1

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

2

I think your question is much broader than you realize, but I'll try to give some sort of answer.

If you find an exploit in say, Internet Explorer, what would a program utilizing that exploit be able to do?

I don't know, depends on what the exploit is. The most dangerous kind of exploit that an application can have is called arbitrary code execution where an attacker can get the application to execute code that the attacker wrote. Think about this like the attacker is re-writing the code of internet explorer while it's running; they are literally turning IE into malware.

Would it be able to only change data in Internet Explorer, could it modify anything on disk, or could it modify only files that IE would be able to?

You basically just answered your own question. Yes, the attacker could get IE to do anything that a program is capable of doing - reading / writing files, sending stuff over the internet, making operating system calls (exploiting OS vulnerabilities if there are any), planting other malware and executing it, possibly modifying the registry, etc.

Since browsers are the most visible attack surface on an end-user's computer (it's the application that actually makes contact with malicious web sites), more and more browsers are running themselves in a sandbox so that if something malicious does get in, the damage it can do is minimal. Here's a nice article by How-To-Geek talking about sandboxes for your apps.

1
  • I think "exploiting OS vulnerabilities" is the most important part here. If the malware exploits a vulnerability in the OS that lets it execute code in kernel mode it can do literally anything that the computer can do. – Anders Apr 30 '16 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.