News for hackers. Stuff that matters.

A comment on U.S. Election Agency Breached by Hackers After November Vote. Parent comment

Re:U.S. Election Agency Breached by Hackers After November Vote by xapata on Sunday December 25, 2016 @01:14AM (#13253193)
Reading XML ain't secure against malicious data either.
[ Parent | on HN ]
Re:U.S. Election Agency Breached by Hackers After November Vote by int_19h on Sunday December 25, 2016 @05:44AM (#13253671)
I don't know why you're downvoted, because this is exactly correct.

https://www.vsecurity.com//download/publications/XMLDTDEntit...

Granted, most modern parsers disable the features that can trigger this by default. But there's still a lot of code out there compiled against libraries that did not, and some of that code is still updated and extended today.

[ Parent | on HN ]