Instant Messaging Vulnerable To New Smiley Attacks 170
titus writes "Security researchers Yoann Guillot and Julien Tinnes have found a way to encode malicious code into smileys and provided a proof of concept encoder to automate the process. The researchers said their discovery paves the way for IM malware that would be impossible to detect since the malicious code would be 'indistinguishable from genuine chat messages.' I've tested the proof of concept code which works very well. Time to panic?"
Virus Smiles!?! (Score:4, Funny)
Re:Virus Smiles!?! (Score:5, Funny)
Re: (Score:2)
Thanks for joining my botnet by reading this comment! :)
Re:Virus Smiles!?! (Score:4, Informative)
It is not wise to post such things... there are people who actually would paste that into a terminal despite your warning.
The way it works is as follows: :(){ something } # this is a valid function declaration which does something
program1|program2 # this runs both program1 and program2, and pipes the output of one to the other
command& # this runs a command in the background (i.e. non-blocking)
; # this is a line break
: # this is a valid function call
So, it makes a recursive function which calls itself twice from within the body of the code. Since it calls itself non-blocking, there is no infinite recursion error. On the next line, it calls the function.
So, each parent function call spawns two children, and each child spawns two children, et cetera. This can easily bring down a system that is not securely configured (that is, most systems).
Re: (Score:2)
Even knowing what a fork bomb will do .. I still want to try it. Can't wait to get home to my VM now.
Re: (Score:3, Funny)
Re: (Score:2)
Were they sending this? :(){ :|:& };:
Re: (Score:2)
Woosh!
Re: (Score:3, Insightful)
Then all of the participants had lots of kids. Lots and lots and lots of kids.
Re:Virus Smiles!?! (Score:5, Funny)
Granny: idk my bff jill?
I'll go kill myself now.
Re: (Score:2)
Mechanic: Somebody set up us the bomb.
Operator: We get signal.
Captain: What !
Operator: Main screen turn on.
Captain: It's you !!
Take that! :-) (Score:5, Funny)
Re: (Score:2)
Re:Take that! :-) (Score:5, Funny)
Ack! Now I'm :-) infected. How could :-) you go posting :-) such a virulent :-) virus where :-) everyone could see i:-)t? I thin:-)k th:-)e inf:-)ect:-)ion's g:-)et:-)tin:-)g wo:-)rs:-)e n:-)o:-)w. I:-)'m of:-)f t:-)o pa:-)t:-)ch:-) m:-)y s:-)ys:-)te:-)m. :-):-):-):-):-)
Re: (Score:2)
Looks like your grammar was infected as well.
Re: (Score:2)
Fortunately (-: reverses the :-) infection. (-:
The trick is getting the infectious smilies and disinfecting smilies into perfect balance. McAfee and Symantec will have products available for that shortly, sure to take your smile away when you pay them for the anti-smile software.
Re: (Score:3, Funny)
You can use a good programming editor when posting, something with syntax highlighting and parensbcwsmilies matching to keep your smilies properly balanced.
I guess the way the infection works is you put so many smilies to make the message look like some sort of lisp code. The IM software gets confused, starts a lisp interpreter to make some sense of it, the unbalanced parenthesis cause a buffer overflow in the parser, ...
Re: (Score:3)
*grin*
Re: (Score:2)
What's funny is that my first reaction as I read the article was, "doesn't yeast produce wastes that are foreign and toxic to the human body?" And wouldn't you know it, the next section was entitled, "Waste problem". Guess they're reading my mind. :-P
:(
Re: (Score:2)
Oops, sorry, that was a failure of copying, pasting, and previewing... uh... intentionally. April fools?
:) and :-) (Score:2, Interesting)
Re: (Score:3, Funny)
Awesome (Score:2)
; ) .... now u r mine
Re: (Score:2)
Watch out, here comes a cyber-attack from China
Re:Awesome (Score:5, Funny)
^_^
Very.. (Score:2)
Re:Very.. (Score:5, Funny)
Yeah, opening for Kathy Griffin.
April Fools Day is always a great opportunity to see that computer nerd humor is every bit as good as computer nerd social skills and personal hygiene.
Brett
Re: (Score:3, Funny)
"computer nerd... every bit"
har har
Re: (Score:2)
Disabled... (Score:1)
Yay! (Score:1)
In the spirit (Score:3, Insightful)
Publishing these holes only encourages further malicious activity!
Re: (Score:2)
Mom was right. (Score:5, Funny)
Smiles are contagious.
Re: (Score:2, Funny)
Great... (Score:2)
Re: (Score:2)
:) i R in yer smiliez... (Score:1)
Stop. Really, just stop (Score:4, Insightful)
Re: (Score:2)
Hear hear.
Enough is enough. One story per year please. Thank you.
Re: (Score:1, Funny)
Re:Stop. Really, just stop (Score:5, Insightful)
Flamebait??? He's spot on. Mod him "goddamn right!"
Slashdot is operational 364 days a year. One day of silliness and it's BITCHBITCHBITCHBITCHBITCH. Your problem's between the chair and the keyboard.
Re:Stop. Really, just stop (Score:5, Funny)
Nothing wrong with my penis. What you talkin about Willis?
Re: (Score:2)
"Willis"? I just named mine "penis". Go figure.
Re: (Score:2)
Now then, anyone hear anything about a patch for this smiley virus?
Re:Stop. Really, just stop (Score:5, Informative)
Slashdot is operational 364 days a year.
actually 364.24222 days a year .. and you call yourself a nerd?
Re: (Score:2)
Slashdot is operational 364 days a year.
actually 364.24222 days a year .. and you call yourself a nerd?
I think he was allowing for 348 mins of downtime.
Re: (Score:2, Insightful)
Slashdot is operational 364 days a year. One day of silliness and it's BITCHBITCHBITCHBITCHBITCH.
In other words, no different than the other 364 days.
Re: (Score:2)
Re: (Score:2)
Well, if you ask me the whole point of April Fool's Day is to try to fool people into believing something that isn't true - hence the name. (Or alternatively, fool them into not believing something that is true)
Posting half a dozen (or more) obviously fictitious stories doesn't seem to be in that spirit to me. That's what irks me, not so much the deluge of stupid stories but the apparent missing of the entire point of the day.
Re: (Score:2)
Oh please. This isn't about the 'spirit' of April Fools, it's about people not being able to disconnect from Slashdot for a day. "One predictable day out of the year is useless, so subscribing is a total waste of money! BITCHBITCHBITCHBITCHBITCH!!!
Re: (Score:1)
Yeah, they're really running it into the ground. Wish I had mod points to undo that 'flamebaid' mod he got.
Leave that poor dead horse alone!
Re:Stop. Really, just stop (Score:4, Insightful)
:D (Score:2)
How about you just turn off those annoying smiles then? Problem solved?
I prefer text based emoticons anyway :p
Re: (Score:1, Funny)
Mark my word. Next year, this day, there'll be a slashdot front page story...about security risk in using to text based emoticons.
And people will spend the year working on the exploit.
Smiley Already Used as Harbinger of Doom (Score:1)
Virus Variant (Score:5, Funny)
As I understand it, there is already a variant out undetectable to anti-smiley software as it embeds itself in a frowny-face.
I wonder if it's transmittable on a discussion board as well? :(
The obvious question: (Score:2)
My favorite holiday (Score:3, Insightful)
"Slashdot Is Broken Day!"
Oh please, please someone post a release date for Duke Nukem Forever! Or a story about how Microsoft is publishing their source code base under the GPL.
IT'S NOT TIRED AND BORING AT ALL.
Re: (Score:3)
Re: (Score:2)
Well, I hate to break it to you, but that conficker blurb was also....No I can't do that to you.
Just don't RTFA. It will take that one little bright gem of your day away.
Re: (Score:2)
Oh please, please someone post a release date for Duke Nukem Forever!
Thing is, no one would believe that. Though a lot of people might well believe the story about a Duke Nukem trilogy for NDS and PSP [pspworld.com] being released. It may even be true ...
Re: (Score:2)
The only thing I've not seen on here today is a good joke about grits.
Come on! Such a huge talent pool, and not one good gritty joke?
Slashdot has indeed gone downhill...
SB
Re: (Score:2)
Which is strange, because it's Wednesday.
GO...THE FUCK...SOMEWHERE ELSE (Score:2)
IT'S NOT TIRED AND BORING AT ALL.
What's tired and boring are people with no lives like you who don't want to be here and yet come along to post. And the idiot mods who modded you up for that.
It's fine that you think it's dumb. That's your prerogative. So you can't quit slashdot for A DAY?
I enjoyed this years' stories. I thought some of them were quite funny, as are the posts (except for people like you). You may think that makes me an idiot, and again, you're entitled to your opinion. But do you go around to every website on the inte
Re: (Score:2)
I'm glad we all agree.
I like it.
More fun with smilies... (Score:5, Funny)
I've always thought that it would be far more fun to get into someone's system (actually, lots of people's systems) and replace the smiley images. You send :) and, instead of getting a smiley face, they see an image that contains a sexually explicit proposition in the default MSN font. Imagine the chaos.
Fortunately for the world, I can't write viruses. :D
Re:More fun with smilies... (Score:4, Funny)
:(){ :|:& };: anyone? (Score:5, Informative)
There, punch that into your terminal and see the poweer of the smiley.
Re:crap anyone? (Score:2, Funny)
that wasn't fun at all. I had to restart my computer. I specifically got ubuntu windows instead of microsoft because of this kind of crap!
Re: (Score:2)
that wasn't fun at all. I had to restart my computer. I specifically got ubuntu windows instead of microsoft because of this kind of crap!
You ever see that old yarn about a linux virus? Please copy and paste this... blah blah blah?
This is the one to watch out for (Score:4, Funny)
It always leads to trouble.
Re: (Score:2, Funny)
I more concerned with this one:
8===D (!)
Stay away from my @ss!!
Or it'll end up looking like this.. =(*)=
-- Never thought I get the use the goatse emoticon in a real posting ;)
Not safe out there! (Score:2)
Gahh!
Wouldn't you know, I switch to Lynx to avoid getting goatse'd and RickRolled...and what do you do? ASCI goatse!!
You're despicable, evil, and talented!
Bugtraq (Score:4, Insightful)
I received this in a bugtraq message earlier and just ignored it, thinking huh, I should read that later. Having read it here I went back and checked it out in full. Did anyone actually run the Ruby code attached to the blog/bugtraq?
The problem with /. April fool's... (Score:5, Insightful)
...is that some of the real stories are less plausible.
Re: (Score:2)
It's amazing that we haven't had any stories about economic recovery today.
SB
I've discovered a similar vulnerability (Score:2)
(o)(o) - here's a vulnerability encoded in bewbs.
I would have more examples but Slashdot refuses to render characters in a fixed-width fashion, foiling any further attempts at character art jokes.
Re: (Score:2)
Re: (Score:2)
So? (Score:3, Interesting)
That's nothing, I can insert malicious code into the space between [wikipedia.org] those smileys.
obligatory xkcd (Score:5, Funny)
http://xkcd.com/380/ [xkcd.com]
Re: (Score:2)
Re: (Score:3, Informative)
It's a basilisk [wikipedia.org].
High payload (Score:1)
Σ(ï¾YÐ"ï¾Y)
A real april fools would have been... (Score:2)
...if one of these hard to believe, so obviously April Fools stories actually turned out to be true. That would have been the *real* April Fools in a really good style. An artfully crafted provocation, made to look stupid and be almost unbelievable... everybody takes it for another lame joke -- and then... tada! April Fools! Your computer actually was compromised by a malicious smiley.
Because until now, the April Fools day on slashdot is ...sad.
j.
Re: (Score:2)
...if one of these hard to believe, so obviously April Fools stories actually turned out to be true.
Remember when Gmail launched?
Re: (Score:2)
Because until now, the April Fools day on slashdot is ...fun.
There, fixed it for you~
STOP PRESS! Slashcode is also vulnerable! (Score:3, Funny)
:O
Warning! (Score:4, Funny)
Slashdot vulnerable to lame April Fools' jokes! Cease using immediately for at least 24 hours.
This message brought to you by the Association of Simpleminded Slashdot Humor Adversion Team
Did anyone actually run the code? (Score:3, Interesting)
You know... (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:2)
If I never see a graphical smiley again... it might make me consider giving Symantec some money again. :) was good enough for my generation, it should be good enough for you darn kids.
And get off my lawn.
Bobby McFerrin says: (Score:3, Funny)
I can just imagine... (Score:2)
In related news (Score:2)
"I fucked all your mothers" declared Louis CK during one of his stand-up routines.
True story.
While this may well be a joke... (Score:5, Informative)
...in reality there are 3rd party smiley add-ons that work with IM software. You can recognize them by the "Your buddy sent you a smiley, to see it you need to install X software" type of IMs.
That software is not exactly good for your computer either.
For example: http://emoticons.smileycentral.com/yahoo-smileys.jsp [smileycentral.com]
And its EULA http://helpint.mywebsearch.com/intlinfo/eula/eula.jhtml [mywebsearch.com]
Choice quotes from EULA
UNIFIED REGISTRATION: As a service to our users, we may consolidate registration data for Webfetti, My Fun Cards, Kazulah, Smiley Central and certain other specified websites, services or applications accessible via the Toolbar, so that users are only required to provide registration information once, and would then be able to use the same unique ID and password to access all such websites, services or applications.
Passwords. In order to access certain services, you may be required to accept additional terms and conditions and/or establish an account including an unique ID and password
After reading that EULA, which references a bunch of other EULAs... that's enough to send my head spinning.
This is real you guys (Score:2, Funny)
Dammit (Score:3, Insightful)
I stared at the PoC and the outputs wondering how the fuck they thought this was supposed to actually be run by the target, before remembering what day it was.