Security Basics mailing list archives

Re: Re: files containing web llinks


From: krymson () gmail com
Date: 22 Nov 2006 21:07:16 -0000

There are ways to do things like open links by just previwing something. Even Windows Explorer, until earlier this 
year, was vulnerable to an overflow when "opening" certain files in the preview pane on Windows Explorer. Again, 
though, that was a vulnerability being exploited and I'm not sure if it was ever widely used.

You can run tcpview to see what program is opening the connections to the web. I would bet that it is just one 
connection, and the first web site called does the rest of the work in opening the rest. There are movie files that 
support a web forward link (I believe mpg but I may be wrong) where a web page will open when the file is fully played. 
Unfortunately, I don't know specifics there.

There is also the possibility that those files are already just links to something on the Internet, or perhaps a 
streaming file that has no real size on disk and instead calls out to connect to the stream. I doubt this is the case 
since it sounds like you have files of substance, but still a possibility.

Just some thoughts, definitely sounds like some interesting and fun stuff. Beyond your malicious hackers and spammers, 
the porn industry utilizes tons of shady techniques to peddle its wares.


Current thread: