In the annual Pwn2Own at the CanSecWest security conference in Vancouver, fully patched machines are set up, and you can win one by being first to hack it (rules). Last year, Charlie Miller hacked the MacBook Air in about two minutes. This year, as he'd warned beforehand, he pwned a fully patched MacBook in a few seconds, by exploiting a security vulnerability in Apple's Safari browser, as Ryan Naraine reports at ZD Net.
The drive-by attack also won Miller a $10,000 prize.
Given Safari's security record, it's not exactly a surprise to see the Mac being first to fall again, though it must be embarrassing for Apple to see its machines get pwned so much more easily than Vista PCs.
Miller's predictions before the event were as follows:
Safari: hacked by 4 different people. Easy pickin's as usual.
Android: hacked by 1 person. Not too tough but no one owns one.
IE8, Firefox: Survive unscathed. The bugs to exploit equation is too hard for $5k.
iPhone, Symbian: Survive due to non-executable heap.
Blackberry, Windows Mobile, Chrome: I don't know enough to say anything intelligent. That said, they're probably hard/obscure and so survive
I don't expect Chrome to survive, but we'll see....
