3 ms·
Except that (1) was completely normal executable program (albeit in not well-known "format", which windows has many) and was not in any way executed automatical
by dfox 8y ago
Except that (1) was completely normal executable program (albeit in not well-known "format", which windows has many) and was not in any way executed automatically (and has nothing to with Java). And (2) is VBA macro virus which again has nothing to do with Java.
- Const-me 8y agoThe comment I replied to specifically asked about other serialization interfaces. Both that VBS, and DOC/XLS, contain some code inside. But users though they are just data files, so they opened these things, running the code. Also, old MS office files were not limited to embedded VBA. They are OLE compound files, so a specially crafted file can create and run ActiveX objects (often implemented as Win32 DLLs registered under HKEY_CLASSES_ROOT key of the registry) installed on user’s system. This is very similar to the way Java serializer creates and runs objects when desterilizing data received from untrusted source.