The Resuts – Pwn2Own 2017 Day Three

Re:The Resuts – Pwn2Own 2017 Day Three by daeken on Sunday March 19, 2017 @12:08PM (#13907897)

Interesting perhaps, but useless. The number of successful attacks we see on a product is an equation taking in the number of interested parties, the amount of collective experience (in the product) those parties are able to draw from, and the relative reward that the attack can give you.

Assuming that the reward doesn't drop (and it certainly hasn't -- that's gone up every year as VMs have become more and more critical), the collective knowledge keeps growing and thus this will always trend towards more attacks, not fewer.

[ Parent | on HN ]

Re:The Resuts – Pwn2Own 2017 Day Three by walterbell on Sunday March 19, 2017 @12:42PM (#13908109)

The layoffs were only a year ago and the product itself was in a mature/stable market, which was one reason for the layoffs. Pre-layoff, VMware's desktop hypervisor had existed and been attacked for more than a decade. Other complications are a shrinking PC market and new versions of Windows.

[ Parent | on HN ]

Re:The Resuts – Pwn2Own 2017 Day Three by nickpsecurity on Sunday March 19, 2017 @02:51PM (#13908893)

That's only half the equation. The other half is the complexity of the design along with its assurance activities. It's why the security and separation kernels with user-mode VMM's either had no or few flaws in pentesting. Whereas, VMware's techniques take a pile of complexity, are built with less assurance (see parent comment), and process malicious inputs in privileged modes.

Definitely designed and assured to be shattered. I'd like to see what results they get on mCertiKOS or Muen.

[ Parent | on HN ]