Browser Exploits Increasingly Go For The Jugular
Long the bane of the security industry, browser exploits just keep getting more dangerous as techniques grow more refined to get the most leverage from browser and browser extension flaws. According to speakers lined up for a lively panel session at Black Hat USA this week, achieving the highest levels of system privileges from a simple browser vulnerability has pretty much become de rigueur for attacks these days.
In a run-down of the exploits that took prizes in this year's Pwn2Own competition, members of the Zero Day Initiative (ZDI) program at Trend Micro are going to offer a number of observations about the techniques and methods behind this year's winning attacks. Among them is the key takeaway that attacks these days are going to increasingly go for the jugular -- namely achieving root privileges on the machine.
According to Matt Molinyawe, a vulnerability analyst and exploit developer for ZDI, this was the first time in Pwn2Own that every single winning submission in the competition was able to execute code to the highest privilege possible. That's across a pool of researchers who won a total of $460,000 for 21 discovered flaws.
