4 ms·

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

by VRay 5y ago

teej 5y ago
It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-exploit-kit-hides-malvertising-code-in-image-pixels/ https://www.bleepingcomputer.com/news/security/new-stegano-e...
- tgsovlerkhgsel 5y ago
  This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.
  - cpeterso 5y ago
    Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.
- boomlinde 5y ago
  Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other. The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.
  - VRay 5y ago
    haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be
    - boomlinde 5y ago
      > if a country wants to spend a 9 figure sum After the initial investment in developing the exploit and before the vulnerability was patched, there would have been a near zero cost to hack any one user in particular.

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

by VRay 5y ago

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

teej 5y ago

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-exploit-kit-hides-malvertising-code-in-image-pixels/ https://www.bleepingcomputer.com/news/security/new-stegano-e...

tgsovlerkhgsel 5y ago
This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.
- cpeterso 5y ago
  Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.
boomlinde 5y ago
Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other. The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.
- VRay 5y ago
  haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be
  - boomlinde 5y ago
    > if a country wants to spend a 9 figure sum After the initial investment in developing the exploit and before the vulnerability was patched, there would have been a near zero cost to hack any one user in particular.