parser is in javascript (google docs), in a sandboxed browser (chrome), in a system whose root partition is read-only, and hash-verified each boot and whose bootloader is in a physically-write-protected SPI chip.
good luck :)
back
1 comments
Oh, you're right, no one's ever been able to exploit javascript in chrome ;)
And you don't need to persist anything to disk, just get a key logger going in memory. Or scrape the data from your other processes. Once you get arbitrary code execution on the machine it's game over.
Seriously, I deal with this kind of stuff for a living. No one is immune to these kinds of attacks; not you, not me, not anyone.
google has a bug bounty ;)
https://www.google.com/about/appsecurity/chrome-rewards/inde...
Feel free to submit your function exploits that you say are so easy to make
Never said browser exploits are easy to make. I just pointed out that many times phishing is about just clicking on the link, not getting people to actually type in their passwords.