full-disclosure - JPG worm!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ab13993b040920145970dd5eca@mail.gmail.com>
From: anthrax101 at gmail.com (Aaron Horst)
Subject: JPG worm!

Interesting. It would appear to not be a JPEG worm, but rather to be
the regular old CHM exploits. The interesting thing about it is that
it simply calls a link that was posted to FD last week.

The JPG is simply HTML, which loads http://www.xf*s.com/msn/1.jpg into
the main page, with http://www.xf*s.com/msn/news.htm in an iframe.
(Note: Change * to 2, to protect the unpatched IE users). I'm not sure
why that would be processed...

However, news.htm was plugged by Nicolas Montoza <xonico@...il.com> last week:
http://lists.netsys.com/pipermail/full-disclosure/2004-September/026475.html

AnthraX101