Pwn2Own MacBook hacked in seconds
updated 10:40 pm EDT, Wed March 18, 2009
MacBook hacked in seconds
For the second year in a row, Charlie Miller has won the Pwn2Own contest by hacking into a MacBook in less time than competitors, according to ZDNet. For the recent event, he quickly compromised Apple's fully patched notebook by exploiting a security vulnerability in Safari. "It took a couple of seconds," he said. "They clicked on the link and I took control of the machine."
Miller said he had planned to hack into Safari, previously testing the exploit to make sure it "worked the first time" before arriving at the CanSecWest conference. The attack netted him a $10,000 purse, along with the hacked MacBook.
The speed of the hack was much quicker than his performance last year that took two minutes, while participants required nine hours the year before to break into a MacBook Pro.
Under the terms of the competition, TippingPoint's Zero Day Initiative received full rights to the vulnerability. Miller is restricted from providing further details until Apple has a chance to release a patch.
Junior Member
Joined: Jan 2007
Clearly
it is possible.
While it does require a user to click a particular link, it might be "somewhat" more difficult to get a specific target to click the link, it is not impossible.
It might take minutes, hours or days, depending on your social engineering skills, but it is possible.
Man in the middle might take less time, or perhaps some sort of temporary dns hijack?
I don't know. Maybe it's harder than I think. Or is it?