3 ms·

And, I think of a nasty thing to do using this information... One can use this sRGB color profile and jam it full of 'complex color information' and know that

And, I think of a nasty thing to do using this information... One can use this sRGB color profile and jam it full of 'complex color information' and know that most sites won't do much with it. Instead, I'd bunch in there maybe 3-4 MB of information (or under size cap) and link the hell out of it. Who'd expect an avatar image to DOS a site?

mseebach 15y ago
> Who'd expect an avatar image to DOS a site? 26.media.tumblr.com is an Akamai server, and I suspect it takes more than large files to bring them down. Yes, you can wreak all sorts of havoc doing this, but I doubt you can actually take down Tumblr in any meaningful way, so it's not really a DOS attack.
shabble 15y ago
my favourite observed abuse of image metadata was an exploit for some forum, in which the (iirc) EXIF chunk contained a bunch of php exploit payload code, and the image itself was uploaded as part of the attack. The forum checked the image for validity, but of course it was. The actual flaw required getting the site to consider the image as a script file, at which point it ignored everything before the <?php and poof, owned.