Hack challenge QuickTime bug not on the loose

CanSecWest organizers now dispute claim that someone snatched exploit

Organizers of last week's MacBook Pro hack challenge Thursday disputed accounts that the QuickTime [ArtId:1226260016|exploit]] that won the US$10,000 prize was nicked from a wireless network and is now in circulation.

"Not likely," said Dragos Ruiu, one of the CanSecWest and hack contest organizers. "Everything went over a wired network. It was in a locked cabinet, so it would have to have been physically compromised."

When asked about the chance that the exploit could now be in the hands of anyone other than 3com TippingPoint -- the company that paid $10,000 for the code; its creator, Dino Dai Zovi; and Apple, Ruiu said: "Slim." Dai Zovi's exploit for the QuickTime vulnerability is very serious," security researchers have said. To make matters worse, unconfirmed reports surfaced Wednesday that others might have captured the exploit while the MacBook Pro was being attacked. In a blog entry, Thomas Ptacek, a researcher at Matasano Security, a New York-based security consultancy, said: "Raw packet captures of the successful exploit have been taken by parties unknown."

Later in the day, Ptacek retracted his claim after another CanSecWest organizer posted a comment to the Matasano blog. "Someone may have reverse-engineered the vulnerability but they didn't pull it off the network there," wrote someone identified as "toby."

"The network was very simple: a WAP [wireless access point] that was connected to a hub and to the router to provide Internet access. The Macs sat on the hub and the only other systems on there were the ones we used to monitor the network to ensure rules were followed. The WAP was routing traffic from the hub to the Internet, not sending it out over the wireless network.

"We were sniffing the traffic on the wireless network and would have noticed if it had been getting traffic from the wired side," toby said.

Ruiu confirmed the setup. "Even the guy who ran the exploit sent it over the wired network," he said.

Throughout Wednesday, Ptacek tried to get the researcher who claimed to have snared Dai Zovi's exploit to confirm his findings, but to no avail. On the Information Security Sell Out blog, Ptacek asked for details, but the blog writer answered: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not."

That exchange and others led Ptacek to write on the Matasano site last night: "The bulk of the 'it leaked!' leads in this soap opera are not panning out, fortunately for all involved."

Dai Zovi's discovery, if or when it does make it into the wild, threatens users of any browser that's Java enabled, TippingPoint has said. Until Apple patches QuickTime, the only sure defense is to disable Java in the browser.

Apple has not posted a fix or said when it would do so.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?