News for hackers. Stuff that matters.

A comment on Jellyfish GPU Rootkit. Parent comment

Re:Jellyfish GPU Rootkit by baroffoos on Monday November 11, 2019 @10:46PM (#21511345)
Don't joke. I have had security people report my stuff is insecure because there is a document upload feature and a user could upload a virus and name it virus.png and then a user could download it and rename it to virus.exe and run it.
[ Parent | on HN ]
Re:Jellyfish GPU Rootkit by fulafel on Tuesday November 12, 2019 @12:16AM (#21511713)
Change the scenario to "download it and double click it, exploiting vuln in file format handler" and it's correct.
[ Parent | on HN ]
Re:Jellyfish GPU Rootkit by baroffoos on Tuesday November 12, 2019 @12:22AM (#21511738)
At that point you may as well ban all user generated content since one user might have an insecure OS
[ Parent | on HN ]
Re:Jellyfish GPU Rootkit by fulafel on Tuesday November 12, 2019 @12:33AM (#21511775)
Well, security engineering is about tradeoffs and managing risk, you won't get far outlawing all sources of risk. The smart way to handle attachments is to scrub them somehow (re-encode, pdf2pdf etc).
[ Parent | on HN ]
Re:Jellyfish GPU Rootkit by badrabbit on Tuesday November 12, 2019 @01:34AM (#21512000)
That is actually a serious issue especially if you allow unicode and RTL override in the file name. Always validate input file type.
[ Parent | on HN ]