How the Bad Guys Get In-Host Application Insecurity