Daring Fireball’s Gruber issues public challenge to ‘60-second MacBook hijackers’

“I’m issuing the following challenge to David Maynor and Jon Ellch,” John Gruber writes for Daring Fireball.

If you can hijack a brand-new MacBook out of the box, it’s yours to keep.

Gruber writes, “I don’t expect to lose this particular bet — but I don’t expect to win it, either. I expect to be ignored. I don’t think Maynor and Ellch have discovered such a vulnerability in the default MacBook AirPort card and driver, and so, if I’m right, they certainly won’t accept this challenge. I think what they’ve discovered — if they’ve in fact discovered anything useful at all — is a class of potential Wi-Fi-based exploit, which they demonstrated on a rigged MacBook to generate publicity at the expense of the Mac’s renowned reputation for security, but that they have not found an actual exploit based on this technique that works against the MacBook’s built-in AirPort.”

“If I’m wrong, and they have discovered such a vulnerability, they may or may not choose to accept this challenge. But it’s a bet that they’ll only accept if they can win,” Gruber writes. “It comes down to this. If I’m wrong, it’d be worth $1099 to know that MacBook users are in fact at risk. And if I’m right, someone needs to call Maynor and Ellch on their bullshit.”

Full article, with Gruber’s stipulations for the challenge, here.

[Thanks to MacDailyNews Reader “BuriedCaesar” and “Rainy Day” for the heads up.]

Related MacDailyNews articles:
The curious case of the supposed Apple MacBook Wi-Fi hack – August 21, 2006
SecureWorks admits falsifying Apple MacBook ‘60-second wireless hijacking?’ – August 18, 2006
Re: Brian Krebs’ reporting on supposed MacBook Wi-Fi exploit – August 04, 2006
Hijacking an Apple Macbook in 60 seconds video posted online – August 03, 2006
Hijacking an Apple Macbook in 60 seconds – August 02, 2006

28 Comments

  1. <i>I took</b> the fool Goober up on his offer, but he declined saying he want’s to show David and Jon for the frauds they are.

    He said he couldn’t just give a MacBook away to everyone.

    But he tried to pick my brain, but I said it would cost him a MacBook to find out.

    By the way, if he’s holding the challenge exactly like he says, he better check what version of Mac OS X is on those new MacBooks first.

    There is quite a few holes in 10.4.6.

  2. I am in a security mailing list and the hack does NOT WORK!

    The reason it was used with the MacBook having the USB card active AND the internal Airport active at same time is that the hack they discovered on the driver for the USB card (not discovered on the Airport driver) makes the USB connection die after it has received the hack packet. Then the connection with the Airport is used in order to keep the network alive with the malicious host.

    Currently, what the hack would do, if tried on a exploitable driver, is to make your connection die and leave you wonder what the heck has happened to your network.

    I thought it was already know it was BS and there is no possible hack at the moment. More so against a builtin Airport on a MacBook.

  3. l33th@xx0r. Your are a pitiful TROLL!

    Even Maynor have admitted on a public forum it CAN’T be done as is on an out-of-shelf MacBook!
    You need TWO wireless connections ALIVE at same time.

    HECK, for what is worth it CAN’T BE DONE EITHER on a Dell, HP, Compaq, Lenovo, etc you name it!
    Repeat after me, BOZO: YOU NEED TWO WIRELESS CONNECTIONS ALIVE AT SAME TIME.

    One to deliver the hack exploiting the driver fault and installing the callback, then the compromised driver dies or act erratically and THEN you make use of the second connection alive to continue the exploit with the installed callback.

    Now, how many users you see going around with TWO wireless devices installed and using BOTH AT THE SAME TIME for chrissake!

    It one more time amounts to getting publicity by bashing Apple and Macs. The cigarette he wanted to use on smug Mac users actually burned his fingers!

    PS
    l33th@xx0r, another TROLL in MDN. Don’t you guys ever get tired of being called IDIOTS?

  4. Wireless and Bluetooth has been insecure for years.

    Computers are basically insecure, much like the internet used to send information back and forth.

    Apple does a better job than anyone else at keeping most of the common pains out.

    But they are really no match against a hardened electronics warfare technician and the NSA.

  5. Damn, Gruber, you might make these bozos shit their panties. You realize, of course, that these two miscreants will likely claim that Apple’s firmware updates have resolved the previous flaws in security and that the Macs are not capable of being hacked NOW. So, you see, reality is not important, image is.

  6. l33th@xx0r:

    I’m less concerned with NSA stealing my secret recipe for beef stew, as I am a criminal stealing my financial data, accessing my root kit, deleting my files, or a converting my Mac into a zombie. Besides, if all computers are open to NSA and mysterious “hardened electronics warfare technicians” you had better disconnect your box now, before it’s too late to save yourself!

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.