"First of all, I said that we would be talking about deprecated tricks, just silly things where the exploit environment would have to be set up such that one co

"First of all, I said that we would be talking about deprecated tricks, just silly things where the exploit environment would have to be set up such that one could use these tricks." Even the crusty old stack-based buffer overflow can still be exploitable if the people who wrote the code in question didn't use any mitigations. It's plugging my own work, but the Green Dam censorware vulnerabilities from June (http://www.cse.umich.edu/~jhalderm/pub/gd http://www.cse.umich.edu/~jhalderm/pub/gd) were stack-based overflows, and I got a remote shell in the lab through Firefox on Windows XP. Apparently, DEP was not properly activated in that build of Firefox. It's even worse with unpatched XP, which, IIRC, has no DEP at all.