Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354225
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[4]: Operating System Security
by ciplogic on Fri 20th Mar 2009 21:55 UTC in reply to "RE[3]: Operating System Security"
ciplogic
Member since:
2006-12-22

What if it stoles your card data you are used to register to buy books from Amazon? Would you feel much safer that you know that your World of Warcraft is not attacked by the browser's exploit?

Reply Parent Score: 0

Adam S Member since:
2005-04-01

Assuming that's what actually happens, of course not. But a "vulnerability" doesn't mean he got access to all cookies, and it doesn't mean he had root on the system. Although, certainly if he found a buffer overflow, which is what it sounds like, that's not good.

However, there are plenty of vulnerabilities that don't expose your entire system.

Reply Parent Score: 2

Adam S Member since:
2005-04-01

Also interesting that you modded me down as "inaccurate." What exactly did I say that was inaccurate?

Reply Parent Score: 2

ciplogic Member since:
2006-12-22

Thank you for my chance to say why:

Pwn2Own have the clean rules, with increasing exposure of way to attack a machine, the attacker should get user data. Your post was: is not a big vulnerability as it doesn't do much worse as a root kit let's say. Pwn2Own tries to expose the security leaks in security model of the user land applications, mostly the browser and it's component as is the default application you may find in mostly every OS, even into a phone OS one, and in one way it do it really well.

The inaccuracy comes that probably the security is done by saving data, not applications. Is hard to do from userland a change of executables in Linux or using OS X limited user (or guest) or even XP limited account.

The most permissions tries to protect credentials and data and most of security tries also to do the same thing (Active Directory's permissions or better SELinux or AppArmor force the application in case of a buffer overflow or any other break, that may happen) to save data, not applications.

So for me it seems (with no offense, as you are a OSNews webmaster and you with Eugenia creates the OSNews site and I respect this deeply on you!) that you remember the security as a flaw of OS as it was in Windows 98-XP era, when viruses (all mallware) and scamware was the biggest problem.

So based on this thoughts I've seen that your post seems misleading... tell me if I'm wrong.

Edit: I'm not native English speaker so I've did fixes here and there

Edited 2009-03-20 23:51 UTC

Reply Parent Score: 2