📸 Photo

OPPORTUNITIES

Explorer with unnecessary features and functionality. Every added capability expanded the attack surface of the browser. More code meant more bugs.

Now Internet Explorer holes were constantly surfacing. They were usually discovered by one of the good guys first: Microsoft's own programmers or a white hat who often, but not always, warned the company before detailing the hole on Bugtraq.

But once a hole was public, the race was on. Black hats worked to exploit the bug by setting up Web pages serving the attack code and then tricking victims into visiting them. Just looking at the Web page would yield control of the victim's computer, without any outward sign of infection. Even if the bugs were not made public, the bad guys could figure them out by reverse-engineering the vulnerability from Microsoft's patches. Security experts had been watching with dismay as the time between a vulnerability's announcement and its exploitation by black hats shrank from months to days. In the worst-case scenario, the black hats found a bug first: a "zero day" vulnerability that left the good guys playing catch-up.

With new Microsoft patches coming out nearly every week, even vigilant corporations tended to lag in installing them, and average users often didn't patch at all. A global survey of one hundred thousand Internet Explorer users conducted around the time of Max's effort found that 45 percent suffered from unpatched remote access vulnerabilities; narrowing the field to American users cooled the number only slightly, to 36 percent.

Max's attack was effective. After securing access to an employee's Windows machine, he hopped on the company's network from the inside, grabbed some trophies, and popped out like the chest-bursting monster in Alien.

"It was then that I decided to scrap my old model of penetration testing and include client-centric attack as a mandatory part of the exercise," he later wrote a white-hat colleague. "I've been confident about the 100 percent rate ever since."