Re: [CGUYS] OS X blackhat training

2009-07-30 Thread David K Watson
(Damn it, I didn't fix the subject: tag again. Sorry.) I will grant that you can argue this both ways. The way I remember it, version 5.0 was never more than a developer preview, 5.2 was the first true OS X version, and there were big differences in the rendering engine between versions. IE

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread Jeff Wright
Bottom like is that OS X is extremely hard to hack and these are still no viruses in the wild that attack Macs. Meanwhile there have been 10,000s that have attacked Windows. The latest (June) WildList (http://www.wildlist.org/WildList) shows 753 viruses currently circulating in the wild that

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread TPiwowar
On Jul 29, 2009, at 7:56 AM, Jeff Wright wrote: I've noticed that Apple has stopped updating software on 10.3 systems. QuickTime, Safari and iTunes are way out of patch on some of my Macs and Software Update shows nothing amiss. Odd for a company to abandon a product after only 4 or 5

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread Jeff Wright
Apple supports the current and previous versions of the OS. They price their OS upgrades very reasonably and they have a quality product (not Vista). It is easy for their customers to keep up and they get lots of value with each upgrade. It makes little sense to support X.3. I should add that

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread mike
Don't they sell those on late night cable tv? On Wed, Jul 29, 2009 at 11:22 AM, Jeff Wright jswri...@gmail.com wrote: Never mind, I get it, it's just the patented Piwowar Hypocrisy Pump in action again. * ** List

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread Jeff Wright
Now you know what killed Billy Mays. Don't they sell those on late night cable tv? On Wed, Jul 29, 2009 at 11:22 AM, Jeff Wright wrote: Never mind, I get it, it's just the patented Piwowar Hypocrisy Pump in action again.

Re: [CGUYS] OS X blackhat training

2009-07-29 Thread Steve Rigby
On Jul 29, 2009, at 10:48 AM, TPiwowar wrote: Apple supports the current and previous versions of the OS. They price their OS upgrades very reasonably and they have a quality product (not Vista). It is easy for their customers to keep up and they get lots of value with each upgrade. It

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
Exactly. He found the exploit and wrote it in a couple hours...took over the mac in about as much time as it takes to go to a web page. Same way most windows machines are taken over. On Wed, Jul 22, 2009 at 7:01 PM, Rev. Stewart Marshall popoz...@earthlink.net wrote: But is that not what

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Snyder, Mark - IdM (IS)
Mike, can you defend this couple of hours with reference? I recall reading that he spent several days or a few weeks finding the vulnerability and writing the exploit script before the Pwn2own competition (I searched, but found no reference to offer). Thank you, Mark Snyder -Original

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 10:36 AM, mike wrote: Exactly. He found the exploit and wrote it in a couple hours...took over the mac in about as much time as it takes to go to a web page. Same way most windows machines are taken over. So now 30 seconds morphs into a couple hours. If I took the

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 22, 2009, at 10:01 PM, Rev. Stewart Marshall wrote: But is that not what most hackers do? In 30 seconds? Not even Windows is that easy. * ** List info, subscription management, list rules, archives, privacy **

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Rev. Stewart Marshall
Tom you either did not read what I wrote, or misunderstood. They all do their homework. That is what makes these dudes/dudettes so dangerous. They find the exploits and write the code for them. And given time I am sure they wills tart working on hacking Mac's more often and finding the

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
Tom didn't misunderstand, he just refuses reality. His apple fan bois-ism is too meaningful to him. On Thu, Jul 23, 2009 at 9:01 AM, Rev. Stewart Marshall popoz...@earthlink.net wrote: Tom you either did not read what I wrote, or misunderstood. They all do their homework. That is what

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
Sure. http://www.securityfocus.com/news/11461 Note Dai Zovi admits to being a mac fanboy also. Here is a relevant few paragraphs. I love at the end where he practically talks to Tom. In all he found the flaw friday morning, wrote the exploit in a couple hours and then the exploit took seconds

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Snyder, Mark - IdM (IS)
I see where you get that from, but for me, the fact that this all occurs over months (Several months ago, he had done some poking around the Mac OS X's operating system and applications looking for vulnerabilities and found a few promising places) leaves me with a different sense of timing. Thank

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Rev. Stewart Marshall
This is no different than what the hackers do with WinOS. You think they find the exploits over night? It takes some skill and work to do it. Now before you blast me let me say this. All OS's are exploitable. Some make it easier than others so they gravitate to this, Plus remember with

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
I don't know, I took him at his word. He looked at OS X as a whole and found some questionable places...friday he went looking again and actually found the exploit (he had not found this before this) and within a couple hours wrote an exploit. On Thu, Jul 23, 2009 at 10:41 AM, Snyder, Mark - IdM

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Snyder, Mark - IdM (IS)
No blast, Rev; that was part of my point. Finding vulnerabilities and creating exploits takes time and thought. Irrespective of which OS you plan to attack. Thank you, Mark Snyder -Original Message- This is no different than what the hackers do with WinOS. You think they find the

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Snyder, Mark - IdM (IS)
Okay: I go to the library and study for an undisclosed amount of time, bring the results of my research home, and after several weeks or a few months, I organize my notes and write a brief report from my notes in 15 minutes. I would not then say that I just spent 15 minutes writing that report.

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 1:49 PM, Rev. Stewart Marshall wrote: You think they find the exploits over night? It takes some skill and work to do it. As I recall, I love you virus was written by somebody taking a beginners VBS programming class, infecting 10 percent of all computers connected to

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 12:01 PM, Rev. Stewart Marshall wrote: And given time I am sure they wills tart working on hacking Mac's more often and finding the exploits. Given time the Sun will supernova? So what -- I won't be here.

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 1:20 PM, mike wrote: Note Dai Zovi admits to being a mac fanboy also. Here is a relevant few paragraphs. I love at the end where he practically talks to Tom. In all he found the flaw friday morning, wrote the exploit in a couple hours and then the exploit took

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
Too true, mac os is safe regardless of it's less then stellar security, but in the end, safe. On Thu, Jul 23, 2009 at 1:43 PM, t.piwowar t...@tjpa.com wrote: On Jul 23, 2009, at 1:20 PM, mike wrote: Note Dai Zovi admits to being a mac fanboy also. Here is a relevant few paragraphs. I love

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread mike
No just regular logic without your weird outlook. Less than stellar meaning when put to the test as in the last few pwn to own contests, it fails. My home has never been broken into...this does not lead me to believe that it is an impossibility. On Thu, Jul 23, 2009 at 4:09 PM, t.piwowar

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 5:50 PM, mike wrote: Too true, mac os is safe regardless of it's less then stellar security, but in the end, safe. How do you define less then stellar security? Looking at Apple's excellent record and then looking at M$'s defective product, WFBs declare that Apple

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread t.piwowar
On Jul 23, 2009, at 7:42 PM, mike wrote: No just regular logic without your weird outlook. Less than stellar meaning when put to the test as in the last few pwn to own contests, it fails. My home has never been broken into...this does not lead me to believe that it is an impossibility.

Re: [CGUYS] OS X blackhat training

2009-07-23 Thread Rev. Stewart Marshall
Depends on where you live. Stewart At 09:42 PM 7/23/2009, you wrote: Fantasy land. So when the cops come to your house to do a security audit do you think you have been burglarized? How silly. Rev. Stewart A. Marshall mailto:popoz...@earthlink.net Prince of Peace www.princeofpeaceozark.org

[CGUYS] OS X blackhat training

2009-07-22 Thread mike
http://www.theregister.co.uk/2009/07/20/advanced_mac_osx_rootkits/ Advanced rootkit design techniques from a OS X security expert. You know the guy that hacked a mac in like 30 seconds. * ** List info, subscription

Re: [CGUYS] OS X blackhat training

2009-07-22 Thread t.piwowar
On Jul 22, 2009, at 6:38 PM, mike wrote: Advanced rootkit design techniques from a OS X security expert. You know the guy that hacked a mac in like 30 seconds. He didn't hack a Mac in 30 seconds. He ran a prepared script. Big difference.

Re: [CGUYS] OS X blackhat training

2009-07-22 Thread Rev. Stewart Marshall
But is that not what most hackers do? They examine and look at the OS they want to hack and then through trial and error find the way to do it. Stewart At 07:23 PM 7/22/2009, you wrote: He didn't hack a Mac in 30 seconds. He ran a prepared script. Big difference. Rev. Stewart A. Marshall