Is 30-min Mac Hack Bogus? Secrecy Makes Claim Questionable

We received a note from reader Tim McManus who has requested proof of the challenge and proof that the Mac mini server was actually hacked as alleged in this article originating on ZDNet. He wrote:

First, I requested a copy of the system logs and the root shell history from the guy who owns the server. In a single-line email he replied "No, there's nothing in them anyway." His refusal to post the logs or share them leads me to believe that he's hiding something.

Second, if you look at the "Logs" section of his web site it posts the last 100 lines of a log that is called "everything.log" Upon further review from the shell, those logs are accessible only by root. This is extremely poor security. Essentially, the web-based application needs to use a method that runs as root. From a hacker's perspective, the 'tail -n100 /var/log/everything.log' command in the application is the Holy Grail. If that line is being implemented poorly, it can be used by a hacker to issue commands to the server. It's a doorway.

Most internet-facing applications are designed to run as a user within their user space. For instance, there is a MySQL user created on the box when you install MySQL. This prevents anyone with that user account from accessing anything outside of the MySQL user space.

If the owner of the box wanted to show the logs in the format he has displayed, he should have had a cron job replicate the logs at an interval and then used Apache or PHP to display the logs from a secure location via a method that did not require root privileges.

Finally, all of the user accounts that are created have access to the gcc compiler. Security best practice is to remove all development tools from a production machine because that allows a hacker a golden opportunity to create and execute an application on the host machine to compromise it in many, many different ways. So not only do the users have shell access to the machine, they can compile and execute their own code.

If that machine was hacked--and I seriously doubt the claim at this point due to the lack of disclosure--it was more probable that it was done via the web-based application versus the shell. And there have not been any further successful attempts since that initial announcement.

Perhaps the person who claims his Mac mini was hacked will be more open so that the holes that were exploited can be closed. [Bill Fox]