2

I'm a software engineer and I still don't understand how malware works or what an exploit actually is in software engineering terms. How do the contents of a website, say, or a file attachment to an email, become executable code on a PC?

File formats like HTML, JPEG, MP3, PNG, BMP, etc, are all read by another piece of software and so should only be able to do what that reader allows it to do. Something that reads a JPEG file can basically light up pixels using certain RGB values in a display window; there's nothing in the JPEG spec that says "create a .exe file and put it here in the file system and then execute it". So how do they corrupt a JPEG file to achieve that? Why would a legitimate JPEG reader have the capacity to execute arbitrary code on a PC, and how would those bits get written to the PC?

Even javascript, which is a scripting-language, is still read by an interpreter and doesn't have direct access to the host's file system - it's sandboxed and can't directly write to the host's file system.

Modern programming languages don't even do direct memory access with pointers like we used to with C in the 80's and I assume that the "buffer-overrun" vulnerabilities that existed in the old days are a thing of the past with modern OSes and hardware memory management. So even if I wanted to, I don't know how I would write bits into a block of memory I didn't have legal access to, and even if I managed to do that, how would I trick the OS into treating those bits as executable code and execute them?

So how, exactly, does a nefarious website create executable code on a modern PC with a modern OS?

closed as too broad by Matthew, Steve, Serge Ballesta, Anders, Stephane May 18 '17 at 14:49

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

2

Many of the questions in the original post have already been asked and answered elsewhere on this site. Entire books have been written on some of these topics.

I'm a software engineer and I still don't understand how malware works or what an exploit actually is in software engineering terms.

If the definition of what an exploit is in the context of computer security is not clear enough, it may be helpful to look at examples of exploit code. exploit-db is a good resource for this.

File formats like HTML, JPEG, MP3, PNG, BMP, etc, are all read by another piece of software and so should only be able to do what that reader allows it to do. Something that reads a JPEG file can basically light up pixels using certain RGB values in a display window; there's nothing in the JPEG spec that says "create a .exe file and put it here in the file system and then execute it". So how do they corrupt a JPEG file to achieve that? Why would a legitimate JPEG reader have the capacity to execute arbitrary code on a PC, and how would those bits get written to the PC?

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

How can normal files hide a virus?

Is it possible for a file that is non-executable and read-only to run malicious code?

How can a virus exist in an image?

Modern programming languages don't even do direct memory access with pointers like we used to with C in the 80's and I assume that the "buffer-overrun" vulnerabilities that existed in the old days are a thing of the past with modern OSes and hardware memory management. So even if I wanted to, I don't know how I would write bits into a block of memory I didn't have legal access to, and even if I managed to do that, how would I trick the OS into treating those bits as executable code and execute them?

Stack Overflows - Defeating Canaries, ASLR, DEP, NX

So how, exactly, does a nefarious website create executable code on a modern PC with a modern OS?

How can a modern Windows/Linux system be compromised by a heap overflow in Chrome?

Browser Exploits: Attacks and Defense

The AnC attack

CWE-94: Improper Control of Generation of Code ('Code Injection')

  • 2
    this is just a long list of links .... – schroeder May 16 '17 at 6:27
  • 1
    @schroeder I can delete it if you wish. It is intended as an extended comment illustrating the fact that the original post consists of duplicate questions and too-broad questions. There are at least 5 questions in the original post. Even the very last question asked is too broad, since browser, operating system, vulnerability and exploit are not specified. This is why I flagged the post as too broad. – julian May 16 '17 at 14:15
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review – Steve May 16 '17 at 15:33
  • @Steve Understood. It should be noted that most links here are to other questions on security.SE (this site) – julian May 16 '17 at 15:42
  • @SYS_V In situations like this - when you think the question is to broad and and there are lots of partial answers around - I think it is better to post the links in comments, and then flagging the question as to broad. – Anders May 17 '17 at 21:19
0

A very common way to exploit for instance jpeg-viewers and other harmless software tools is to trigger a buffer overflow. And then you could do exerything...

  • As I said in my original question, I know buffer overflows USED to be common in the old days when people wrote code in C and allocated big blocks of memory and only used parts of it, But modern hardware and runtime environments will trigger a fault if you access memory outside your object so how is a buffer overflow still possible in 2017? – user316117 May 22 '17 at 18:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.