Mac exploit explodes again (and TSA toons)

Ohhh yes, it's IT Blogwatch, in which Black Hat Mac Wi-Fi bug demo-maker Johnny Cache breaks cover. Not to mention Schneier's favorite airport security cartoons...

L'Inq's Nick Farrell sums it up:

HACKER John Ellche, known in the Black Hat world as Johnny Cache, has opened a can of worms by telling the world about a Apple Wi-Fi exploit at the Black Hat and DEFCON convention last month. Ellch and co-presenter Dave Maynor went silent after the announcement and the Apple fanboys, who don't like the concept of their favourite machines having security holes, have had a field day dismissing the pair's claims as a hoax.

Ellch seems to have a gutsful of his credibility being questioned by religious loonies who base their point of view of faith in Steve Jobs rather than anything technical and has started to explain why everything went quiet.
...
In a cunning plan to avoid the black helicopters from Snapple's legal department, Ellch talks about the same exploit from the point of view of an Intel machine. Unlike Apple, the problem has been patched by Intel for a while now.

Joe Barr spotted Johnny's post:

Ellch finally broke the silence in an email to the Daily Dave security mailing list over the weekend, and one thing is clear: he is chafing under the cone of silence which has been placed over the two of them.
...
Ellch then breaks down the elements of the vulnerability and possible exploits ... notes that a crash caused this way doesn't guarantee a successful exploit ... responded to criticisms that he and Maynor have simply been "playing the media" instead of reporting an actual vulnerability and exploit

Ellch's posts start here:

As everyone has noticed by now, we haven't said anything in public about this attack yet. There are two reasons.

1. Secureworks absolutely insists on being exceedingly responsible and doesn't want to release any details about anything until Apple issues a patch.
   ...
2. Responding to mac bloggers isn't my idea of a good time. Nothing I could say would ever convince them.

Why am I switching the subject from Apple's bug to intel's? Because it's patched, and Secureworks has no influence over what I say regarding this one. So how does it work? There is a race condition inside the centrino driver. Unlike most straightforward ring0 exploits out there, this one is intimately related to timing.
...
Of all the comments I see, the ones that 'we played the media' make the least sense. Have you ever seen me in the news before? No.  Have I ever talked to a reporter before? No. Am I doing a very good job of winning this PR smear campaign lynn fox ignited? No. If I was so deft at manipulating the media, would I be explaining myself on dailydave praying that a few technically competent people will actually get it?

[For more, check out the thread view -- start from the bottom]

Alan LeMaster:

The hubub over the Mac wireless drivers ring0 exploit refuses to settle. Everyone seems to hate Johnny Cache because either 1)MacOSX is divinely inspired and perfect in every way, and there could not possibly be anything wrong with it (even though intel centrino drivers got already patched for a vulnerability in Win32), or 2) he's an attention whore that is using this for his own personal gain (even though he's been assaulted by Apple lawyers and can't talk about the case). Amazing.

Occasionally I forget why I stopped trying to become a "hacker" 3 years ago. It is things like this that remind me.

Slashdotters discuss:

mellon: The way these things work is that when someone hacks your hardware, you get an injunction to stop them from talking about it. If they talk about it, they go to jail for contempt of court ... you might get the very strong impression that he's under an injunction of this type. It's always fun to look for bad guys in situations like this, but both Apple and Mr. "Cache" here are wearing white hats.

rbannon: I still don't see him coming clean on this one. Or maybe, like he says, people like me won't understand it anyway. In any case, I think he's really not being forthcoming with respect to what the hack entails, and maybe that's due to Apple's aggressive lawyers.

eggboard: No one sensible, including myself (over at wifinetnews.com) has asked for the code. Rather, we've asked for Maynor and Ellch to either state that they mislead Brian Krebs, that Apple lied when they stated the company wasn't presented with credible evidence, or that they have material that Krebs saw and Apple hadn't seen yet.

Cid Highwind: Is the exploit real? Who knows, I've seen video of someone cracking a Mac through a wireless driver. Then again I've also seen video of a virus written on a Mac taking down a fleet of invading alien spaceships...

nathanh: Unfortunately the majority of Mac users are an embarrassment ... Mac users make Linux fans look humble and Windows users look intelligent ... I work in the IT security industry and I'm perfectly willing to accept that this exploit is for real. The pattern of events is not abnormal ... The only difference here is that Apple users are so goddamn fanatical that they'll rabidly attack anybody who says their platform is any less than perfect ... Mac users are in for a rude shock. They've told each other their platform is secure ... But the mantra has no foundation in reality. Most Mac users ... have an undeserved complacency regarding security and it will lead to a fall.

Buffer overflow:

Around the Net

• The Enterprise System Spectator: More on Oracle's Fusion strategy
• ForbesOnTech: Portable Technologies-- the Good and the Bad
• Locutus: Administering a stable and well running network: User Rights
• Michael Santo: Sony Hypes PS3 and Blu-Ray … But No HDMI Cable?

Around Computerworld

• Douglas Schweitzer: Tried Mandriva One and it sure works great!
• Martin MC Brown: Are widescreens usable in a business environment?

And finally... Bruce Schneier: Airport Security Cartoons

Richi Jennings is an independent technology and marketing consultant, specializing in email, blogging, Linux, and computer security. A 20 year, cross-functional IT veteran, he is also an analyst at Ferris Research. Contact Richi at blogwatch@richi.co.uk.