5 ms·

I wonder how many of these exploits are simply the result of the following five factors: o Windows o Internet Explorer o Java o Flash o Office People can whin

I wonder how many of these exploits are simply the result of the following five factors: o Windows o Internet Explorer o Java o Flash o Office People can whine all they want about Chromebooks not running non-cloud stuff, but IMHO, diplomats, executives, et al should be required to use locked down machines for communications, and training to educate people about opening email links should be widespread. I get emails all the time from my bank and credit card companies, but even if I visually inspect the link targets, I don't trust them, I always type in the location myself if it is a site that I know I'm going to enter important credentials into.

jiggy2011 14y ago
You can get them all to stop using Java/flash/office etc but then the attackers will just start to target whatever they switch to.
- eslaught 14y ago
  If "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation favorites. Sure, it's not impossible, but at least making exploitation more expensive will put the little guys out of business. And Google has sufficient money to throw at Chrome security that it will become more expensive over time, not less.
  - camus 14y ago
    web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.
    - eslaught 14y ago
      Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
      - kyllo 14y ago
        >plus anything else where the user used the same password Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?
        drivebyacct2 14y ago
        If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.
      - jiggy2011 14y ago
        attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.
enraged_camel 14y ago
You should read the article more carefully. As Schneier says in his post, amateurs target systems, whereas professionals target people. So the technology used doesn't matter very much at all. In most cases all you need to do is some social engineering to figure out people's soft spots.
deleted 14y ago
[deleted]

jiggy2011 14y ago

You can get them all to stop using Java/flash/office etc but then the attackers will just start to target whatever they switch to.

eslaught 14y ago
If "whatever they switch to" is ChromeOS + web apps, then it's going to be much more expensive to get past a Chrome sandbox than any of the current exploitation favorites. Sure, it's not impossible, but at least making exploitation more expensive will put the little guys out of business. And Google has sufficient money to throw at Chrome security that it will become more expensive over time, not less.
- camus 14y ago
  web apps are on servers that can be hacked. if facebook or twitter can be hacked so can b google docs or any SAAS.
  - eslaught 14y ago
    Of course. But that's very different from hacking the user's own machine, which effectively provides the hacker with access to everything the user does. Hacking a single service means that you merely get access to that one service, plus anything else where the user used the same password. And we already have technologies which would make it so that hacking a service would only give access to that one service, e.g. Mozilla Persona[1]. [1]: https://www.mozilla.org/en-US/persona/ https://www.mozilla.org/en-US/persona/
    - kyllo 14y ago
      >plus anything else where the user used the same password Assuming the service is storing unsalted password hashes that can be cracked using a rainbow table, or (god forbid) plaintext passwords, right?
      - drivebyacct2 14y ago
        If I have compromised a server, it's pretty trivial to have login.php also POST a copy of the raw user/pass to my server if I wanted.
    - jiggy2011 14y ago
      attack vectors and techniques are different, but everything else stays the same. If one can add a <script> tag to arbitrary webpages via a malicious extension,XSS or whatever other method then that's probably as good as/better than root. You are still not magically immune from buffer overflow, heap overflows or any of the other bread and butter stuff either.

enraged_camel 14y ago

You should read the article more carefully. As Schneier says in his post, amateurs target systems, whereas professionals target people. So the technology used doesn't matter very much at all. In most cases all you need to do is some social engineering to figure out people's soft spots.

deleted 14y ago

[deleted]