Vuln Dev
RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API Sep 17 2007 12:26PM
Roger A. Grimes (roger banneretcs com) (2 replies)
RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API Sep 18 2007 01:29PM
pgut001 cs auckland ac nz (Peter Gutmann)
"Roger A. Grimes" <roger (at) banneretcs (dot) com [email concealed]> writes:

>I'm sorry, we'll have to agree to disagree. I don't see the new attack vector
>here. I, the attacker, have to make you download my malicious trojan program,
>which you install on your computer.

It's not so much the attack vector, it's the usability issue. This makes it
just too easy to convince users to download and execute untrusted content.

>But if you're worried that your users will click past 3 to 5 warning messages
>to install untrusted gadgets (which they will), then completely control them
>using group policy.

On Joe Sixpack's PC in his den?

(As you say, I think we'll have to agree to disagree on this one. Let's wait
until the phishers discover it and then revisit the topic :-).

Peter

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus