Hot answers tagged

33

but the implication in the other question is that videos in question have been downloaded and played by media software on the target computer. No it is not. The implication is that there need to be a bug in the code handling the data. For instance the ffmpeg library is used in browsers like Chrome or Firefox and it had several serious bugs in the ...


11

A web browsers video system is just another video player, so the same problems apply which were mentioned in the linked question. The smaller set of supported video codecs greatly reduces the attack surface, but doesn't make bugs in the decoders for these formats inconceivable. The Adobe Flash plugin is renowned for its plethora of security bugs in the past ...


5

The relevant code for the HTML generation is the following: for (var i=0; i<posts.length; i++) { var html = '<table class="message"> <tr> <td valign=top> ' + '<img src="/static/level2_icon.png"> </td> <td valign=top ' + ' class="message-container"> <div class="shim"></div>'; html += ...


4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version ...


3

Everything published about this indicates that the FBI seized control of the onion webserver (in doing so, becoming one of the world's largest child porn distributors for a couple weeks, go feds) and then used a combination of drive-by-malware-downloads and known plug-in exploits (like Flash) to bypass Tor, rather than actually breaking it. So, no, the FBI ...


3

According to the Windows Internals 5th Edition book, the 5-bit ASLR bias for heaps is "multiplied by 64KB to generate the final base address, starting at 0, giving a possible range of 0x00000000 to 0x001F0000 for the initial heap". As such, the initial heap for IE on Windows 7 will always be between 0x00000000 and 0x001F0000, with 32 possible locations. By ...


2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information. Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key. Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield ...


2

Is this 100% likely to be a TOR/ Firefox exploit. While nobody except the FBI have the exact details everything known so far suggests that this is an exploit against the browser. It still needs to be delivered to the browser. The website in question is/was on TOR. Would the FBI's 'mystery exploit' work for uncovering the identities of Tor browser ...


2

The strcmp call and what leads to it is correct. Your second hunch, to somewhat suppress the signal, is the right one. signal(SIGABRT, SIG_DFL); … raise(SIGABRT); The call to raise raises a signal whose default action is to kill the program. The prior call to signal ensures that the default action is taken. When a process signals itself, this is ...


2

Make strcmp to be 0 Assuming a correct implementation of strcmp, this means argv[1] must match the contents of level08.pass exactly for 63 bytes or until the first newline/null byte. Since we don't know the contents of the file, our only option would be to manipulate argv[1] to point to an address in memory containing the correct string (e.g. ...


2

You should NOT. First, you don't know if the file is trustable, you got it from some "source". It is never advisable to install APKs from untrustworthy sources, especially on your primary device. Second, it contains a known vulnerability. Third, it is an offline game, and it requires full internet connection(it may be because of ads, but you never know ...


2

To examine a malicious PDF you can use: PDF Stream Dumper After installing PDF Stream Dumper, load the suspicious PDF file and start looking around. You can see different colors on the right side, where the red color shows headers with JavaScript tags. The tool includes a number of signatures of known PDF exploits. To scan the file, select Exploits Scan ...


1

To properly expand your thesis, you should probably read the rest of the article you posted. Under "Android and Google Service Mitigations" it explains the current posture of Google to deal with these threats. While the best solution is naturally to patch the OS at the lowest level the bug exists, it is effective enough to patch the apps in userland that ...


1

I'm talking about the type of exploits that you compile and that result in an executable that exploits a daemon (and not by passing specially crafted input through human input fields). They do so by passing specially crafted input through non-human input fields. A program that does something useful needs to interact with some other programs in some ...



Only top voted, non community-wiki answers of a minimum length are eligible