Mac OS X Top Target in Browser Beatdown

By Brian Krebs, washingtonpost.com, March 24, 2009; 9:00 PM ET

Legendary bank robber Willie Sutton was made famous for allegedly explaining why he robbed banks with the answer: "Because that's where the money is." So why do cyber crooks attack Web browsers? Because that's where the user is.

But maybe a more accurate answer is: "Because that's where the vulnerabilities are." At least, that was the answer given by a 25-year-old German computer science student known only as "Nils," who last week proudly showcased three brand new exploits for remotely hijacking the most popular Web browsers, including Firefox, Safari and the last beta release of Microsoft's Internet Explorer 8.

Nils was competing in the "Pwn2Own" contest at the CanSecWest security conference in Vancouver. That contest, sponsored by 3Com's TippingPoint, awarded contestants $5,000 per browser bug. The first person who can crack any of the browsers was allowed to keep the laptop it was running on (TippingPoint purchases information about unpatched security flaws but alerts the affected vendor and keeps the bug under wraps until the vendor has a chance to patch the vulnerability).

click here to read full article