Hack challenge QuickTime bug not on the loose

Computerworld - Organizers of last week's MacBook Pro hack challenge today disputed accounts that the QuickTime exploit that won the $10,000 prize was nicked from a wireless network and is now in circulation.

"Not likely," said Dragos Ruiu, one of the CanSecWest and hack contest organizers. "Everything went over a wired network. It was in a locked cabinet, so it would have to have been physically compromised."

Ruiu responded, "slim," when asked what the chances were that the exploit could now be in the hands of anyone other than its creator, Dino Dai Zovi; Apple Inc.; or 3com Corp.'s TippingPoint unit -- the company that paid $10,000 for the code. Dai Zovi's exploit for the QuickTime vulnerability is very serious, security researchers have said. To make matters worse, unconfirmed reports surfaced yesterday that others might have captured the exploit while the MacBook Pro was being attacked. In a blog entry, Thomas Ptacek, a researcher at Matasano Security LLC, a New York-based security consultancy, said, "Raw packet captures of the successful exploit have been taken by parties unknown."

Later in the day, Ptacek retracted his claim after another CanSecWest organizer posted a comment to the Matasano blog. "Someone may have reverse-engineered the vulnerability, but they didn't pull it off the network there," wrote someone identified as "toby."

"The network was very simple: A WAP [wireless access point] was connected to a hub and to the router to provide Internet access. The Macs sat on the hub and the only other systems on there were the ones we used to monitor the network to ensure rules were followed. The WAP was routing traffic from the hub to the Internet, not sending it out over the wireless network.

"We were sniffing the traffic on the wireless network and would have noticed if it had been getting traffic from the wired side," toby said.

Ruiu confirmed the setup. "Even the guy who ran the exploit sent it over the wired network," he said.

Throughout yesterday, Ptacek tried to get the researcher who claimed to have snared Dai Zovi's exploit to confirm his findings, but to no avail. On the Information Security Sell Out blog, Ptacek asked for details, but the blog writer answered: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not."

That exchange and others led Ptacek to write the following on the Matasano site last night: "The bulk of the 'it leaked!' leads in this soap opera are not panning out, fortunately for all involved."

Dai Zovi's discovery, if or when it does make it into the wild, threatens users of any browser that's Java-enabled, TippingPoint has said. Until Apple patches QuickTime, the only sure defense is to disable Java in the browser.

Apple has not posted a fix or said when it would do so.

Read more about security in Computerworld's Security Knowledge Center.