New answers tagged

-1

That highly depends on your threat model. In some cases it is not safe to browse with a patched OS, let alone an unpatched one. You are far more aware about what you stand to lose. Don't base your threat model on what a privileged person in another country thinks you should be concerned about. Having said that, exploitation in the wild can go undetected for ...


0

iOS 13.1.3 iOS 13.1.3 includes bug fixes and improvements for your iPhone. This update: • Addresses an issue that could prevent a device from ringing or vibrating for an incoming call • Fixes an issue that may prevent opening a meeting invite in Mail • Resolves an issue where data in the Health app may not display correctly after daylight savings ...


0

For fourteen (or any number) bytes in a message to be executed would presumably require a bug in the O.S. But if executed, it could certainly call other code already in the system (the existence or nature of which might also be a bug). Or, in a JPEG, an embedded preview could contain more code called by the fourteen bytes.


20

It can absolutely fit. For example, this CTF challenge solution attacks a binary that executes ~12 bytes. The payload sent is: 0: 54 push rsp 1: 5e pop rsi 0000000000000002 <y>: 2: 31 e2 xor edx,esp 4: 0f 05 syscall 6: eb fa jmp 2 <y> ...


14

As I am assuming that the 14 bytes within the video file triggers some memory vulnerability, as Peter Cordes said, those 14 bytes are machine code! That is a very important fact, as many people answering here is thinking about source code, characters and all. All of that takes ~8 bits / 1 byte per character. So with 14 characters, one possibly cannot do so ...


9

True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general. If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code ...


85

Yes, it can. It could be just the trigger vulnerability which would load data on specific areas of the movie in memory and execute. The malicious part can be pretty small, and the payload could be stored elsewhere. After extracting and executing the payload, additional modules can be downloaded, doing way more than the loader. It's like most malware ...


29

It really depends on the programming language and the context into which the code is being injected. For examples of what can be done in a very small amount of code space, check out the Code Golf Stack Exchange site.


0

As defalt said... You can delete your mesages on both phones but it will leave a watermark... If the whole chat was emptied the your friends phone migth be hacked... But this is very unlikely The only vuln found to gain acces via whats all is this [cve-2019-11932] and it was patched last year


6

Consider a segfault caused by trying to access memory location 0x0 (ie a null pointer de-reference). Maybe one part of the code thought it was done with a variable and set the pointer to null, and maybe under normal operations it really is done with it, but fuzz testing found some edge-case where something tries to read that variable again after it was set ...


20

Many crashes aren't exploitable for anything except denial-of-service (DoS). The most common example would be a NULL pointer read; attempting to dereference a pointer to (or anywhere near) 0 will fail, and unless the exception/signal is caught will cause the program to crash. However, just because the program tries to read from zero when given invalid input ...


3

This is not an exploit, as there is no underlying vulnerability to be exploited. It's more akin to malware, in the sense that it does something malicious on your system. As you probably know, .bashrc and .bash_profile run after a user runs bash and authenticates successfully. This is not a vulnerability and very much so by design and/or necessity, however ...


1

Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too. Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware ...


1

I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated. As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home ...


9

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (...


2

There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown ...


2

Piquing my interest, I wanted to do some research and found that these types of cases are relatively common. In cases like this, if your Security & Privacy settings are still set to default and bluetooth is regularly used in conjunction with the Public folder, then yes, there's the potential that someone could gain access. But, only to that Public folder....


3

After seeing multiple answers with mixed conclusions here and in Google searches, as well as no thorough explanations on whether or not Windows 7 is effected by this vulnerability, I took it upon myself to determine the true answer and show my testing process. Below are screenshots of a fresh Windows 10 installation in a Virtual Machine(VM) within which I ...


2

This post on the SANS ISC InfoSec Forums website states Windows 7 is not affected. . .The affected library, crypt32.dll (CryptoAPI), is present in older versions of Windows, including Windows 7. But not all versions of this library are affected. and CMU CERT Coordination Center Vulnerability Note VU#849224 explains Windows 8.1 and prior, as well as ...


2

First off (only because you mentioned "realistic"), this is not exactly a realistic scenario for a 64-bit system. The main reason is that the address space is much much larger, which makes it much more difficult to predict and land within your NOP sled. For a more detailed explanation, see this answer. Also, no-execute-stack (NX) is almost universally ...


0

I do not agree that negative rings are false rings. They are quite real. Let's take -1 for example: having control of it almost guarantees having control over anything starting with 0 (with very few exceptions). Nothing unreal about it. Here's how I see it today: Ring 3 - user-level Ring 2 - driver level (actual drivers) Ring 1 - driver emulation level (...


Top 50 recent answers are included