Hackers find the IE vulnerability. Windows 7 is no longer fixed.

Some people say that Windows 7 is the most secure operating system launched by Microsoft. Is that true? In March 30, the Dutch hacker Peter Vreugdenhil was reported to be playing a role in CanSecWest Pwn2Own, breaking through a series of anti-attack obstacles. He used only two IE vulnerabilities to successfully hack into a 64-bit Windows 7 host with a complete patch.

Independent researcher Vreugdenhil specializes in finding and exploiting client software vulnerabilities. He used several techniques to bypass the built-in security protection on the two Windows platforms, ASLR (address space arrangement randomization) and DEP (Data Execution Prevention.

Vreugdenhil said: I first bypassed ALSR and asked me to get the basic address of the module included in IE. I used this information to avoid DEP.

Vreugdenhil won the $10 thousand cash prize and a new Windows computer. He used fuzzing techniques to find software vulnerabilities. Vreugdenhil said: I carefully look for this type of error in my fuzzing record, because I can avoid ASLR.

After finding a specific IE 8 vulnerability, Vreugdenhil took about two weeks to write a matched attack program.

Microsoft's IE team also witnessed the demonstration of Vreugdenhil. A spokesman for the company said they still do not know the details of the vulnerabilities. Once the information provided by the organizer is obtained, their security response procedures will be started immediately.