2023-05-08: Thoughts on overlarge fields in formats and protocols A few days ago I had a fun chat with Ange Albertini about secure design of file formats – a topic Ange has been passionately researching for some time now. One of the specific problems that we discussed were overlarge fields and how to approach them in a file format or communication protocol design in a way that makes certain that their handling is safe and secure by default. In this blogpost I wanted to discuss two of my ideas (neither of which is perfect) and related observations on this topic. What is an overlarge field?It's best to explain this using one of my favorite examples – same one I've used in my "How to find vulnerabilities?" blog post and in several talks. In the GIF image format specification there is a field called LZW code size which holds the initial LZW compression code size in bits. 7 6 5 4 3 2 1 0 +---------------+ | LZW code size | +---------------+ What exactly the value entails isn't really important for this discussion. What is however important is that said value must be between 3 and 12 (inclusive). The second important piece of information is that the field holding this value is a typical byte (8-bit) field. This of course means that while on paper the value should be between 3 and 12, technically the actual field in a GIF file can contain any value in the range of 0 to 255. I.e. the field is too large for the actual value it's supposed to hold and thus I call it an overlarge field1. The problem with overlarge fieldsRead more... [ 4 comments ] |
2023-04-05: Mega Sekurak Hacking Party – Maj 2023 (wystąpienie o CTFach) 22 maja będę miał "bezslajdowe" wystąpienie na kolejnym MSHP. Ponieważ będzie to dla mnie akurat sezon urlopowy, to i wystąpienie będzie trochę bardziej na luzie. Czyli będzie o CTFach! Gynvael Coldwind – „Jak wygrywać CTFy: Tips & Tricks!” Na samym MSHP Sekurak, który organizuje wydarzenia, szykuje cztery ścieżki tematyczne (websec, netsec, defence oraz intro dla początkujących) oraz zapewnia cały dzień merytorycznych treści bez męczącego marketingu. Będą za to doskonali prelegenci, konkursów oraz inne niespodzianki. Dodatkowo każdy uczestnik dostanie dostęp do ponad 50 nagrań z czterech ostatnich edycji MSHP. Do końca kwietnia z kodem: mshp-gyn35 bilety STANDARD macie 35% taniej. Do zobaczenia na MSHP! Czytaj dalej... [ 1 komentarz ] |
Five newest or recently updated notes (these are unfinished posts, code snippets, links or commands I find useful but always forget, and other notes that just don't fit on the blog):
Click here for a list of all notes. ![]()
Some conference slides are linked at the bottom of this page. ![]()
The full list of vulnerabilities discovered by me (including collaborative work) can be found here (please note that the list might be out of date). The Google Application Security / Research site might also contain some of my findings. ![]()
![]()
|
![]()
[ 0 thumbs up | 0 comments | 0 views ] Dodatkowo: ReverseCraft - starsza seria podcastów o reverse engineeringu i assembly. ![]() Dla programistów:
Security / hacking:
Dodatkowo, kilka przemyśleń na temat odnajdywania się na rynku pracy w IT:
![]()
← trochę więcej postów jest po angielskojęzycznej stronie. ![]() Grafika generowana proceduralnie:
|
|