Monthly Archives: April 2010
Old trick with byte. Bypassing the “Safe HTML” filter.
Sending attachments over email can sometimes be a game of getting around content filtering rules. Especially when you’re in the security field and you are sending something that may look like a security threat. Recently we found ourselves needing to send out attachments with HTML code to a user who was checking their mail with [...]
Security Dialogs and Graphics
Something I take for granted working in the “IT industry” are the many different security dialogs and graphics I encounter. I am generally wise enough to interpret the security graphics and input choices put before me and make a well reasoned decision about the consequences of taking a particular action. I know enough about SSL [...]
PDF Ownage: It is getting ugly out there
As previously documented the PDF format is full of fun items, like the /Launch action, that allows the execution an arbitrary binary to be executed. Within two weeks of Didier Steven’s article about his PoC a number of researchers (myself included) and malware authors have been getting in on the act. The current news is [...]
WebOS: Examples of SMS delivered injection flaws
(Note: the findings herein affect WebOS 1.3.5. Palm has since released WebOS 1.4, which fixes these vulnerabilities, though not all handsets or carriers are running this version. Due to contractual agreements, the public disclosure of this information was delayed.) Intrepidus Group has been doing mobile application security testing for over three years now, and during [...]
An executable wolf in a PDF sheep’s clothing
A few of us over at Intrepidus Group have been following the recent issues with the PDF format and the software that renders PDF documents closely. Didier Stevens has an excellent blog detailing his work with the PDF format. A recent podcast from Eurotrash Security included an interview with Didier. Based on his research, the [...]
SSL Mystery Theater
Some frightening chatter from the mozilla.dev.security.policy list. A root certificate that would appear to be owned by RSA has been included in the NSS root store for the better part of a decade, and expires in 2026. Unfortunately, RSA does not claim to own it, and its true origin is currently unknown. “The lack of transparency [...]
XKCD – cool shell!
If you havent been over to XKCD to see their new shell, go check it out: http://xkcd.com/ http://github.com/chromakode/xkcdfools/blob/master/xkcd_cli.js <– badass guest@xkcd:/$ vi You should really use emacs. guest@xkcd:/$ WHAT Unrecognized command. guest@xkcd:/$ rm -Rf / guest@xkcd:/$ woo Unrecognized command. guest@xkcd:/$ su God mode activated. Remember, with great power comes great … aw, screw it, go [...]
