MacSmugness and Black Hat Security Breaches

According to a blog on WashingtonPost.com, a couple of hackers claimed they could gain control of a MacBook in sixty seconds or less by using a flaw in the wireless system. Initially the story talked about the hackers exploiting a problem with a MacBook device driver. Later they produced a video, now posted on the internet, showing that they accomplished their goal.

Ultimately the demonstration led to more questions than answers. The demonstrator reported that the computer being exploited does not need to be associated with an access point in order to be taken over, but then connected the MacBook into a software access point on a Dell computer. He also used a third-party wireless card, not MacBook’s AirPort built-in system. While the demonstrator claims that AirPort is also susceptible, it was never proven.

Reaction to this report ranged from total disbelief, with viewers wondering if the whole thing was a publicity hoax, to criticisms about Apple’s security. Supposedly this is a flaw that Apple knew about but hasn’t fixed yet.

Note that, when asked, the hackers said that this is a vulnerability in most wireless systems. They claimed they demonstrated on an Apple computer because of the “aura of smugness” from the cult of Apple. They also cited Apple’s new ads touting it’s security as another reason to use a MacBook for demonstration purposes.

Apple users should learn from those comments about user attitudes. There is good reason to feel good about security on your MacBook or other Apple product, but that doesn’t mean you should let your guard down entirely. Many never use anti-virus or other security programs. This is just asking for trouble over time.

There us good reason to believe that Apple will be challenged more frequently in the future. An interesting article in the Statesman Journal talks about the profit motive for hacking. It points out that intruders haven’t failed to note that Apple Mac users number about 25 million, and another 58 million people own iPods. These numbers are high enough to be worth the time and attention of intruders.

Shortly following the news about Apple’s security flaw, another hacker showed how easy it was to plant malicious code on Vista. This happened after Vista challenged attendees of the Black Hat hacker conference to show what they could do. (The Apple demonstration was also performed by attendees of this conference.) Overall reaction was much different than reaction to the MacBook demonstration. Most articles emphasized that the hacker needed to be in administrator mode to plant the code, and concluded with comments Microsoft made about working to fix this.

I applaud Microsoft for challenging Black Hat attendees. This is a good way to find and fix problems before releasing Vista.

Whether or not Apple has a problem with wireless security remains to be seen. In the meantime, Apple users who have gotten complacent and have forgotten how to protect their computers might want to take this as a wake-up call. It doesn’t matter how secure Apple is; sooner or later somebody with some good financial incentive will raise havoc.

There is no perfect system. Securing your computer before a break-in is much easier than picking up the pieces later. Believe me, I know.