Home
FK_name FK_name's Library tagged → View Popular
Questions for Pwn2Own hacker Charlie Miller | Zero Day | ZDNet.com
On a scale of 1-10, how impressive was the Nils’ sweep of exploiting all three main browsers?
I was surprised. For IE 8, I’d give him a 9 out of 10. For Safari, maybe a 2. It’s just too easy to pop Safari. For Firefox on Windows, I give him a 10. That was the most impressive of the three. It’s really hard to exploit Firefox on Windows.
Really? What’s the difference between what you can do on IE but can’t do on Firefox?
The technique he used works against IE but not Firefox. It allows you to place code in a specific spot in memory. Mark Dowd and Alex Sotirov talked about this at last year’s Black Hat. You can use a technique to make .net not opt into the mitigations and jump over hurdled easily. With Firefox, you can’t do that.
For all the browsers on operating systems, the hardest target is Firefox on Windows. With Firefox on Mac OS X, you can do whatever you want. There’s nothing in the Mac operating system that will stop you.
You talked earlier about the value of vulnerabilities. Was it a surprise that he (Nils) basically gave up three “high-value” bugs for $5,000 each?
It’s clear he’s incredibly talented. I was shocked when I saw someone sign up to go after IE 8. You can get paid a lot more than $5,000 for one of those bugs. I’ve talked to a lot of smart, knowledgeable people and no one knows exactly how he did it. He could easily get $50,000 for that vulnerability. I’d say $50,000 is a low-end price point.
For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they’re paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac.
Is Michael Arrington One of the World's Most Influential People? | Fast Company
We want to cover all areas of the news where technology plays a part. The way to do that is through multiple properties that serve niche audiences. We'll have a master property that rolls up the most interesting parts into one big tech newspaper. Text wi
Talking to Disqus’ Daniel Ha | Mark Evans
If you write a blog or read blogs, one of the major challenges is managing comments.
PaidContent vs. TechCrunch: Two Visions of Blogging’s Future - Bits - Technology - New York Times Blog
“The big market for us is the trade media. Companies like Reed Elsevier, Nielsen, Incisive and Informa play in this market, not these blogs,” Mr. Ali said. “If CNet is the only target you can aspire to be, that is selling yourself really short.”
How to Deal with Requests for Your Salary History or Salary Requirements from Monster Career Advice
Can PR Save China? - public relations - toy recall - crisis
Recently, "Made in China" has been associated with dying pets, an amputated finger, poisoned children, and even toys that emit a date-rape chemical when swallowed. Can the country salvage its reputation?
Selected Tags
Related Tags
Sponsored Links
Top Contributors
Groups interested in interview
-
Joe Polish Interviews Brian Kurtz
Brian is a direct marketing...
Items: 1 | Visits: 46
Created by: joepolish
-
interview question
interview question
Items: 1 | Visits: 53
Created by: 刘 正刚
Highlighter, Sticky notes, Tagging, Groups and Network: integrated suite dramatically boosting research productivity. Learn more »
Join Diigo