meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 1 year |
| seen | Apr 19 at 21:28 | |
| stats | profile views | 1 |
|
Feb 11 |
comment |
How content-type:image can lead to infected JAR file? Also it's a sad thing that browser's editors don't take necessary measures to secure the MIME thing. It would be an efficient way to spot lots of malicious content, and even if most servers are set up wrong, they should do something to push the thing slowly (discreet warning messages, not loading by default, etc.). |
|
Feb 11 |
comment |
How content-type:image can lead to infected JAR file? Thanks for that answer. I didn't know neither the "GIFAR" stuff was even possible. |
|
Feb 11 |
awarded | Scholar |
|
Feb 11 |
accepted | How content-type:image can lead to infected JAR file? |
|
Feb 10 |
comment |
How content-type:image can lead to infected JAR file? Still my question remains : the exploit is not using malicious mails to spread, only webservers controlled by attacker, and I still wonder how it is possible that a modern browser doesn't alert you when a server tries to dissimulate a JAR file with an image Content-Type. This is undoubtely a malicious action from the server. |
|
Feb 10 |
comment |
How content-type:image can lead to infected JAR file? Thanks, I didn't know about the Content Sniffing stuff. Although I don't see why it's seen as a security issue : the files type/content should be checked by the browser, not defined by a server that of course can be controlled by an attacker ! |
|
Feb 10 |
awarded | Student |
|
Feb 10 |
asked | How content-type:image can lead to infected JAR file? |
|
Sep 10 |
awarded | Supporter |
|
May 12 |
answered | Will virus downloaded to guest OS affect Host OS? |
|
May 12 |
answered | What information is sought by malware researchers and those reverse engineering malware? |
|
May 10 |
comment |
Code auditing and/or fuzzing - Books and resources Thanks Ali, I'll have a look at the Bug Hunter's Diary. I've already read the WAHH which is very good indeed, but I'm only looking for system exploits there. Also google can be helpful but there is way too much stuff here, that's why I asked here for only the best resources :) |
|
May 8 |
asked | Code auditing and/or fuzzing - Books and resources |
