bugtraq - Re: Binary Planting Goes "Any File Type"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20110708191850.3966E10E2D1@smtp.hushmail.com>
Date: Fri, 08 Jul 2011 20:18:50 +0100
From: anonymous-tips@...hmail.me
To: security@...ossecurity.com, dan@...para.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk,
	si-cert@...es.si, cert@...t.org
Subject: Re: Binary Planting Goes "Any File Type"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dan seems to be on the money here, and remember - if the attacker
can get you to click on their file or open it, you are fscked
anyways.

Hence, it is moreso a "way to hide your .exe" unless I am very
mistaken...

(again, I hope I am doing the CC/BCC thing right, call me on it if
I aint)

On Fri, 08 Jul 2011 20:10:31 +0100 Dan Kaminsky <dan@...para.com>
wrote:
>And here's where your exploit stops being one:
>
>===
>Suppose the current version of Apple Safari (5.0.5) is our default
>web
>browser. If we put the above files in the same directory (on a
>local
>drive or a remote share) and double-click Test.html, what happens
>is
>the following:
>===
>
>At this point, Test.html might actually be test.exe with the HTML
>icon
>embedded.  Everything else then is unnecessary obfuscation -- code
>execution was already possible the start by design.
>
>This is a neat vector though, and it's likely that with a bit more
>work it could be turned into an actual RCE.
>
>On Fri, Jul 8, 2011 at 10:38 AM, ACROS Security Lists
><lists@...os.si> wrote:
>>
>> We published a blog post on a nice twist to binary planting
>which we call "File
>> Planting." There'll be much more of this from us in the future,
>but here's the first
>> sample for you to (hopefully) enjoy.
>>
>> http://blog.acrossecurity.com/2011/07/binary-planting-goes-any-
>file-type.html
>>
>> or
>>
>> http://bit.ly/nXmRFD
>>
>>
>> Best regards,
>>
>> Mitja Kolsek
>> CEO&CTO
>>
>> ACROS, d.o.o.
>> Makedonska ulica 113
>> SI - 2000 Maribor, Slovenia
>> tel: +386 2 3000 280
>> fax: +386 2 3000 282
>> web: http://www.acrossecurity.com
>> blg: http://blog.acrossecurity.com
>>
>> ACROS Security: Finding Your Digital Vulnerabilities Before
>Others Do
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wsBcBAEBAgAGBQJOF1gaAAoJEJicku1BO3ojW2sH/jrtAW8bvfPOhjohvGke9VSbASW9
PfDV4BOHGfhG6FS/7YfUDtqABf2zNI6NlrUdOz+bKvqfZ+ugv4LRMpMiBeSr9iklDadH
E3zT6r2XLXm5+blA2O8msk8bQaYT14FmCkY9ZTZxohhRkvI1l+9VFlFCAWfuWyJqLLul
pTY7xXIhSBWZnJX21/+sTT5/bxkoFqBSfCtdbPdIqL8ehlY/uaY590ElCCLLQA3zI5vV
HHZJ+HO6WE3vFziOMlQRMh2B6GEE/HUwNPLY9OTtOlhu7pfGpGnwIhlS5Hyj7CLH71XD
h5yXVhn1hmmqHYtZ+BNssgHBizvpxMUdnJKzxDGR7Vk=
=Xha9
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/