Whilst this is an excellent article with a large number of valid (if not new points) I wonder if there is good reason to use the reaserchers powerbook as an example of a flaw in this case. Since the powerbook was "locked down" and since there are no obvious answers as to how the laptop was hacked is it not possible that this security flaw was human not software. i.e. a physical security issue? did the researcher leave his notebook out of sight? did someone watch him enter a password? For an isolated incident it is a bit much to suggest that there is a flaw in Mac OSX that allows a remote attacker to take control of a system (presumably as root if launching server processes) without leaving a trail or indeed anyone else knowing about it....

I wonder.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11375/33060#33060