3 ms·

google.com/?q=windows%2010%20market%20share google.com/?q=chrome%20market%20share

da_big_ghey 6y ago
Sure, but you must admit that there's probably a difference in the software used by security researchers and that used by average people. I know some who use linux for their day-to-day operations, and a few more who use OpenBSD. Though I'd say you're right that the majority (especially those who work in more "corporate" jobs) use either windows or mac.
- high_byte 6y ago
  That's not the point. the cover was a Windows exploit, "please run it", for whatever reasons, presumably collaboration followed by monetary rewards, respect, etc. Why would anyone run that code outside a sandbox? it is unclear. even more so a security researcher. Come on, it is a single click to launch a Windows sandbox... was the source extremely trustworthy? fine, that would be the same as giving your password to your spouse.
- numlock86 6y ago
  I wouldn't bet on every security researcher also being a security enthusiast and vice versa. Also it depends on your scope. Plus the attacks originated from conversations mainly via Twitter and other social media and email. I am probably wrong, but even a security researcher wouldn't boot up a readonly OpenBSD live system with a cli-based browser just to access Twitter, as you are trying to imply. Also the article mentions compromising people with forged VS Studio projects relying on Powershell. To me this is pretty much "average people" software.
- segfaultbuserr 6y ago
  This attack is particular nasty because it was not targeting security researchers personally but their exploits - which is more difficult to protect. Imagine I'm a developer who follows good security practice, I use the web, read mails, and write code in a fully up-to-date OpenBSD system, I use pledge() sandboxing and BSD jails routinely, and I don't open any untrusted nontext file due to its risks. Instead, I do all the risky security analysis in an insecure Windows machine. Now, if someone is going after me in person, I'm well protected. But if someone is going after my exploits, not so much, this setup has zero protection. If the machine contains PoCs from my previous projects, all of them will be stolen. Protection is possible (e.g. separating the test environment to "trusted" and "untrusted" parts, keep sensitive PoCs in the trusted system, do test/RE in an "untrusted" system, roll back the system image every time one finishes an "untrusted" work), but more difficult.
- swiley 6y ago
  IT is part of the business. The business says jump and you say how high or you join the people camping outside.
eeZah7Ux 6y ago
Nice try, but I expect a security researcher to understand the very basics of security and avoid putting sensitive data on untrusted OSes. People have been using testbeds with dedicated hardware since day 1 of computing.
- numlock86 6y ago
  Yup, I am sure you put all data from coworkers or business partners on a completely isolated and safe system first, too. Even if the premise is to work on an ongoing project of yours. Sure.

Sure, but you must admit that there's probably a difference in the software used by security researchers and that used by average people. I know some who use linux for their day-to-day operations, and a few more who use OpenBSD. Though I'd say you're right that the majority (especially those who work in more "corporate" jobs) use either windows or mac.

high_byte 6y ago
That's not the point. the cover was a Windows exploit, "please run it", for whatever reasons, presumably collaboration followed by monetary rewards, respect, etc. Why would anyone run that code outside a sandbox? it is unclear. even more so a security researcher. Come on, it is a single click to launch a Windows sandbox... was the source extremely trustworthy? fine, that would be the same as giving your password to your spouse.
numlock86 6y ago
I wouldn't bet on every security researcher also being a security enthusiast and vice versa. Also it depends on your scope. Plus the attacks originated from conversations mainly via Twitter and other social media and email. I am probably wrong, but even a security researcher wouldn't boot up a readonly OpenBSD live system with a cli-based browser just to access Twitter, as you are trying to imply. Also the article mentions compromising people with forged VS Studio projects relying on Powershell. To me this is pretty much "average people" software.
segfaultbuserr 6y ago
This attack is particular nasty because it was not targeting security researchers personally but their exploits - which is more difficult to protect. Imagine I'm a developer who follows good security practice, I use the web, read mails, and write code in a fully up-to-date OpenBSD system, I use pledge() sandboxing and BSD jails routinely, and I don't open any untrusted nontext file due to its risks. Instead, I do all the risky security analysis in an insecure Windows machine. Now, if someone is going after me in person, I'm well protected. But if someone is going after my exploits, not so much, this setup has zero protection. If the machine contains PoCs from my previous projects, all of them will be stolen. Protection is possible (e.g. separating the test environment to "trusted" and "untrusted" parts, keep sensitive PoCs in the trusted system, do test/RE in an "untrusted" system, roll back the system image every time one finishes an "untrusted" work), but more difficult.
swiley 6y ago
IT is part of the business. The business says jump and you say how high or you join the people camping outside.

eeZah7Ux 6y ago

Nice try, but I expect a security researcher to understand the very basics of security and avoid putting sensitive data on untrusted OSes. People have been using testbeds with dedicated hardware since day 1 of computing.

numlock86 6y ago
Yup, I am sure you put all data from coworkers or business partners on a completely isolated and safe system first, too. Even if the premise is to work on an ongoing project of yours. Sure.