3 ms·
The guys that did the RSA hack would have found another attack vector even if Flash wasn't installed. Maybe they would have gone for a Java applet based attack
by 9999 15y ago
The guys that did the RSA hack would have found another attack vector even if Flash wasn't installed. Maybe they would have gone for a Java applet based attack, or perhaps in the future they'll target WebGL. The more complex your browser's capabilities are, the more surface area you have exposed to attack. Even if you reduce that surface area considerably, for example, by switching over to text only browsing for all of your employees, a motivated attacker would probably just find some way to cause a buffer overflow in the browser's text parser... Where there is a will, there is a way.
- Lagged2Death 15y agoThe guys that did the RSA hack would have found another attack vector even if Flash wasn't installed ... The more complex your browser's capabilities are, the more surface area you have exposed to attack. Perhaps, but interestingly enough the attack wasn't against a web browser, but against Excel running a Flash applet. Maybe that path was chosen because it's less carefully examined by security policy and security software; I don't know. In any case, it's certainly true that this pathway wouldn't have been available if not for the unnecessary use of Flash in places where it doesn't belong, i.e., Excel. Which ties into the theme here rather nicely; Flash used unnecessarily is worse than Flash eschewed entirely.