Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Signed software doesn't matter when it comes to the most common methods of execution: Java, Flash, PDF exploits, Flash objects embedded in Microsoft Word documents currently bypass the sandboxing in both Word and Adobe Flash.

In other words, this isn't going away.



Read the article. They aren't clever enough to do that, they just get their users to install the software for them.


Sounds like they need a better sandbox :)

Signing does matter. Those may still be exploitable to run arbitrary code, but you cannot write code to disk that will get executed on start-up. The victim would have to open the same PDF every time they use their computer.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: