Reply to thread

Message: <blockquote data-quote="hansakach" data-source="post: 2889586" data-attributes="member: 4419">Serious Security Flaw in Google Chrome (Carpet-Bombing)Google Chrome has quickly become one of our favorite browsers , but as Ryan Narraine, a security evangelist at Kaspersky Lab, reports, Chrome has also inherited a potentially serious security flaw from the old version of WebKit it is based on. An attacker could easily trick users into launching an executable Java file by combining a flaw in WebKit with a known Java bug and some smart social engineering.Security expert Aviv Raff, who first discovered this flaw, set up a demo of the exploit here. (Note: This page will automatically download a Java file onto your desktop). You can safely click on the download, as it only opens up a notepad application written in Java.Carpet-BombingThe problem here is that, after a user double-clicks the download at the bottom of the screen, this application is opened without any warning, which would allow a malicious hacker to easily execute any Java program on a user's machine.Two facts make this exploit especially embarrassing for Google. First of all, Google stressed the security of Chrome in both the official announcement as well as in today's live video demo just before the launch.Apple Already Did ItMore importantly, as ZDNet reports, Apple already patched WebKit against this flaw when it released Safari 3.2.1 in July, though only after the flaw had been known already for more than two months. Google, however, is using an older version of WebKit as the basis for Chrome.Social EngineeringObviously, this exploit only works because of the social engineering behind it. Just like some pop-up ads trick users into clicking "OK" because the ad mimics a typical system message in Windows, this exploit would trick users who are not yet familiar with Chrome's interface into believing that the download is actually just part of the web page.what do u say about this ???? <img src="/styles/default/xenforo/smilies/default/confused.gif"  class="smilie" loading="lazy" alt=":confused:" title="Confused    :confused:" data-shortname=":confused:" /> <img src="/styles/default/xenforo/smilies/default/confused.gif"  class="smilie" loading="lazy" alt=":confused:" title="Confused    :confused:" data-shortname=":confused:" /> <img src="/styles/default/xenforo/smilies/default/confused.gif"  class="smilie" loading="lazy" alt=":confused:" title="Confused    :confused:" data-shortname=":confused:" /> </blockquote>

Verification: Haya warak paha keeyada? (haya wadi kireema paha)

Top Bottom