RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API

[pgut001 () cs auckland ac nz (Peter Gutmann)]

"Roger A. Grimes" <roger () banneretcs com> writes:

> I'm sorry, we'll have to agree to disagree. I don't see the new attack vector
> here. I, the attacker, have to make you download my malicious trojan program,
> which you install on your computer.

It's not so much the attack vector, it's the usability issue.  This makes it
just too easy to convince users to download and execute untrusted content.

> But if you're worried that your users will click past 3 to 5 warning messages
> to install untrusted gadgets (which they will), then completely control them
> using group policy.

On Joe Sixpack's PC in his den?

(As you say, I think we'll have to agree to disagree on this one.  Let's wait
until the phishers discover it and then revisit the topic :-).

Peter