News for hackers. Stuff that matters.

A comment on Windows Bluescreen and Boot Loops (update: caused by a Crowdstrike update). Parent comment

Re:Windows Bluescreen and Boot Loops (update: caused by a Cr... by Sohcahtoa82 on Friday July 19, 2024 @02:14PM (#41009364)
Some file formats allow data to be appended or even prepended to the expected file data and will just ignore the extra data. This has been used to create executables that happen to also be a valid image file.

I don't know about PNG, but I'm fairly sure JPEG works this way. You can concatenate a JPEG file to the end of an executable, and any JPEG parser will understand it fine, as it looks for a magic string before beginning to parse the JPEG.

A JPEG that has something prepended might raise an eyebrow. A JPEG that has something executable prepended should raise alarms.

[ Parent | on HN ]
Re:Windows Bluescreen and Boot Loops (update: caused by a Cr... by skydhash on Friday July 19, 2024 @03:07PM (#41009940)
Why make something like that executable in the first place? I like the Unix model where things that should be executable are marked so. I know bad parsers and format decoders can lead to executable exploits, but I've always felt uncomfortable with the windows .exe model. Also VBA in excel, word... I believe a better solution would be to have a minimal executable surface than invasive software.
[ Parent | on HN ]