Saturday, March 29, 2008

Linux last OS standing, but is it really better?

The last notebook left unbeaten in the Pwn 2 Own contest is a VAIO VGN-TZ37CN running Ubuntu 7.10. The other two, a MacBook Air and a Fujitsu U810 running Vista Ultimate SP1, have fallen. The MacBook was the first and fastest to fall via a Safari exploit. The Vista machine fell due to a bug in Java. I have no idea what version of Java that was, but it's disturbing that (1) we still have security problems with Java after all these years and (2) Vista would allow a compromise in Java to compromise the operating system.

The fact that Ubuntu hasn't been hacked yet does not prove Ubuntu's superiority to either Mac OS X or Vista. There was this interesting comment from the show:
Some of the show's 400 attendees had found bugs in the Linux operating system, she said, but many of them didn't want to put the work into developing the exploit code that would be required to win the contest.
So the bugs are there ready to be exploited. All somebody needs is real motivation.