Reigning Pwn2Own champion: "The main thing is not to install Flash!"

[A Guy]

With the Pwn2Own hacking contest coming up at Vancouver's CanSecWest security conference later this month, Italian computer security blog OneITSecurity took some time to interview Charlie Miller. Miller, in case you're not familiar, is a security expert who has won Pwn2Own two years running by hacking Apple's Safari browser with incredible speed. Safari isn't the only target -- this year, all major browsers and a selection of mobile operating systems will serve as Pwn2Own challenges - but it's fair to say that Miller knows a thing or two about keeping your browser secure.

Here are the highlights from Miller's interview:
He thinks Windows 7 will prove more secure than OS X Snow Leopard this year, in part because it doesn't have Java and Flash enabled by default. Windows' full ASLR (address space layout randomization) also gives it a security advantage.

When asked what he thought would make the safest OS and browser combo, he opted for Chrome or IE8 on Windows 7, with no Flash installed, although "there probably isn't enough difference between the browsers to get worked up about."

For my money, the juiciest quote from the interview was "The main thing is not to install Flash!"

On the mobile side, Miller guessed that the iPhone 3GS would be more easily exploitable than the Motorola Droid, mainly because the iPhone's been around longer, and has been subjected to more extensive security research.

You can check out Miller's full answers (in English or Italian!) at

http://www.oneitsecurity.it/01/03/2010/interview-with-charlie-miller-pwn2own/

http://www.downloadsquad.com/2010/03/02/reigning-pwn2own-champion-the-main-thing-is-not-to-install-fla/

A Guy

[safeguy]

Amazing to hear this from a ''hacker''....but honestly who in the world will use a browser with Flash not installed...it's becoming a sort of necessity for most...

[leofelix]

who the hell translated into italian that webpage? LOL
It is simply an horrible italian.
I think I'll get in touch soon with that italian blogger, I'm pretty sure he used google translate,

Well, there are people who are used to disable Flash Player, that's one of the options of JavaCool SpywareBlaster or some firefox add ons.

Thanks for heads up