Miller on Mac OS X, Chrome, Firefox, Economics
Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
E-mail Print r 11   · Read More · 138 Comment(s) http://osne.ws/gc3
Thread beginning with comment 354407
To view parent comment, click here.
To read all comments associated with this story, please click here.
middleware
Member since:
2006-05-11

No, they won't stop before Vista. As Miller mentioned, it is simply economic. When it is more difficult to do, it has a better price on the market attracting more people to do it. And those 40 days comparing 20 days, the extra 20 days, means barely little. That extra time is not given to Microsoft to provide the patch, because the attacker won't report the bug to Microsoft when he/she starts exploiting it.

On the other hand, the anti-exploit actually increase the maintenance cost of a system. The core dump information will be messed and debug a crash becomes harder, too. Then the debugger must become more complex as well as the debugger itself becomes more buggy. And once a debugger is mature, its algorithm and implementation will be shared with a hacker to work around the anti-exploit feature.

Reply Parent Score: 1

PlatformAgnostic Member since:
2006-01-02

I think you have a misunderstanding here. Anti-exploit technologies usually aim to make the program crash more readily when it is exposed to malicious data. If the crash happens closer to the point of failure, it becomes easier to understand the bug and to debug problems. None of the mitigation techniques we use increase the obfuscation of the code.

Reply Parent Score: 2

middleware Member since:
2006-05-11

I think you misunderstand the "obscurity" in the "security is not obtained by obscurity". Here, obscurity has nothing to do with the obscurity with the source code and, in some case, even the executable code. Here "obscurity" means lack transparency and straightforwardness.

I don't know what you mean by "crash more readily". Anti-exploit features do not prevent the crash, so it does not increase the stability. Either, it does not prevent a hacker from doing things malicious, but only slow him/her down. But as I said, time does not as much matter in exploiting as other attack-defense game. That's why I am skeptical about the anti-exploit.

In fact, in the exploiting world, there is a certain sort of bug which is by nature anti-exploiting. That's the heap corruption. Unlike stack, heap is dynamic, its location is almost random. So by natural a randomization feature is not too much obscure than a heap corruption. But even a heap corruption is attackable and there are a number of techniques to do so.

Reply Parent Score: 1