All Major Browsers Fall at Pwn2Own Day Two

Re:All Major Browsers Fall at Pwn2Own Day Two by eeeeeeeeeeeee on Friday March 20, 2015 @05:44PM (#9240851)

It definitely improves security, but you'll still be screwed against a targeted attack against a specific website.

The attack against Forbes.com is a good example. That is a site you would have whitelisted and the attackers compromised that website to then elevate access to the people browsing that site (government employees specifically targeted).

http://www.forbes.com/sites/thomasbrewster/2015/02/10/forbes...

[ Parent | on HN ]

Re:All Major Browsers Fall at Pwn2Own Day Two by rudolf0 on Friday March 20, 2015 @05:56PM (#9240899)

I work in incident response and actually investigated that watering hole firsthand at our organization. The SWF was hosted on a separate domain, so NoScript in fact would have prevented that specific attack from working even if you whitelisted forbes.com.

NoScript will very often block exploit chains from occurring even if it won't necessarily always block stage 1.

[ Parent | on HN ]