Slashdot Mirror
Instant Messaging Vulnerable To New Smiley Attacks
titus writes "Security researchers Yoann Guillot and Julien Tinnes have found a way to encode malicious code into smileys and provided a proof of concept encoder to automate the process. The researchers said their discovery paves the way for IM malware that would be impossible to detect since the malicious code would be 'indistinguishable from genuine chat messages.' I've tested the proof of concept code which works very well. Time to panic?"
Uh-oh, I knew all those 14 year old girls were really 1337 ha>0rz...
And that! :-) (-:
Palm trees and 8
which is safer?
For the love of all that's decent, make it stop!
Publishing these holes only encourages further malicious activity!
Smiles are contagious.
Dual Opteron < $600
Yeah, opening for Kathy Griffin.
April Fools Day is always a great opportunity to see that computer nerd humor is every bit as good as computer nerd social skills and personal hygiene.
Brett
Please? OK? One or two stories is acceptable, even if they are not funny. Multiple stories each year is just annoying.
As I understand it, there is already a variant out undetectable to anti-smiley software as it embeds itself in a frowny-face.
I wonder if it's transmittable on a discussion board as well? :(
"Slashdot Is Broken Day!"
Oh please, please someone post a release date for Duke Nukem Forever! Or a story about how Microsoft is publishing their source code base under the GPL.
IT'S NOT TIRED AND BORING AT ALL.
Weaselmancer
rediculous.
Ack! Now I'm :-) infected. How could :-) you go posting :-) such a virulent :-) virus where :-) everyone could see i:-)t? I thin:-)k th:-)e inf:-)ect:-)ion's g:-)et:-)tin:-)g wo:-)rs:-)e n:-)o:-)w. I:-)'m of:-)f t:-)o pa:-)t:-)ch:-) m:-)y s:-)ys:-)te:-)m. :-):-):-):-):-)
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I've always thought that it would be far more fun to get into someone's system (actually, lots of people's systems) and replace the smiley images. You send :) and, instead of getting a smiley face, they see an image that contains a sexually explicit proposition in the default MSN font. Imagine the chaos.
Fortunately for the world, I can't write viruses. :D
:(){ :|:& };:
There, punch that into your terminal and see the poweer of the smiley.
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
8===D
It always leads to trouble.
I received this in a bugtraq message earlier and just ignored it, thinking huh, I should read that later. Having read it here I went back and checked it out in full. Did anyone actually run the Ruby code attached to the blog/bugtraq?
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
...is that some of the real stories are less plausible.
Genesis 1:32 And God typed
"computer nerd... every bit"
har har
That's nothing, I can insert malicious code into the space between those smileys.
http://xkcd.com/380/
Did you mount a military-grade, variable-focus MASER on an unlicensed artificial intelligence?
:O
Slashdot vulnerable to lame April Fools' jokes! Cease using immediately for at least 24 hours.
This message brought to you by the Association of Simpleminded Slashdot Humor Adversion Team
I'm paranoid, as my idea of a good AFJ would be publishing genuinely malicious code as joke malicious code.
- fader
Regardless of it being a harmless April fools joke, Symantec is probably all ready working on a "Smiley Face Blocker".... And people will buy it...
^_^
Don't worry about your data, be :)
You go typing: "I 3 you" and norton pops up... the horror, the horror...
-- Por mais que eu ande no vale das trevas e da morte, meu PowerMac G4 Não Travará!!!
*grin*
It's old. The more humans I meet, the more I like my cats. At least they are honest.
You can use a good programming editor when posting, something with syntax highlighting and parensbcwsmilies matching to keep your smilies properly balanced.
I guess the way the infection works is you put so many smilies to make the message look like some sort of lisp code. The IM software gets confused, starts a lisp interpreter to make some sense of it, the unbalanced parenthesis cause a buffer overflow in the parser, ...
AccountKiller
...in reality there are 3rd party smiley add-ons that work with IM software. You can recognize them by the "Your buddy sent you a smiley, to see it you need to install X software" type of IMs.
That software is not exactly good for your computer either.
For example: http://emoticons.smileycentral.com/yahoo-smileys.jsp
And its EULA http://helpint.mywebsearch.com/intlinfo/eula/eula.jhtml
Choice quotes from EULA
UNIFIED REGISTRATION: As a service to our users, we may consolidate registration data for Webfetti, My Fun Cards, Kazulah, Smiley Central and certain other specified websites, services or applications accessible via the Toolbar, so that users are only required to provide registration information once, and would then be able to use the same unique ID and password to access all such websites, services or applications.
Passwords. In order to access certain services, you may be required to accept additional terms and conditions and/or establish an account including an unique ID and password
After reading that EULA, which references a bunch of other EULAs... that's enough to send my head spinning.
Leonid S. Knyshov
Find me on Quora
This is not a hoax, this is real you guys... I'm cereal!
Bow before me, for I am root.
I stared at the PoC and the outputs wondering how the fuck they thought this was supposed to actually be run by the target, before remembering what day it was.
that wasn't fun at all. I had to restart my computer. I specifically got ubuntu windows instead of microsoft because of this kind of crap!
Fork bomb? I thought it was a smiley threesome.
Then all of the participants had lots of kids. Lots and lots and lots of kids.
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.