Archive for the ‘SC Mag Blues’ Category

In case you’ve been following along, I promised last month to keep on top of SC’s “Hot or Not” feature. Well, I’m a bit late to the party (seeing as how it’s November and the column came out in late October,) but at least I didn’t miss it entirely. Anyway, this month eEye founder Marc Maiffret posits that wireless card attacks are not hot; saying instead that they are just hype – nothing sums up his take better than this selection:

Do we all really believe that the next major wave of identity theft attacks is going to happen by Eastern European hackers flying to the United States to sit at your local Starbucks and hope that someone with the correct vulnerable wireless card driver is going to fall victim to their scheme?

Now, in my opinion, Marc’s half right – or how about “right from a certain point of view.” Here’s what I mean: everything Marc says about the attack is 100 percent true: it’s not being particularly likely to occur, it’s the least of your worries at the local Starbucks, and it not any more technically interesting than other kernel-level issues already documented in other products. All true. So, judged solely on the merit of the bug, I would tend agree with Marc; the panic associated with this issue is way out of line for the threat. But there is one area where I think we do need to move beyond the merit of the bug to determine “hot vs. not” status – namely the Mac community’s response to it.

Now I’ve learned the lesson that saying something negative about Mac security signs you on for the flame email barrage, but just for the record, let’s not forget the following:
- MacWorld denied the existence of this flaw
- Public laims were made that the BlackHat demo was entirely fabricated
- public Assertion appeared in the press that the demo was rigged
- Apple still hasn’t given full credit to the researchers

So, while I agree with Marc that this isn’t the worst thing in the world from a security perspective, I think it makes for interesting fodder for discussion nevertheless.