Tag Info

Hot answers tagged

149

Is there such a thing? Absolutely. Feeding malicious input to a parser is one of the most common ways of creating an exploit (and, for a JPEG, "decompression" is "parsing"). Is this description based on some real exploit? It might be based on the Microsoft Windows GDI+ buffer overflow vulnerability: There is a buffer overflow vulnerability ...


38

Agreeing with others to say yes this is totally possible, but also to add an interesting anecdote: Joshua Drake (@jduck), discovered a bug based on a very similar concept (images being interpreted by the OS) which ended up being named "Stagefright", and affected a ridiculous number of Android devices. He also discovered a similar image based bug in libpng ...


8

Unrealistic? There was recent critical bug in font definition parsing: https://technet.microsoft.com/en-us/library/security/ms15-078.aspx and libjpeg changenotes are full of security advisories. Parsing files[1] is hard: overflows, underflows, out of bounds access. Recently there were many fuzzing tools developed for semi-automatic detection of input that ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


1

As others have pointed out, such attacks usually exploit buffer overflows. Regarding the nuts-and-bolts of how, it's called a stack-smashing atack. It involves corrupting the call stack, and overwriting an address to legitimate code to be executed with an address to attacker-supplied code, which gets executed instead. You can find details at ...


1

No, not directly. As you've observed, SGX ensures the freshness and integrity of transient state in memory, but doesn't provide any mechanism (like a monotonic counter) for ensuring freshness of persistent state. So if you just want to rely on SGX on the local CPU, you can't protect against state rollback attacks. The general solution to this problem is ...



Only top voted, non community-wiki answers of a minimum length are eligible