point "the test was flawed." If I had the ability to hack a Mac there is now way I would do it during a test that is monitored, the IP's are recorded and Apple being notified of successful hacks. But that's just me.

Mar 08, 06 - 10:49 am Comment from: :rolleyes:

"The ZDNet article did not "fail to mention" that local access was given. It's mentioned in the second freakin' paragraph!"

Guess you were late to the party. wink

That second paragraph you refer to was ADDED AFTER the article was released and picked up by AP and others. The original story made absolutely NO MENTION of the fact that this machine was hacked from the INSIDE by someone with USER ACCESS.

It was inferred that the Mac was on the Internet when it was brought down by a hacker from the outside, in under 30 minutes.

BIG DIFFERENCE!

Maybe it is you that should bother digging a little deeper before sounding off eh? wink

Mar 08, 06 - 11:00 am Comment from: Wingsy

Literate - The original ZDNet article did NOT have that paragraph in it. It was only after they got raked over the coals on their forum did they go back and add that paragraph. But by then a great deal of damage was already done.

Mar 08, 06 - 11:12 am Comment from: AlanAudio

I understand the explanation given for shortening the challenge period, but the unfortunate side effect of that is that it allows naysayers to claim that the challenge didn't run it's course and was pulled ahead of time.

Perhaps somebody could arrange for a similar challenge to be made on a Mac where it would be acceptable to leave it running for longer while attracting so much attention.

Mar 08, 06 - 05:03 pm Comment from: Zillatron

Where is the ZDnet 'News Alert'!??

Z

Mar 08, 06 - 05:30 pm Comment from: Rory

uh oh....

going to: http://test.doit.wisc.edu/

now says:

"Yesterday we discovered the Mac OSX "challenge" was not an activity authorized by the UW-Madison. Once the test came to the attention of our CIO, she ended it. The site, test.doit.wisc.edu, will be removed from the network tonight. Our primary concern is for security and network access for UW services. We are sorry for any inconvenience this has caused to the community. "

Mar 08, 06 - 10:23 pm Comment from: Majikthize

Umm, I'm no expert on hacking. But, wouldn't a competent hacker have a relatively easy time masking his IP address? If I'm right, fear of discovery due to IP logging would not be a disincentive for would-be challengers.

Reader feedback page 1 of 1 pages:

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my info   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: