Slashdot Mirror
Instant Messaging Vulnerable To New Smiley Attacks
titus writes "Security researchers Yoann Guillot and Julien Tinnes have found a way to encode malicious code into smileys and provided a proof of concept encoder to automate the process. The researchers said their discovery paves the way for IM malware that would be impossible to detect since the malicious code would be 'indistinguishable from genuine chat messages.' I've tested the proof of concept code which works very well. Time to panic?"
:(){ :|:& };:
There, punch that into your terminal and see the poweer of the smiley.
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
Slashdot is operational 364 days a year.
actually 364.24222 days a year .. and you call yourself a nerd?
...in reality there are 3rd party smiley add-ons that work with IM software. You can recognize them by the "Your buddy sent you a smiley, to see it you need to install X software" type of IMs.
That software is not exactly good for your computer either.
For example: http://emoticons.smileycentral.com/yahoo-smileys.jsp
And its EULA http://helpint.mywebsearch.com/intlinfo/eula/eula.jhtml
Choice quotes from EULA
UNIFIED REGISTRATION: As a service to our users, we may consolidate registration data for Webfetti, My Fun Cards, Kazulah, Smiley Central and certain other specified websites, services or applications accessible via the Toolbar, so that users are only required to provide registration information once, and would then be able to use the same unique ID and password to access all such websites, services or applications.
Passwords. In order to access certain services, you may be required to accept additional terms and conditions and/or establish an account including an unique ID and password
After reading that EULA, which references a bunch of other EULAs... that's enough to send my head spinning.
Leonid S. Knyshov
Find me on Quora