Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354288
To view parent comment, click here.
To read all comments associated with this story, please click here.
middleware
Member since:
2006-05-11

Make exploit hard, yes. Exponentially? I don't think so. After Windows adopted some anti-exploit features, the exploiting become not so straightforward and not so handy. But, at last there is some programmatic way to automate the exploiting procedure as long as the anti-exploit features themselves are program. So it is one-shot effort to break the anti-exploit feature, not exponential. By saying anti-exploit is not bad, it is enough to make me NOT WRONG. It just doesn't matter.

Reply Parent Score: 1

PlatformAgnostic Member since:
2006-01-02

It's pretty costly to develop an exploit against a Vista flaw. From Immunity Inc:
http://www.immunitysec.com/downloads/ApologyofOdays.pdf

Page 37: From Bug to Reliable Exploit on Win2k - ~12 days

Page 38: SP2/2k3 - ~20 days

Page 39: Vista - ~40 days

If it takes that amount of time for an expert researcher who is known in the 'grey' community for coming up with exploits for difficult areas, then chances are good that the average pre-packaged vulnerability will be quite expensive and a lot of potentially purchasers will become discouraged.

Also if the learning curve for exploit writing is steep enough maybe people will stop looking so hard (who's going to spend that much of their life looking for something when few people ever succeed?).

Reply Parent Score: 3

middleware Member since:
2006-05-11

No, they won't stop before Vista. As Miller mentioned, it is simply economic. When it is more difficult to do, it has a better price on the market attracting more people to do it. And those 40 days comparing 20 days, the extra 20 days, means barely little. That extra time is not given to Microsoft to provide the patch, because the attacker won't report the bug to Microsoft when he/she starts exploiting it.

On the other hand, the anti-exploit actually increase the maintenance cost of a system. The core dump information will be messed and debug a crash becomes harder, too. Then the debugger must become more complex as well as the debugger itself becomes more buggy. And once a debugger is mature, its algorithm and implementation will be shared with a hacker to work around the anti-exploit feature.

Reply Parent Score: 1

Read more of this thread... >