5 ms·
So how can one protect against an image with a payload? Would the payload still be there if the image was rebuilt with Imagemagick?
by tehwebguy 9y ago
So how can one protect against an image with a payload?
Would the payload still be there if the image was rebuilt with Imagemagick?
- hans_castorp 9y agoDon't access your database with a superuser account from your application. Don't allow superuser connections from outside of your network.
- Cthulhu_ 9y agoDon't have superuser accounts at all if you can help it. Run Postgres in a limited user. Something that can't access any file or execute any command (like wget) it doesn't need, can't do chmod +x. Can't run a shell. Don't know if postgres needs that.
- anarazel 9y agoNo, postgres can't work without accessing files or having a working shell (latter kinda works in some limited configurations). And I don't think it's a reasonable idea to not have a superuser at all. But you can have it password less and only accessible from the local machine and a specific account (eg root).
- deleted 9y ago[deleted]
- waynecochran 9y agoIf the image is not lossy compressed (even if it is for the really clever) you can use a variety steganographic tricks to hide any data you want inside an image. Of course you have to have code to decode it.
- aiCeivi9 9y agoThat is not something you need to protect against, it was only used to make hosting malware code easier. For image hosting services it is required to process images anyway - for example to strip EXIF GPS data. It looks like imagemagick can't really do it for JPEGs: https://stackoverflow.com/questions/2654281/how-to-remove-exif-data-without-recompressing-the-jpeg https://stackoverflow.com/questions/2654281/how-to-remove-ex...