Filed under: Desktops, Laptops

Several weeks ago, we regaled you with the tale of how a pair of hackers, David Maynor and Jon “Johnny Cache” Ellch claimed that they could pwn a MacBook in a minute flat. The dynamic duo then showed the exploit to Brian Krebs, a reporter at The Washington Post and a controversy ensued over the next few weeks as to who had shown exactly what to whom when. The most recent episode involved Apple telling Macworld two days ago that SecureWorks, Maynor’s employer, hadn’t showed Apple any specific information — however, on its own, Apple discovered a problem, then released security and wireless patches for PowerPC-based and Intel-based Macs. Meanwhile, SecureWorks has been awfully mum on the issue, refusing to say anything further to Krebs or to the IDG News Service. Glenn Fleishman has a very lengthy blog entry over at Wi-Fi Net News that provides a play-by-play of this whole situation, but points out that Maynor and Ellch are scheduled to speak at Toorcon in San Diego later this month, and concludes by saying that he thinks the pair will show their cards and tell all, which may finally settle this torrid affair.

 

Read | Permalink | Email this | Linking Blogs | Comments

---

SPONSORED BY: BOLD MOVES: THE FUTURE OF FORD A new documentary series. Be part of the transformation as it happens in real-time.

Filed under: Misc. Gadgets, Networking

Usually the term "hacking" has some rather negative connotations, so it almost seems counterintuitive to pay someone good money for breaking into your system, but that's exactly what HP is offering to do for its corporate customers with a new service called HP Active Countermeasures, or HPAC. As you'd imagine, HP's hackers won't do anything malicious once they break into a client's server -- propagating a worm, for instance, would seem to be bad for business -- but they will use a combination of buffer, heap, and stack overflows to exploit a system in much the same way that black hatters cause Internet terror on a daily basis. Specifically, the company will employ one of its own servers to launch attacks using eight to ten scanning clients for every 250,000 devices that are part of the program, and offer customers a temporary patch until they're able to hire a dedicated security firm for shoring up any vulnerabilities. Pricing is promised to be "aggressive," with firms using less than 20,000 IP addresses expected to pay only a few dollars per user per year for the privilege of learning how shoddy their security really is.

[Via The Inquirer]

Read | Permalink | Email this | Linking Blogs | Comments