Linked by Thom Holwerda on Thu 19th Mar 2009 06:44 UTC, submitted by Moulinneuf
Thread beginning with comment 353880
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[4]: Comment by Hakime
by sakeniwefu on Thu 19th Mar 2009 15:27
in reply to "RE[3]: Comment by Hakime"
Well, it's quite possible the other guys had also prepared for the browsers they worked on.
All of them had. The ones that didn't win didn't have any good exploit or had one but a recent patch had fixed it.
Nobody can find and exploit a bug in minutes, or even hours unless the bug is very noobish and can be found easily.
It's not 1983 anymore.
I am sincerely surprised by IE8/Win7 both falling. While IE8 was bound to be broken as any other browser, I thought IE in windows Vista+ ran in sandbox mode, or is that something you have to enable?
Maybe the sandbox isn't sandproof?
RE[5]: Comment by Hakime
by PlatformAgnostic on Thu 19th Mar 2009 20:10
in reply to "RE[4]: Comment by Hakime"




Member since:
2005-08-18
Well, it's quite possible the other guys had also prepared for the browsers they worked on.
Yeah, I was also wondering how he got control over the machine from the browser. Running code, sure, but that would still only be under the user account.
Then again, having "root" isn't what most malware is interested in anyway.
Aside from not being able to change system files and configurations it can still be quite damaging. You can still run botnets from a user account, for example.
Edited 2009-03-19 11:42 UTC