Mon, May 21, 2007 — Computerworld — Dino Dai Zovi, the New York-based security researcher who took home US$10,000 in a highly-publicized MacBook Pro hijack on April 20, has been at the center of a week's worth of controversy about the security of Apple Inc.'s operating system. In an e-mail interview with ComputerWorld, Dai Zovi talked about how finding vulnerabilities is like fishing, the chances that someone else will stumble on the still-unpatched bug, and what operating system—Windows Vista or Mac OS X—is the sturdiest when it comes to security.

Friday, the vulnerability was first identified as within Safari, but by Monday, QuickTime was tagged. Why the confusion?

I knew exactly where the vulnerability was when I wrote the exploit; that is part of the basic vulnerability research usually required to write a reliable exploit. I intentionally did not reveal where exactly the vulnerability was in order to prevent others from reverse engineering the vulnerability from those details. Initially, I was only revealing that the vulnerability affected Safari on Mac OS X, the target of the contest. However, now ZDI [3com TippingPoint's Zero Day Initiative] has been willing to publicly reveal that it affects many more system configurations, including all Java-enabled browsers on Mac OS X and Windows if QuickTime is installed. [Click here for a related article.]

As you were working with the vulnerability and exploit, did you know that it would impact non-Mac OS X systems?

I had suspected that it might affect other platforms running QuickTime, but I did not have time to look into it. You found the vulnerability and crafted an exploit within 9 or 10 hours.

And you've said "there was blood in the water." Does that mean you had a head start—in other words, prior research—or was it all built from scratch? Is it really that easy to dig up a vulnerability?

I had found other vulnerabilities in Mac OS X and even QuickTime in the past, so I had some familiarity with the code, but I only discovered this vulnerability that night. My quote that there was "blood in the water" referred to the fact that there were reports of other vulnerabilities in QuickTime, and even Java-related vulnerabilities in QuickTime over the last few years. In my experience, if a certain software package has had vulnerabilities in the past, it is more likely to contain other undiscovered vulnerabilities.

Halvar Flake and Dave Aitel, two prominent security researchers, use the fishing metaphor to explain vulnerability finding. Some days you go out and catch nothing, some days you catch something great. Sometimes you hear about some great fishing happening in a stream somewhere and there are lots of fish to catch until everyone else starts fishing there and the stream becomes overfished. In this case, I suspected that there would be good fishing in QuickTime and I got lucky and found something good in a short amount of time. This is far from the first time that I've gone fishing for vulnerabilities, however.