So Many Layers of Security, So Many Holes in Each Layer

At Pwn2Own an attacker used a chain of three exploits to penetrate three levels of security around InternetExploder8. It took him weeks to get around randomized location of software but he did. Others might see this as reason to add another layer of security. The hacker earned $thousands per week for his efforts. A malware artist might have earned $millions. I see this as an indication that M$ creates so many holes with each addition to its software bloat that smothering the software in layers will accomplish little. They might even make the software less efficient.

No one even bothered to attempt to crack Google’s Chrome. Even if Chrome could be penetrated if it is running on GNU/Linux there might still be a layer of security left. Bill Gates integrated IE so tightly with that other OS that if you own the browser you own the PC, and the network, and the server, and, soon, the cloud. No new layers of obscurity will protect that other OS from its fundamental flaw, that it was conceived as a single-user system.

About Robert Pogson

I am a retired teacher in Canada. I taught in the subject areas where I have worked for almost forty years: maths, physics, chemistry and computers. I love hunting, fishing, picking berries and mushrooms, too.
This entry was posted in technology. Bookmark the permalink.

7 Responses to So Many Layers of Security, So Many Holes in Each Layer

  1. oldman says:

    “Nice to see you agree by omission, there’s no defending Microsoft’s record on security.”

    No need to , they have earned it, as has the linux desktop.

    BTW, nice to see YOU agree by omission too!

  2. Richard Chapman says:

    Illuminating lies is not defending, it’s simply telling the truth. Nice to see you agree by omission, there’s no defending Microsoft’s record on security.

  3. oldman says:

    “Advice to Microsoft followers: There is no defending Microsoft’s security record. Just leave it alone. The more you try to defend Microsoft on security, the worse they look.”

    Advice to Linux followers. Stop defending the pile of antiquated and mediocre crap that is linux userland in the desktop world. The more you try to make excuses, the worse you look.

  4. Richard Chapman says:

    Microsoft: We will offer $200,000 for information leading to the arrest of the person who released the (some recent very bad Trojan/virus).

    Google: We will offer $20,000 for a previously unknown security hole in Chrome (possible Android too).

    Microsoft response to security: After the fact.

    Google response to security: Before the fact.

    Microsoft’s thinking on security: Not in customer’s best interest.

    Google’s thinking on security: Normal.

    Advice to Microsoft followers: There is no defending Microsoft’s security record. Just leave it alone. The more you try to defend Microsoft on security, the worse they look.

  5. Bender says:

    @ChrisTX

    Six weeks for a ONE person!! Most of the teams contain many more.

    Depends on where you find the flaw.

    Newsflash!! New code, new flaws! IE9 won’t be different than any software ever written from Microsoft.

    With the advent of the techniques sidestepping ASLR/DEP expect to see new waves of malware…

    “The sandbox was broken, but that only gives you user rights, same as if Chrome were broken on Linux”

    The difference is that we can additionally secure that with AppArmor/SELinux making it virtually impossible to break through.

  6. The malware artists have much more time than six weeks to work and to deploy their malware. He could install software and run it. At that point he could install an run just about anything whether or not he had privilege escalation. If he had DEP bypassed could he not run arbitrary code to do anything? Isn’t privilege escalation trivial in “7” once arbitrary code can be run? That’s why there are so many layers trying to prevent that.

    IE9 will have holes. The fixes for IE9 will have holes. Nothing will change even if the whole world used IE9.

  7. ChrisTX says:

    Few things on this: The sandbox was broken, but that only gives you user rights, same as if Chrome were broken on Linux.

    Plus, newsflash, IE9 RC is not vulnerable against any of these holes. So in 3 days (IE9 final RTW), that’s also settled.

    Then, this required six weeks work only to chain these vulnerabilities to get a reliable exploit. (Not to find these vulnerabilities, only to chain them)

    It is also known that some DLLs IE8 loaded are not relocateable, IE9 fixed that, too.

Leave a Reply