Hack challenge QuickTime bug not on the loose

Organizers of last week's MacBook Pro hack challenge Thursday disputed accounts that the QuickTime [ArtId:1226260016|exploit]] that won the US$10,000 prize was nicked from a wireless network and is now in circulation.

"Not likely," said Dragos Ruiu, one of the CanSecWest and hack contest organizers. "Everything went over a wired network. It was in a locked cabinet, so it would have to have been physically compromised."

When asked about the chance that the exploit could now be in the hands of anyone other than 3com TippingPoint -- the company that paid $10,000 for the code; its creator, Dino Dai Zovi; and Apple, Ruiu said: "Slim." Dai Zovi's exploit for the QuickTime vulnerability is very serious," security researchers have said. To make matters worse, unconfirmed reports surfaced Wednesday that others might have captured the exploit while the MacBook Pro was being attacked. In a blog entry, Thomas Ptacek, a researcher at Matasano Security, a New York-based security consultancy, said: "Raw packet captures of the successful exploit have been taken by parties unknown."

Later in the day, Ptacek retracted his claim after another CanSecWest organizer posted a comment to the Matasano blog. "Someone may have reverse-engineered the vulnerability but they didn't pull it off the network there," wrote someone identified as "toby."

"The network was very simple: a WAP [wireless access point] that was connected to a hub and to the router to provide Internet access. The Macs sat on the hub and the only other systems on there were the ones we used to monitor the network to ensure rules were followed. The WAP was routing traffic from the hub to the Internet, not sending it out over the wireless network.

"We were sniffing the traffic on the wireless network and would have noticed if it had been getting traffic from the wired side," toby said.

Ruiu confirmed the setup. "Even the guy who ran the exploit sent it over the wired network," he said.

Throughout Wednesday, Ptacek tried to get the researcher who claimed to have snared Dai Zovi's exploit to confirm his findings, but to no avail. On the Information Security Sell Out blog, Ptacek asked for details, but the blog writer answered: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not."

That exchange and others led Ptacek to write on the Matasano site last night: "The bulk of the 'it leaked!' leads in this soap opera are not panning out, fortunately for all involved."

Dai Zovi's discovery, if or when it does make it into the wild, threatens users of any browser that's Java enabled, TippingPoint has said. Until Apple patches QuickTime, the only sure defense is to disable Java in the browser.

Apple has not posted a fix or said when it would do so.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email ARN
• Follow ARN on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark