No Such Thing As A Secure Browser

No matter how many patches, fixes, updates, revisions or who the maker is, once again it has been proven no browser is totally secure. At the CanSecWest security conference hackers made toast out of Safari, Firefox and Internet Explorer 8 in a matter of seconds. Contest winners easily took home the prizes as the browsers toppled with ease.

According to a ZDNet article it stated this:

VANCOUVER, BC — Charlie Miller has done it again.  For the second consecutive year, the security researcher hacked into a fully patched MacBook computer by exploiting a security vulnerability in Apple’s Safari browser.

“It took a couple of seconds.  They clicked on the link and I took control of the machine,” Miller said moments after his accomplishment.

The contest kicked off at exactly 3:15 PM and, within seconds, Miller launched his drive-by attack and claimed the $10,000 top prize.  He also got to keep the MacBook machine.

Miller said he came to the CanSecWest security conference with a plan to hack into Safari and had tested the exploit carefully to ensure “it worked the first time.”

TippingPoint’s Zero Day Initiative has acquired the exclusive rights to the vulnerability and coordinate the disclosure and patch release process with Apple.

Technical details of the vulnerability will not be released until a patch is ready.

Next to fall was Firefox and IE8:

A security researcher named “Nils” (he declined to provide his full name) performed a clean drive-by download attack against the world’s most widely used browser to take full control of a Sony Vaio machine running Windows 7.

He won a cash prize and got to keep the hardware.  Details of the vulnerability, which was described by contest sponsor TippingPoint ZDI as a “brilliant IE8 bug!” are being kept under wraps.

Several members of Microsoft’s security response team were on hand to witness the successful exploit.

“Nils” also scored a clean hit against Apple’s Safari (he was the second hacker to exploit Safari) and, later in the afternoon, he exploited a Firefox zero-day flaw to claim the trifecta.

I seriously doubt any of us will see a secure browser or secure OS in our lifetimes. There are just way to many smart folks who can break into any software produced by man.

Comments welcome.

Source.