Behind Pwn2Own: Exclusive Interview With Charlie Miller

Introduction

You’ve probably seen the headlines: “Pwn2Own 2008: MacBook Air hacked in 2 minutes” or “Pwn2Own 2009: Safari/MacBook falls in seconds.” But there’s a story behind every headline and who better to get the story from than Charlie Miller, the man behind the headlines? We had the opportunity to chat with Charlie after his back-to-back successes in demonstrating zero-day exploits affecting the Mac.

Alan: Thanks for agreeing to chat with us today. Let's start with the basics. Our readers will know that you were the first to "take down" a fully patched MacBook Air at last year's CanSecWest. And this year, you had an encore performance when you took down a fully patched MacBook. Before we begin, why don't you tell a little bit about yourself? How did you get started in the security business?

Charlie: I'm 35 years old and live in St. Louis. I've liked tinkering around with computers since I was a kid, but got a degree in Mathematics. After that, it was five years of on-the-job training at the NSA. I'm actually probably best known for being the first to hack the iPhone. I'm currently Principal Analyst at Independent Security Evaluators, a small consulting firm in Baltimore, MD. 

Alan: You know I have to ask you. What was it like working at the NSA? Did you even know that you had an interest in Math when you entered college, or was your stint at the NSA the result of walking by the NSA booth at the college job fair?

Charlie: I liked Math. I switched majors a handful of times but always continued taking classes because I knew if I stopped I’d never be able to start again. As for the NSA, there’s not much I’m allowed to say, but I enjoyed my time there.

Alan: How much of your work today is focused on securing Macs vs. PC vs. Linux? Who is your typical customer?

Charlie: At work, I mostly look at application-level security. Most of this is really independent of operating system. For example, source code reviews or reverse engineering binaries doesn't depend much on the operating system. I've spent a lot of my research time on Macs because I like them and they also happen to be pretty easy to break!

Most of ISE's customers are small to medium size companies that care a lot about security and want to make sure their applications are secure.  The companies that only want a check box usually go somewhere else because we are pretty good at what we do and consequently charge more than many other consulting firms.

  • crisisavatar
    he was born to kill
    Reply
  • Niva
    Blah, sad he didn't give an estimate to linux security. He said it has some method of protection but didn't expand on that much...

    As osx market share grows we'll see more exploits.
    Reply
  • Silluete
    Interesting thing about sandboxing, it's mean chrome more safe than other browser? or i missing something here?
    Reply
  • lire210
    whats up mac
    Reply
  • pcfxer
    Chrome uses processes instead of threads. The difference is that the memory space for each process is different--better sandboxing.

    Processes have increased headroom: they are making a copy of local variables and structures at the time of "forking".

    Threads "fork off" as functional code and work with their own memory space... in a nutshell.

    Sandboxing doesn't mean that Chrome is safer, it does mean that if sandboxing is implemented correctly Chrome CAN be safer. Security is so relative ;).
    Reply
  • AlanDang
    Exactly, Chrome is currently safer than any other web browser on Windows Vista or Windows 7. We have an upcoming interview that talks a little bit more about this, but we haven't made plans on a dedicated article. Is that something people are interested in?
    Reply
  • echdskech
    AlanDangExactly, Chrome is currently safer than any other web browser on Windows Vista or Windows 7. We have an upcoming interview that talks a little bit more about this, but we haven't made plans on a dedicated article. Is that something people are interested in?count me in A
    Count me in. Come to think of it, I spend more time on my browser than any other piece of software (except the OS ofcourse) at any given day. primarily because I use it both at work for research and for play (ie reading articles here). Also, trend these days seem indicate it becoming more and more a target rather than the OS.

    Would be extra nice if the level of detail would be like the articles you guys write when a new cpu architecture is discussed. =)
    Reply
  • anthony lackey
    There is less ppl attacking Mac's because they aren't the mainstream. Hackers would rather try to infect as many ppl as possible thats why they target PC users.
    Reply
  • If Apple does not allow cloning mac os may be safe for a long while, nobody likes to be tied to a single hardware vender. I really don't see how Apple could pull more that 15% to 18% market share without clones. JMO.
    Reply
  • dedhorse
    Good interview. Makes up for that Mac review.
    Reply