4 ms·
Not to be rude, but in the USA (where SWIFT or bank wire transfers can be expensive) an email address as a recipient of an online fund transfer is a pretty comm
by 45h34jh53k4j 10y ago
Not to be rude, but in the USA (where SWIFT or bank wire transfers can be expensive) an email address as a recipient of an online fund transfer is a pretty common; ie: paypal, venmo, chase quickpay
now specifically in this case, lcamtuf (at google security) is joking and doesn't want your money.
this hack is actually pretty crazy - an arbitrary HTML / jpeg polyglot file that fooled a browser could be used for js injection, say from a site that allowed jpeg file uploads, and validated mime type.
- bluesmoon 10y agoThis has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories: https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.html https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.htm... https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex... The way we protected ourselves against it at <earlier company> (since we allowed image uploads at a variety of locations) was to decode and recode the image before storing and strip out comments.
- 45h34jh53k4j 10y agoI agree transcoding all user content is a must, but even that can be dangerous :-) as with ImageTragick which lcamtuf discussed here: https://lcamtuf.blogspot.com/2016/05/clearing-up-some-misconceptions-around.html https://lcamtuf.blogspot.com/2016/05/clearing-up-some-miscon...