3 ms·

This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the ma

by nivla 14y ago

This is true of any cross platform language, the job of making the exploit work across different OS gets efficiently transferred to the compiler. One of the main reasons I am worried if webkit becomes monolithic, zero day exploits, there will be no running away from it.

eksith 14y ago
It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.
- chc 14y ago
  You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
  - eksith 14y ago
    Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).
twistedpair 14y ago
Look at the exploits over the last few years. JS, JS in Acrobat, Flash, Java. Any sort of VM with sandboxing is fair game. So long for the really low hanging fruit of straight up VB attacks. Further still, there are attacks through even the most apparently harmless types like maliciously formatted images. If the web was my everyday world, I'd be concerned walking down the street that lines on the street would strangle me.

by nivla 14y ago

eksith 14y ago

It's not the language so much the isolation in the VM. Normally, there would be safegards against privilege escalation (since remote code execution is a feature, not a bug). This is just a factor of Oracle not paying attention to a product they bought. When Cisco let Linksys (in the consumer market) stagnate, we ended up with lackluster hardware. Not a big deal. When Oracle ignored Java in the consumer market, the damage is quite a bit more extensive due to its sheer ubiquity.

chc 14y ago
You're talking about something different than nivia was. That comment was in reference to "write once, run anywhere" meaning that malware became cross-platform. A malicious Python app can do malicious things on any platform with Python just like a malicious Java app can do bad things anywhere you have Java. The fact that this is exploitable through a browser plugin makes the risk of infection worse, but doesn't actually make it more cross-platform, per se.
- eksith 14y ago
  Yes but Python also isn't generally distributed the same way. You could argue the same about the C++ redistributable across Windows and even .Net (I think 4.0 runs on XP), but malware for these are still executables. Silverlight may be the only common ground, but then that's the same as Flash, Acrobat or similar plugin. And as you say it certainly doesn't run in the browser on so many disparate systems making watering hole attacks not nearly as damaging if there were to be Python malware in the wild (and I'm sure there are).

twistedpair 14y ago

Look at the exploits over the last few years. JS, JS in Acrobat, Flash, Java. Any sort of VM with sandboxing is fair game. So long for the really low hanging fruit of straight up VB attacks. Further still, there are attacks through even the most apparently harmless types like maliciously formatted images. If the web was my everyday world, I'd be concerned walking down the street that lines on the street would strangle me.