bugtraq - RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 19 Sep 2007 01:29:55 +1200
From: pgut001@...auckland.ac.nz (Peter Gutmann)
To: pgut001@...auckland.ac.nz, roger@...neretcs.com,
	Thierry@...ler.lu
Cc: bugtraq@...urityfocus.com, tmb@...35.com,
	vuln-dev@...urityfocus.com, webappsec@...urityfocus.com
Subject: RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API

"Roger A. Grimes" <roger@...neretcs.com> writes:

>I'm sorry, we'll have to agree to disagree. I don't see the new attack vector
>here. I, the attacker, have to make you download my malicious trojan program,
>which you install on your computer.

It's not so much the attack vector, it's the usability issue.  This makes it
just too easy to convince users to download and execute untrusted content.

>But if you're worried that your users will click past 3 to 5 warning messages
>to install untrusted gadgets (which they will), then completely control them
>using group policy.

On Joe Sixpack's PC in his den?

(As you say, I think we'll have to agree to disagree on this one.  Let's wait
until the phishers discover it and then revisit the topic :-).

Peter