Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354124
To read all comments associated with this story, please click here.
Security is NOT Obtained by Obscurity
by middleware on Fri 20th Mar 2009 14:49 UTC
middleware
Member since:
2006-05-11

So the anti-exploit features are not bad, but do not matter a lot. If there is a venerability, it WILL be exploited however much effort need to pay. If it is harder to be exploited, the bug/exploit price will be higher and attracting more hacker. It is like a ostrich to believe there is venerability but nobody knows it because of obscurity.

I don't say providing those feature is bad, but they do little matter. Go to fix security hole and provide update as soon as possible. Make your applications running as least privilege.

Reply Score: 2

sakeniwefu Member since:
2008-02-26


I don't say providing those feature is bad, but they do little matter. Go to fix security hole and provide update as soon as possible. Make your applications running as least privilege.


Euh, did you read the same article as everyone else?

Specifically he said that once you use some OS-side security measure, an exploitable bug in an app becomes difficult to exploit, exponentially more so the more measures there are.

So, no, you are wrong and Apple IS wrong.

Reply Parent Score: 3

middleware Member since:
2006-05-11

Make exploit hard, yes. Exponentially? I don't think so. After Windows adopted some anti-exploit features, the exploiting become not so straightforward and not so handy. But, at last there is some programmatic way to automate the exploiting procedure as long as the anti-exploit features themselves are program. So it is one-shot effort to break the anti-exploit feature, not exponential. By saying anti-exploit is not bad, it is enough to make me NOT WRONG. It just doesn't matter.

Reply Parent Score: 1

Read more of this thread... >