Tag Info

New answers tagged

1

Unrealistic? There was recent critical bug in font definition parsing: https://technet.microsoft.com/en-us/library/security/ms15-078.aspx and libjpeg changenotes are full of security advisories. Parsing files[1] is hard: overflows, underflows, out of bounds access. Recently there were many fuzzing tools developed for semi-automatic detection of input that ...


20

Agreeing with others to say yes this is totally possible, but also to add an interesting anecdote: Joshua Drake (@jduck), discovered a bug based on a very similar concept (images being interpreted by the OS) which ended up being named "Stagefright", and affected a ridiculous number of Android devices. He also discovered a similar image based bug in libpng ...


76

Is there such a thing? Absolutely. Feeding malicious input to a parser is one of the most common ways of creating an exploit (and, for a JPEG, "decompression" is "parsing"). Is this description based on some real exploit? It might be based on the Microsoft Windows GDI+ buffer overflow vulnerability: There is a buffer overflow vulnerability ...


-1

Yes this is possible: A new variant of the nefarious Zeus banking trojan – dubbed ZeusVM – is concealed in JPG image files, according to the collaborative findings of Jerome Segura, senior security researcher with Malwarebytes, and French security researcher Xylitol. The act is known as steganography – concealing messages or images in other ...


4

Here is a StackOverflow answer for Android: The tapjacking attack has been blocked at the OS level since Android 4.0. For such devices, you do not need to do anything to prevent tapjacking attacks. android:filterTouchesWhenObscured="true" helps on API Levels 9-13. It did not exist prior to that, and so that attribute will be ignored on older ...


0

If you didnt sanitize your file input AT ALL, the hacker might just uploaded a php shell like c99.php to your server. He could then access the shell control via yourapp.com/uploads/c99.php If you checked the content type of the request, he might uploaded the shell after changing the content type of the request to image/jpg through a HTTP POST editing tool. ...


0

With single-board computers (SBCs) such as the Raspberry Pi 2 (or B+, collectively referred to as "RPI", based on the Broadcom chips) and the USB Armory (based on the Freescale chips), you have to make decisions about how to proceed forward. First of all, Kali on ARM supports LUKS with NUKE -- ...


9

If the input is not carefully filtered, then that is a vulnerability called Server Side Request Forgery (SSRF). There is even a common weakness enumeration number and page for it. https://cwe.mitre.org/data/definitions/918.html By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly ...


5

Well depending on how they've implemented this feature it could indeed be quite dangerous. In addition to to the risks you've mentioned there's also the potential for non-public URLs to be retrieved by the system. For example retrieving http://127.0.0.1 would retrieve localhost. This can be a risk as things like administration panels are commonly deployed ...



Top 50 recent answers are included