CNet is reporting on a competition set up by a Sweden-based Mac site called "rm-my-mac".
The competition set up a Mac mini as a server and invited hackers to break in and gain root control. The winner, identified as "Gwerdna", claims that he exploited a "vulnerability that has not yet been made public or patched by Apple Computer."
Arstechnica explores the exploit a little further and reveals that the competition was a bit unusual in that it didn't represent an entirely remote exploit:
The web site author had enabled SSH [ ... ] and added a web-based interface so that visitors to the site could add their own shell accounts to the system. These shell accounts were given limited user access, so in theory they should not have been able to access or modify any files that were owned by the system or by other accounts. The hacker used a vulnerability in OS X to promote the privileges of this account, thus "gaining root" and becoming able to modify any file on the computer at will.
The University of Wisconsin has posted a rebuttal challenge due to the "woefully misleading" coverage.
...this machine was not hacked from the outside just by being on the Internet. It was hacked from within, by someone who was allowed to have a local account on the box.
While this means your Mac OS X machine is still generally safe when connected to the internet, it shows you do need to be careful in providing accounts to individuals you do not trust.
