Chris Brook

About

"Distrust and caution are the parents of security" - Benjamin Franklin

ASLR + DEP Bypass Puts Hackers Ahead

When Microsoft shipped Windows Vista,  the addition of security technologies like ASLR (Address Space Layout Randomization) alongside DEP (Data Execution Prevention) and SafeSEH were held up as major roadblocks to hacker attacks.   With every new service pack of OS upgrade, these mitigations got stronger and stronger but, at Pwn2Own, attackers found ways to bypass and defeat these mechanisms.   In typical cat-and-mouse fashion, this shows that the skilled, dedicated hackers with the right motivation will always find ways to stay ahead of the security technologies.

Google Chrome Survives: Most Secure? Nope

The only browser that survived Pwn2Own this year was Google Chrome.  This led to numerous news reports like this one suggesting that Google’s browser was somehow more secure than the others.  This is far from the truth.  In fact, the vulnerability that caused the iPhone’s downfall was in the WebKit engine and also affected the Google Chrome browser.

Dedicated Attackers Will Always Win

Despite the multitude of anti-exploit mitigations built into modern operating systems (ASLR, DEP, Sandboxing), hackers were able to compromise every major target this year.  This is confirmation that dedicated attackers with the right (financial) motivation, will almost always find a way to break into computer systems.  It also highlights the difficulties businesses face when trying to thwart targeted attacks that combine zero-day vulnerabilities/exploits with clever social engineering lures.   The dedicated targeted attacker will, in almost every case, win.

10 Lessons From The Pwn2Own Hacker Contest

by Chris Brook

The recent CanSecWest Pwn2Own contest saw successful hacking attacks against Microsoft Internet Explorer 8, Mozilla Firefox and Apple’s Safari and iPhone products.  Now that the dust has settled and the vendors are starting to patch the vulnerabilities, Threatpost editor Ryan Naraine takes a look at the real-world implications of the contest and the lessons learned.

Annoyed by Facebook games

by Chris Brook

Many people play games on Facebook. Some of them are fun. But if you’re not interested in a specific game and its messages are getting really annoying, you can make sure you get NO messages from them by going to their page and choosing to block the application.

Status Update privacy

by Chris Brook

You should be aware that when you type a status update, you can also set the privacy of that status posting like you were creating an album.

Photos

by Chris Brook

On the left is the default. You want to turn off Everyone. And change Networks so none of your networks will get automatic permission (unless you specifically want that, like old school pictures).

Then choose whether you want Friends of Friends, etc., or to customize, choose Some Friends.

Then start typing the names of your groups and choose the set(s) of people you will allow to see this album.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.