Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe...
by tialaramex on Thursday March 27, 2025 @08:59PM
(#43500167)
Maybe I was unclear, I think the exploited hole was cut by the vendor.
You hire team A of excellent security people to build you an impenetrable barrier. They do a sterling job and are appropriately rewarded.
Then you realise oops, the new feature we're very proud of can't work with that impenetrable barrier. Hey, Jim, we need the feature to work ASAP, figure out a way to do that without removing the expensive barrier. And so of course Jim cuts a hole in it.
You do highlight an important difference between the mindset of an attacker and a defender. The attacker only needs to be right once, and then they can move onto the next phase of the attack. That’s why they don’t bother “understanding it properly” beyond the perspective of attacking it. A medieval siege unit understands the weak points of castle walls, and how to operate a catapult, but they don’t care about the intricacies of stone masonry beyond what’s necessary for knocking down a wall.