RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- From: pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)
- Date: Wed, 19 Sep 2007 01:29:55 +1200
"Roger A. Grimes" <roger@xxxxxxxxxxxxxx> writes:
I'm sorry, we'll have to agree to disagree. I don't see the new attack vector
here. I, the attacker, have to make you download my malicious trojan program,
which you install on your computer.
It's not so much the attack vector, it's the usability issue. This makes it
just too easy to convince users to download and execute untrusted content.
But if you're worried that your users will click past 3 to 5 warning messages
to install untrusted gadgets (which they will), then completely control them
using group policy.
On Joe Sixpack's PC in his den?
(As you say, I think we'll have to agree to disagree on this one. Let's wait
until the phishers discover it and then revisit the topic :-).
Peter
- Follow-Ups:
- References:
- RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- From: Roger A. Grimes
- RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- Prev by Date: RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- Next by Date: Uninformed Journal Release Announcement: Volume 8
- Previous by thread: Re: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- Next by thread: RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API
- Index(es):
Relevant Pages
|
