"Anyone who wished it was given a local account on the machine (which could be accessed via ssh). Yes, there are local privilege escalation vulnerabilities; likely some that are 'unpublished'. But this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box. That is a huge distinction." Local accounts could allow hackers to exploit many 'unpublished' (as noted by the "gwerdna" hacker) and older known security vulnerabilities that Apple has not yet addressed. However, most users will not offer hackers these accounts, thus dramatically distorted the overall security picture of Mac OS X, according to Schroeder. The challenge invites hackers to alter the web page at test.doit.wisc.edu, hosted on PowerPC-based Mac mini running Mac OS X 10.4.5 with Security Update 2006-001 and two local accounts; the creators note that the machine has both SSH and http ports open, which is "a lot more than most Mac OS X machines will ever have open."