Dailydave mailing list archives

This guy cracks me up.


From: "Dave Aitel" <dave.aitel () gmail com>
Date: Sat, 2 Sep 2006 09:01:17 -0400

http://daringfireball.net/2006/09/open_challenge

"""

With that in mind, I'm issuing the following challenge to David Maynor
and Jon Ellch:

If you can hijack a brand-new MacBook out of the box, it's yours to keep.

Stipulations:

   1.

      We'll meet at an Apple store — or other reseller of Mac hardware
— convenient to you. If the location is not convenient for me, I may
choose to be represented by one or more trusted readers of Daring
Fireball.
   2.

      I will purchase a new MacBook.
   3.

      We'll proceed to an agreed-upon location for the hijacking to take place.
   4.

      The hijacking will be videotaped, including the display of the
MacBook. The technical details of the hijacking itself, including the
network traffic, will not be examined or recorded. I.e. nothing will
be revealed about how the hijacking is performed, only that it can be
done. (I offer this stipulation not because I wouldn't want to know
the details — I very much would — but because this sort of "we don't
want to reveal how it works" thinking is clearly the only possible
explanation for Maynor and Ellch's continued silence on the issue, if
they in fact have discovered such an exploit.)
   5.

      I will open the MacBook and proceed through the initial
first-run configuration. The initial administrator user account will
be the only user account on the machine.
   6.

      I believe AirPort is turned on by default, but if it isn't, I'll
turn it on using the system-wide AirPort menu.
   7.

      I will not otherwise diddle with the default network and
firewall settings of the MacBook.
   8.

      If prompted to join an available Wi-Fi network, I will refuse.
I.e. AirPort will be turned on, but the attack can't be based on the
assumption that the user is willing to join an untrusted network
created by the attacking machine, or that the MacBook's Wi-Fi settings
have been changed from their defaults to allow joining new networks
without asking.
   9.

      No additional hardware or software will be installed on the
machine. At no point before the contest has been decided do you, the
challengers, get to physically touch the machine.
  10.

      I will create a file on the desktop of the MacBook. This file
will be created with the default ownership and file permissions — read
and write access for the current user, read-only access for the group
and world.
  11.

      If you delete this file, you win the challenge, and the MacBook
is yours to keep.
  12.

      If you don't delete the file, you pay me the full retail price
of the MacBook.
  13.

      If you can crash the machine or crash the current login session,
we'll call it a draw. I keep the MacBook, and you don't have to pay
for it.
  14.

      If the offer is not accepted by September 8, 2006, it will be rescinded.

"""
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave


Current thread: