Security Bitch Watch – Day 1.

On George Ou’s blog post mentioned in the story below, he noted that David Maynor (aka the sensitive pink pony of hackers, who was needlessly subjected to the vicious ridicule of Mac users spurred on by a rabid Steve Jobs screaming “Fly, my monkeys! Fly!”) would be “bringin’ it on” (not a direct quote) and that he would provide “the bitch slap Apple so badly needs” (also not a direct quote) and that “sisters would be doin’ it for themselves” (that, oddly, is a direct quote).

Ou indicated on Sunday morning that SecureWorks’ totally bitching response of doom to the scurrilous Apple’s scurrilous press release of scurrility would be revealed “in the next couple of days.”

The Oxford American Dictionaries as accessed through Dashboard define “couple” as “two” or “an indefinite small number”, but I think we can start the watch as of this morning.

If Ou is right, we shouldn’t have long to wait.

Which is good because the suspense is killing us. This is the John Mark Karr case of the Mac world, you know.

Let’s review the players here and see who’s down for what.

SecureWorks’ George Maynor and Jon “Johnny Cache” (get it?! Puns rock!) Ellch – They hacked a MacBook using a third party wireless card and driver and – according to Brian Krebs – claimed they could do the same thing with a stock Airport card and driver. Krebs also said they claimed they totally told Apple about this and got hit over the head with a sock full of nickels by Steve Jobs who said they’d better not tell anyone or he’d finish the job.

Oh, and I’m sure this isn’t in any way relevant, but they also want to stab Mac users in the eye with a lit cigarette.

Ha-ha! Oh, you guys!

The Washington Post’s Brian Krebs – Krebs wrote that Maynor and Ellch claimed the Apple-supplied Airport card and drivers could be hacked the same way the third party ones could. Then said they didn’t.

Then said he stood by his reporting.

I may have some of that out of order, but that’s essentially it.

ZDNet’s George Ou – Ou is outraged – OUTRAGED! – that Mac users don’t want to have lit cigarettes stuck in their eyes! The nerve! Listen, Mac punks, if a respected security professional wants to stick a lit cigarette in your eye, you just ask him which one! GOT IT?!

Anyway, Ou says Maynor and Johnny Cache never claimed the exploit worked on Apple Airport hardware and drivers, even though he himself linked to Krebs’ post which says they did. And he says they actually demonstrated the hack against Apple hardware and software, which I guess they must have done while just raising their eyebrows a lot and pointing in silence as Ou says they never said they could do that.

He also had the temerity to claim

…Maynor chose an external third party hardware wireless adapter to avoid focusing attention on possible Apple hardware and software issues which may endanger Mac users.

Oh, that’s so sweet of him. See, he’s just looking out for us. What a nice guy. We should send him a fruit basket or some…


Yeah, whatever, dude.

Apple Computer – Apple essentially said:

We haven’t seen anything from SecureWorks except a grainy video of an exploit of a third party card and driver.

Did we mention we don’t make or resell that card and driver?

‘Cause we don’t.

Oh, and we’d really appreciate it if you fuckers would stop using a MacBook in your demo.

Hugs and kisses,

Here’s what we at Crazy Apple Rumors Site think may have happened. Our opinion is, of course, worth exactly dick.

Maynor and Johnny Cache wanted to demonstrate an exploit they had researched. They also wanted to take a jab at the security of the Mac operating system – a metaphorical jab much like the actual jab with a lit cigarette they’d like to take into the eyes of Mac users everywhere (have you heard this part?). Not really knowing much about Macs (a point I’ll prove at the end), they decided to use a third party wireless card they already knew was exploitable, not realizing it was highly unlikely any Mac user would have a need for a third party card.

Krebs then over-hyped the Mac vulnerability, possibly misinterpreting Maynor’s comments about the exploitability of the stock Airport card and driver. It’s also possible Maynor knew there was a flaw in BSD and assumed it was also exploitable in OS X.

It’s apparently not.

So all this happened and Apple said “Wha-huh?” and Artie MacStrawman threatened Maynor’s life and then Ou freaked out.

That’s just our theory. We’ll gladly eat crow if we’re wrong. [UPDATE, ONE YEAR LATER: I came back to read this and was surprised at how much is actually right. Much, however, is wrong and since I’m all about accuracy… While we STILL haven’t seen the whole exploit, it now looks like they probably did have one on Apple’s native card. But what they sent Apple was not code for an OS X exploit. And then they acted all squirrelly instead of manning up and just releasing the damn thing. Why these few drama queens couldn’t behave like any other security professional who finds a Mac bug is beyond me.]

Except for Ugluk who doesn’t eat crows because he considers them sacred.

He’ll have crowfurkey.

Wait, that’s not right. It’d be… “crowfu”, I guess. Crowfurkey’d be some mutant hybrid of a crow and a turkey.

That’s not right either. It’d be a crow and a tofurkey.



Ugluk says that is what he’ll have. The mutant hybrid of a crow and a tofurkey. That’s apparently OK. Um… I’m not sure where we’re going to get that.

And he’d like a Sprite.

OK, look, I’m not really ready to take orders yet…

I’m not even sure if the place we normally go to get crow is open right now.

Anyway, we’re just about done with Day 1 of Security Bitch Watch and so far the silence…

…has been a little deafening.

Brian Krebs’ blog – where the whole thing started – hasn’t been updated since Friday and Ou’s blog (warning: annoying self-starting audio of Maynor’s presentation) hasn’t mentioned the controversy since the aforementioned post. SecureWorks’ web site hasn’t been updated since they added verbiage pointing out the hack took place with third party hardware and drivers.

But there is one other telling thing you need to know about this controversy:

Maynor – in the video of his presentation of the exploit – repeatedly calls the MacBook he’s using “this Apple.” As in “This Apple will connect back to the attacker.”

I don’t know about you, but that tells me a lot.

I’m just sayin’ Maynor or Krebs might want to think about what wines go with crow.

55 thoughts on “Security Bitch Watch – Day 1.”

  1. Well, I’m lost too.
    But I still have MY toothbrush…

    My Pants™® are going to read the article and explain it to me.


  2. The toothbrushes have an exploit in their BSD layer. That bitch is gonna use your toothbrush….via bash!

  3. The best part of this post is the reemergence of the phrase “of doom”. This is an old Mega-Post trick, for all you johnny-come-lately’s (no offense, Moltz, it’s just coincidence that it’s ‘johnny’). Adding “of doom” to a noun really increases its potency. (That bitch of doom totally used your toothbrush). Back in the MP days, we used to combine body parts, power tools, and doom for added effect. (buttwrench of doom, thatchhatchet of doom, you get the picture [of doom])

    Package™® of doom™®

  4. My Manhammer (of doom) will …bash… your crow into edible toothbrush shaped apple cakes. And you can have a glass of Moo with that, Johnny “The Yellow Dart” Cache

  5. Bob doesn’t like third party anyway. He didn’t have such a great time at parties one and two. Bob of Doom.

  6. You are right Mr 2000guitars [of Doom]. Adding ‘of Doom’ to my name just made me more powerful. Now if only I could find a female of Doom to mate with! 😉

  7. Hey! I have just noticed for the first time that there is a kind of “article” above the posts. Quite funny too. I wonder if they do that every day?

  8. My iBook of doom is sure glad that he is an iBook (of doom), and that he has a good AirPort card (of doom) that can’t be hacked.

    Who would put a third-party card (of doom) in a MacBook (of doom) anyways?

    They come standard with the AirPort (of doom), which is probably an intel chipset (of doom!) due to the fact of them taking over everything.

    doom. ™ & ® the doom corporation (of doom)
    try some doom-o’s today!


  9. John,
    1) The reason I have a Mac is because they WORK and I am lazy.
    2) The reason I read CARS is because it is short, amusing and I am lazy.
    3) The above article is long. As well as being lazy, I possess the attention span of a goldfish. As such, I failed to grasp its full import.
    4) Despite this and being too lazy to question the article, I believe every one of Saint John of the Mac’s words.
    5) Looking forward to Friday’s Help Desk as I understand every subtle nuance. (You do ‘subtle nuance’, don’t you?)

  10. The Portentious Cataclysm of Doom embodied in a lit cigarette has dampened my enthusiasm ever so slightly.

    I would bleat in terror if only I could muster an iota of concern about nonexistant security exploits.

  11. It does seem a bit ludicrous. Hey check this out I’ve severely compromised a MacBook!

    [I used a third party card and driver that nobody would actually have]

    The best thing those guys have done for the Mac community is to tell us that there are third party wireless cards and drivers for Mac (or Apples). I was not aware of that. But I guess that helped them because everyone would assume it was an airport card.

    Notice use of italics, one step before bold in the getting over excited about one of these flame war things stakes…

  12. Looks like everyone is using everyone else’s toothbruch in this drama.

    Time for a trip to Wal-Mart for some new toothbrushi…

  13. I find it very retro that this story involves Maynard and Krebs. Maynard G. Krebs of Dobie Gillis fame has returned, and I for one am glad to see it. With all the toohbrushes, ponies, and ants-pay, it a pleasure to return to the simpler days of wine, women and living on the edge nuclear anniliation. I do hope the cigarette’s are non filtered. Those Parliments can really hurt.

  14. First: first. Got that outa the way.

    Second, yesterday when I said that the cigarette in the eye thing was cool and to press on, I meant go ahead and stick on in someone’s eye. Not keep bringing it up in the next post.

    Third, I should shut the *humm* up because the post was really funny. “Crowfurky” was killer. Followed closely by “crowfu”.

    Forth, good use of the words “scurrilous” (and derivatives) and “temerity”. Lets see if we can fit in “ribald” and “froward” tomorrow, kay?

    Fifth, I agree with Dr. Who. Seeing the words “Maynor” and “Krebs” used in such close proximity kept making me think of Dobie Gillis for some reason. Maybe there is a clue to this mystery somewhere in a Dobie Gillis episode. Now I sound like Scoobie Doo. Or the Hardy Boys or something. Remember that one? Shaun Cassidy was in it. He looked more like Nancy Drew than one of the Hardy boys to me. But my sister loved him. Go figure. I always had the hots for Kristy McNichol when she was younger. On Family. Though it was hard to put up with Willie Aames to get my Kristy fix. Ah, what we do for teenage lust. Man, looking at some old photos, she looked a bit like a dude back then. Her 1980s pictures were nice but… Uh, what was I thinking?

    Crow? Yea, I like the teriyaki crow on a stick!

  15. Nu uh. I resent the implications. I stand by my reporting, which was correct through a twisted web of logic that has absolutely nothing to do with what anyone else understood my articles to say, and everything to do with what I meant by the words in my heart of hearts.

    So there. Go buy some crow, SUC-KEERRR.

  16. It’s getting better and better, but it needs “pony” in there, as in:

    “That pony bitch of doom totally used your toothbrush!”

    I am worried though. I think once this phrase reaches perfection, the universe will infold and we will all return to the Entity’s ring… or a little charm around his cats neck or something.

  17. I have to agree with someone above about that thing.
    sorry for going too deep into details.

  18. Now I completely agree that Maynor and Ellch have COMPLETELY lost any credibility as security professionals, but there are legitimate reasons to have a third party card. Apple’s MacBooks are 802.11b or 802.11g. Not every place uses these standards. I have a 802.11a card because some of the secure facilities I need to work in uses them. (802.11a is less likely to have RF interference and has a shorter range so it is easier to dampen and keep within a small facility. The speed is comparable to 802.11g).

    Some people may need WiMax, or if traveling outside the country HiperLan. So Mac users do need to be aware of security issues when using third party cards. These guys though are media whores and should be treated as such. Do not let them use your toothbrush under ANY circumstances because who knows what you could catch.

  19. What’s up with the cigarette? What brand? Pall Mall (of doom)? Marlboro (of doom)?

    Dunno if a cigarette needs any “of doom”- seems like if you’re smoking, you’re already there….

  20. Dobie Gillis.. I’ve always felt too old, but maybe everybody else is (are?) the old farts.. Who the heck is Dobie Gillis?

  21. My two pack a day addiction is relatively harmless when compared to my 3 lb a day bacon habbit.

    Poking someone in the eye with a crispy slice of maple cured bacon (of Doom) can be almost as traumatic as a lit cigarette.

  22. Dobie Gillis is Gilligan. And he is all of us.

    Is a “habbit” a hobbit’s habit?

  23. When I loaded this page, I had to run and didn’t have time to post a comment. However, when the page loaded there were two comments, so I am therefore claiming third.

    You fuckers just try and stop me.

  24. Ou, Ou, Ou! Stop it it hurts!

    That said, several thoughts immediately leap to mind after reading this fine screed:

    Crow-fu is the martial art being practiced when a large, ill-tempered black bird pokes your eye out. No cigarette required!

    The Maynard-Krebs cycle is the process whereby slackers are fueled by hanging-out.

    Not enough cigarette smokers use toothbrushes. There may be bitches involved in this, but probably not.

    That wasn’t a roll of nickels. Everybody knows that Steve prefers to wield a sock containing a first-gen 10 GB iPod. Ou!

    Given a choice, I’ll go with the bacon.

  25. Do you think Steve’s monkeys are real flesh and blood monkey’s or robot monkey’s. My money’s on robot monkey’s of doom because real monkey’s don’t fly. Their probably produced at the sexbot factory.

  26. The Dobie Gillis Show was the live-action counterpart of Archie comic books. Dobie was Archie, Maynard G. Krebs was Jughead, there were various Betties and Veronicas, and there was a rich , snide fellow like Reggie.

    I’m not sure about Moose and Midge.

  27. Bro’, you are ON FIRE! This whole MacBook-hacked-not-hacked thing has really got your goat!

    Goatfu, furkey, whatever.



  29. Ah. I knew it, knew it, knew it. Moltz, or this so-called “CARS Staff”, IS the Evil Invisible Boys Choir (of Doom) coming to a city (of doom) near you.

    the whole Package™® (of doom)

  30. All of the above.

  31. filthy fucking hobbitses! I hates them! They have my toothbrush and I wants it back!

  32. No! I was just trying to inject that into the mainstream, so anything you can do to speed it along, I’m behind it 100%.

    I still reserve the rights to “Only the bagel has the correct aspect ratio.” Even though Psyko came up with that.

  33. lol, I’ll leave the bagel rights for you, you crazy-apple-rumor-money-grubbing-whore with god knows what kind of habbits(sic). Can I at least have the rights to “habbit” as well?

  34. Wha-huh? I don’t believe it…this is the most concise statement of the facts I’ve read on the Internet. Could CARS actually be thinking of a carrer in (gasp) SERIOUS JOURNALISM?!?

Comments are closed.