VANCOUVER, Canada--The security expert who won US$10,000 hacking a MacBook Air in less than two minutes last year won US$5,000 on Wednesday by exploiting a hole in Safari in 10 seconds or so.
Charlie Miller, principal security analyst at Independent Security Evaluators, used a MacBook running the latest version of the Mac OS as part of a contest at the CanSecWest security conference called "Pwn2Own", which is hacker slang for gaining control of a computer.
The security hole, which Miller said he discovered last year, allows a remote attacker to gain control of a machine simply by getting the computer user to click on a malicious URL, as Miller demonstrated.
"It's not easy, but this worked with one click" from the Safari browser, he said.
Miller is prevented by contest rules from revealing details of the exploit. He said he told Apple representatives what he planned to do earlier in the day. "They're happy because they get free research and get a bug fixed," he said.
The contest is sponsored by TippingPoint, which will share details on the exploit with Apple and develop a patch for it. TippingPoint is offering US$5,000 for each new exploit demonstrated in the major browsers and US$10,000 for each successful exploit in the major smartphones, as well.
Previously, Miller discovered a hole in the mobile version of Safari shortly after the iPhone was launched in 2007.
This article was first published as a blog post on CNET News.
Play video
There are currently no comments for this post.