最新报道续：

马考勒表示，他今年选择以Vista为攻击对象，是由于他曾接过微软的软件合同，因此对微软产品较为熟悉。大赛举办方表示，虽然不少参赛赛者多次试图攻破UbuntuLinux笔记本，但都没能取得成功。但有不少参赛者称，他们其实已经找到了Ubuntu系统中的漏洞，但鉴于这款开放源代码操作系统仍处于发展阶段，参赛者有意把Ubuntu Linux“放了一马”。

据国外媒体报道,在加拿大召开的全球黑客大会当地时间周五落下了帷幕,除了安装Linux的索尼Vaio笔记本电脑安然无恙外,另外一台安装了Vista的富士通笔记本在最后一天也被攻破.
本周三,全球黑客顶级赛事“CanSecWest PWN 2 OWN”在温哥华拉开了帷幕,主办方提供了三台运行不同操作系统的笔记本供参赛者实施攻击,分别是Linux、Mac OS X和Vista.获胜者将获得2万美金的奖金及被攻破的笔记本.不过随着时间的推移,奖金也在不断缩水,每过一天将减少一半.

比赛第一天,主办方规定参赛者只能实施基于系统本身的网络攻击,而不能借助用户的互动行为,由于难度较大,所有参赛小组都未能成功攻破.

　　苹果微软操作系统相继被攻破

　　第二天,即周四,主办方放宽了攻击规则,允许参赛者引诱被攻击用户访问含有恶意代码的网站,或打开含有恶意代码的电子邮件附件.由 Independent Security Evaluators的研究人员查理·米勒(Charlie Miller)等组成的小组在3Com旗下网络安全部门TippingPoint的专家协助下,利用事先准备好的恶意代码和Safari浏览器的一个漏洞,在2分钟内成功攻破了MacBook Air笔记本.该小组除了领到1万美元的奖金,还把被攻破的笔记本领回了家.

　　周五,由谢恩·麦考利(Shane Macaulay)等人组成的小组攻破了Vista笔记本.麦考利也是去年黑客大赛的获胜者之一.由于此前并不知道攻击目标是安装了SP1的Vista版本,因此麦考利是在VMware公司专家的指导下完成此次攻击的.

　　根据大赛规定,麦考利及米勒均不得对外泄露他们所攻击的系统漏洞,直到相关软件公司发布了补丁程序.不过,麦考利透露,“漏洞存在于别的地方,但 Java的内在性质使得我们避开了微软的安全保护机制.”麦考利周五在得奖后对媒体表示,“这对Linxu或Mac OS X都有所影响”.

　　麦考利解释说,之所以选择Vista是因为自己曾经为微软承包过项目,因此对微软产品更为熟悉.而米勒则解释说,选择Mac为攻击对象是因为Mac相对较为容易攻破.对此,麦考利并未否认,“我想有这个可能.”

　　尽管此次有少数参赛小组试图攻击Linux系统,但均未获成功.参会的网络安全专家透露,此次参赛的400名黑客中,有人的确发现了Linux漏洞,但却没有按照大赛要求开发攻击代码.

新浪科技消息





【赛迪网讯】3月31日消息，上周上周在加拿大温哥华举行的全球黑客大赛中，继苹果MacBook Air笔记本被攻破之后，运行Vista的富士通笔记本也在大赛最后一天被攻破，三台分别运行Linux、Mac OS X和Vista的笔记本中，只有运行Linux系统的索尼Vaio完好无损。

在加拿大温哥华举行的全球黑客大赛中，继苹果MacBook Air笔记本被攻破之后，运行Vista的富士通笔记本也在大赛最后一天被攻破，三台分别运行Linux、Mac OS X和Vista的笔记本中，只有运行Linux系统的索尼Vaio完好无损。

据国外媒体报道，全球黑客领域一项顶级赛事上周三在加拿大温哥华拉开了帷幕，该比赛由CanSecWest安全会议进行组织。主办方提供了三款运行不同操作系统的笔记本电脑，分别是Linux、Mac OS X和Vista，供参赛的各路黑客实施攻击。

根据主办方的要求，黑客在比赛中只能使用最新的、别人尚未发现的“零日”攻击代码。获胜者将获得2万美金的资金，同时被攻破的笔记本电脑也归其所有。大赛组织者将此次赛事称之为“PWN 2 OWN”，在黑客字典里是控制计算机的意思。

大赛第一天，三部笔记本电脑系统完好无损。这一情况也在组织者的意料之中，因为大赛第一天只允许参赛者实施基于网络的攻击手段，并且不能与用户进行互动交流，这种类型的攻击目前还非常少见。但每过一天，奖金将会减半，不过攻击难度也会因放松规则而减少。

大赛第二天，Independent Security Evaluators的查利·米勒利用Safari浏览器的一个漏洞通过一个尚未使用的代码攻破了运行Mac系统的MacBook Air笔记本。米勒获得了1万美金的奖励，外加这台被攻破的MacBook Air。

大赛第三天，去年该大赛的获胜者之一、沙恩·马考勒在VMware的研究人员亚里山大·索蒂洛夫等人的协助下攻破了运行Vista的富士通笔记本电脑。

根据大赛的规定，在上述发现的漏洞被修补之前，马考勒和米勒不能透露漏洞的具体细节。但马考勒透露，他发现并利用的是一个跨平台漏洞，通过Java绕过了Vista的安全防护。

马考勒表示，他今年选择以Vista为攻击对象，是由于他曾接过微软的软件合同，因此对微软产品较为熟悉。大赛举办方表示，虽然不少参赛赛者多次试图攻破Ubuntu Linux笔记本，但都没能取得成功。但有不少参赛者称，他们其实已经找到了Ubuntu系统中的漏洞，但鉴于这款开放源代码操作系统仍处于发展阶段，参赛者有意把Ubuntu Linux“放了一马”。

[ 本帖最后由 Send_linux 于 2008-3-31 09:29 编辑 ]

没白学linux

[ 本帖最后由 7717060 于 2008-3-30 19:55 编辑 ]

看来linux的安全还成啊，呵呵

Vista, MacBook Out--Only Linux Left in Hacking Contest

  Robert McMillan, IDG News Service  Sat Mar 29, 8:00 AM ET  

The MacBook Air went first; a tiny Fujitsu laptop running Vista was hacked on the last day of the contest; but it was Linux, running on a Sony Vaio, that remained undefeated as conference organizers ended a three-way computer hacking challenge Friday at the CanSecWest conference.
ADVERTISEMENT

Earlier this week, contest sponsors had put three laptops up for grabs to anyone who could hack into one of the systems and run their own software. A US$20,000 cash prize sweetened the deal, but the payout was halved each day as contest rules were relaxed and it became easier to penetrate the computers.

On day two, Independent Security Evaluators' Charlie Miller took the Mac after hitting it with a still-undisclosed exploit that targeted the Safari Web browser. After about two minutes work, Thursday, Miller took home $10,000, courtesy of 3Com's TippingPoint division, in addition to his new laptop.

It took two days of work, but Shane Macaulay, finally cracked the Vista box on Friday, with a little help from his friends.

Macaulay, who was a co-winner of last year's hacking contest, needed a few hacking tricks courtesy of VMware researcher Alexander Sotirov to make his bug work. That's because Macaulay hadn't been expecting to attack the Service Pack 1 version of Vista, which comes with additional security measures. He also got a little help from co-worker Derek Callaway.

Under contest rules, Macaulay and Miller aren't allowed to divulge specific details about their bugs until they are patched, but Macaulay said the flaw that he exploited was a cross-platform bug that took advantage of Java to circumvent Vista's security.

"The flaw is in something else, but the inherent nature of Java allowed us to get around the protections that Microsoft had in place," he said in an interview shortly after he claimed his prize Friday. "This could affect Linux or Mac OS X."

Macaulay said he chose to work on Vista because he had done contract work for Microsoft in the past and was more familiar with its products.

Although several attendees tried to crack the Linux box, nobody could pull it off, said Terri Forslof, a manager of security response with TippingPoint. "I was surprised that it didn't go," she said.

Some of the show's 400 attendees had found bugs in the Linux operating system, she said, but many of them didn't want to put the work into developing the exploit code that would be required to win the contest.

Earlier, Miller said that he chose to hack the Mac because he thought it would be easiest target. Vista hacker Macaulay didn't dispute that assertion: "I think it might be," he said.

尽管此次有少数参赛小组试图攻击Linux系统,但均未获成功.参会的网络安全专家透露,此次参赛的400名黑客中,有人的确发现了Linux漏洞,但却没有按照大赛要求开发攻击代码.

有漏洞，但是不好利用

没有攻破，不代表没有漏洞，还是好好的检查代码，看看有没有可能被利用的

却没有按照大赛要求开发攻击代码？看来觉得价值不大~

不还是发现了linux目标漏洞吗？只是没有及时开发出来攻击代码！所以没有绝对安全的系统啊！
但相对来说windows是比较安全的！

不知楼上所云