Hot answers tagged

95

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be downloaded, doing way more than the loader. It's like most malware ...


33

It really depends on the programming language and the context into which the code is being injected. For examples of what can be done in a very small amount of code space, check out the Code Golf Stack Exchange site.


23

It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is: 0: 54 push rsp 1: 5e pop rsi 0000000000000002 <y>: 2: 31 e2 xor edx,esp 4: 0f 05 syscall 6: eb fa jmp 2 <y> ...


14

As I am assuming that the 14 bytes within the video file triggers some memory vulnerability, as Peter Cordes said, those 14 bytes are machine code! That is a very important fact, as many people answering here is thinking about source code, characters and all. All of that takes ~8 bits / 1 byte per character. So with 14 characters, one possibly cannot do so ...


10

True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general. If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code ...


3

No, he cannot have recorded your traffic then decrypt it later. That takes an incredible amount of power and time. As for "downgrade attacks", those require an active connection. You manipulate the negotiation of the security between the server and the client and force a weaker level of security. That's obviously not possible when there is no connection or ...


1

Lucky13 and Sweet32 are both attacks on SSL/TLS, i.e. these attacks can be used to intercept the encrypted connection between the client and the server. In the case of a server that is vulnerably to Lucky13, an active attacker may be able to launch a MITM attack by exploiting this vulnerability. The same applies to Sweet32, but even a passive attacker may ...


1

This answer is inspired by my conversation with MechMK1 in the comments. The problem that MechMK1 points out in the comments basically boils down to authenticity, which is often seen as the achilles heel of public key cryptography. How can you be sure the public key purporting to belong to the person that you are attempting to connect with really belongs ...


1

For fourteen (or any number) bytes in a message to be executed would presumably require a bug in the O.S. But if executed, it could certainly call other code already in the system (the existence or nature of which might also be a bug). Or, in a JPEG, an embedded preview could contain more code called by the fourteen bytes.


Only top voted, non community-wiki answers of a minimum length are eligible