Re:All Major Browsers Fall at Pwn2Own Day Two
by drzaiusapelord on Friday March 20, 2015 @05:04PM
(#9240683)
The few times I've caught on-load viruses was when visiting big sites. Turns out their ad networks often get compromised and suddenly reddit or facebook are loading exploits.
Virtualizing and sandboxing the browser in a secure way is the only way out of this. On top of an eventual move to memory safe languages.
Re:All Major Browsers Fall at Pwn2Own Day Two
by javajosh on Friday March 20, 2015 @07:17PM
(#9241245)
That's a damn good point. It also means that ad networks and CDNs are the best targets.
Re:All Major Browsers Fall at Pwn2Own Day Two
by branchless on Friday March 20, 2015 @02:46PM
(#9239800)
The lovely choice:
1. facebook where the NSA are checking on you
2. faceskibook where a Russian hacker is going to own your pc
The real nightmare scenario is when developer machines get hacked and attackers get access to source, but also to build servers where they can inject binaries into the web deployment stream, which themselves exploit end-user browsers. This is, I think, a very good reason to not give devs any access to build/CI servers. (Ironically, actual endpoint servers are slightly less critical to secure from devs.)