Collaborate Disseminate
This week we got news of a security incident at 1Password, and we’re certain we aren’t the only ones hoping it’s not a repeat of what happened at LastPass. 1Password …read more Continue reading This Week in Security: 1Password, Polyglots, and Roundcube
Aspiring polyglots can be stymied by differing keyboard layouts and character sets when switching between languages. [Thomas Pollak]’s Poly Keyboard circumvents this problem by putting a screen in every key …read more Continue reading Poly Keyboard has Screens in Every Key
Steganography involves hiding data in something else — for example, encoding data in a picture. [David Buchanan] used polyglot files not to hide data, but to send a large amount of data in a single Twitter post. We don’t think it quite qualifies as steganography because the image has a giant red UNZIP ME printed across it. But without it, you might not think to run a JPG image through your unzip program. If you did, though, you’d wind up with a bunch of RAR files that you could unrar and get the complete works of the Immortal Bard in …read more
Continue reading Shakespeare in a Zip in a RAR, Hidden in an Image on Twitter
Polyglots, in computing terms, are files have multiple valid meanings. We’ve seen some amazing examples of polyglot files in releases of The International Journal of PoC||GTFO. One example: a PDF that is also a ZIP, HTML file, and BPG image.
[Vi Grey] was inspired by PoC||GTFO’s release of a PDF/ZIP/NES ROM hybrid file for issue 0x14. Using a different method, [Vi] created a file which is both an NES ROM and ZIP, where the full contents of the ZIP are stored in the NES ROM.
When PoC||GTFO created their NES ROM polyglot, they stuck most the information outside the bounds …read more
Amber alert hacking, polyglots, and switching centers. Continue reading Hacking Is the Least Ridiculous Part of ‘House of Cards,’ Somehow
James challenged me to see if it was possible to create a polyglot JavaScript/JPEG. Doing so would allow me to bypass CSP on almost any website that hosts user-uploaded images on the same domain. I gleefully took up the challenge and begun dissecting t… Continue reading Bypassing CSP using polyglot JPEGs
James challenged me to see if it was possible to create a polyglot JavaScript/JPEG. Doing so would allow me to bypass CSP on almost any website that hosts user-uploaded images on the same domain. I gleefully took up the challenge and begun dissecting t… Continue reading Bypassing CSP using polyglot JPEGs
Victims infected with the MarsJoke ransomware can now decrypt their files; researchers cracked the encryption in the CTB-Locker lookalike last week. Continue reading Researchers Break MarsJoke Ransomware Encryption