Security: Relationship between operating systems and browsers

Today, it seems that Ryan's interview with Charlie Miller. This guy just captured the Safari browser at the cansecwest hacking competition.

 

For the full text of the interview, see:

 

Http://blogs.zdnet.com/security? P = 2941

 

 

One of the most interesting topics in the interview is:

 

Why safari? Why didn't you go after IE or safari?

It's really simple. safari on the Mac is easier to exploit. the things that Windows do to make it harder (for exploit to work), Macs don't do. hacking into MACs is so much easier. you don't have to jump through hoops and deal with all the anti-exploit mitigations you 'd find in windows.

It's more about the operating system that the (target) program is running on. firefox on Mac is pretty easy too. the underlying OS doesn' t have anti-exploit stuff built into it.

With my safari exploit, I put the code into a process and I know exactly where it's going to be. there's no randomization. I know when I jump there, the code is there and I can execute it there. on Windows, the Code might show up but I don't know where it is. even if I get to the code, it's not executable. those are two hurdles that Macs don't have.

It's clear that all three browsers (Safari, ie and Firefox) have bugs. code execution holes everywhere. but that's only half the equation. the other half is exploiting it. there's almost no hurdle to jump through on Mac OS X.

Security issues are a whole. The security of end users is related to applications and operating systems.