Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length

 
Advanced search

880192 Posts in 33024 Topics- by 24392 Members - Latest Member: mfroeschl

May 26, 2013, 12:12:21 AM
TIGSource ForumsPlayerGeneralJust a little heads up: Avatars and trojans
Pages: [1]
Print
Author Topic: Just a little heads up: Avatars and trojans  (Read 1202 times)
Mipe
Level 10
*****


Migrating to imagination.


View Profile
« on: July 18, 2009, 02:38:46 AM »

This thread triggers an alert from Avast AV, apparently one of avatars of users there contains some malicious code or something. Just a heads up. Could be nothing, but better safe than sorry.

Does this mean that remotely hosted forum avatars aren't that safe anymore?

Edit: It is dustin's avatar.
« Last Edit: July 18, 2009, 02:45:24 AM by Mipey » Logged
Paul Eres
Level 10
*****


Also known as RinkuHero.

RinkuHero
View Profile WWW Email
« Reply #1 on: July 18, 2009, 05:14:33 AM »

usually it's just a warning for particular domain names which are black-listed, usually nothing to worry about. i know that willhostforfood was blacklisted once, maybe he uses that as a host?
Logged

Kekskiller
Guest
« Reply #2 on: July 18, 2009, 06:31:02 AM »

WHFF isn't blacklisted anymore.
Logged
PaleFox
Guest
« Reply #3 on: July 18, 2009, 06:45:18 AM »

Yes, that has happened to me as well with SiteAdvisor: certain sites, since they are hosting sites, get blacklisted for one or two people using it for malware and the like, while others can be completely innocent yet their site is also flagged as red (dangerous). When it involves situations like that, it is best to take with a grain of salt.
Logged
Paul Eres
Level 10
*****


Also known as RinkuHero.

RinkuHero
View Profile WWW Email
« Reply #4 on: July 18, 2009, 06:47:06 AM »

in any case i think it's impossible to put a virus *inside* an avatar image file, that'd make no sense
Logged

Montoli
Level 7
**


i herd u liek...?


View Profile WWW Email
« Reply #5 on: July 18, 2009, 08:56:49 AM »

Actually, I don't think it still exists, but there have been bugs in both jpg and bmp parsing routines in popular software, making them vulnerable to buffer overrun attacks.  I think at least one virus made use of this, a couple of years back.  (It spread by being an image that, when viewed through a common program [internet explorer, I think] would trigger a buffer overrun to execute code.]

I think these vulnerabilities have been patched for several years, but just say'n.  People are clever.  It's not as impossible as you might think. :D
Logged

deadeye
First Manbaby Home
Level 10
*



View Profile
« Reply #6 on: July 18, 2009, 09:19:23 AM »

in any case i think it's impossible to put a virus *inside* an avatar image file, that'd make no sense

I disagree.

No, really... you can do that.
Logged

tweet tweet @j_younger
Paul Eres
Level 10
*****


Also known as RinkuHero.

RinkuHero
View Profile WWW Email
« Reply #7 on: July 18, 2009, 09:36:38 AM »

hm, that seems to rely on extra buffers to store code -- so it's possible i guess. but the last time it happened was 2004? also i'd imagine the filesize limit on forums for avatars would also discourage that method, since large buffers to store code might cause it to go over the small filesize limits many forums have, leading them to target sites like flickr and deviantart instead of forum avatars
Logged

Montoli
Level 7
**


i herd u liek...?


View Profile WWW Email
« Reply #8 on: July 18, 2009, 10:16:56 AM »

Never said it was likely.  Smiley  As you say, those particular exploits are 5 years old.  Just saying "It's possible."  Buffer overruns can happen in all sorts of funny places.  Heck, sometimes it doesn't even require a terribly large buffer.  A malformed header can cause all sorts of trouble on its own.

Anyway, again.  Probably not likely.  But as a friendly reminder - Just because image elements are normally passive data doesn't mean you can automatically trust them not to be a threat and bite you. 
Logged

Mipe
Level 10
*****


Migrating to imagination.


View Profile
« Reply #9 on: July 19, 2009, 02:06:44 AM »

Logged
Paul Eres
Level 10
*****


Also known as RinkuHero.

RinkuHero
View Profile WWW Email
« Reply #10 on: July 19, 2009, 03:51:51 AM »

wasn't avast that program that gave false positives and thought every single mmf game had a virus, and deleted it without telling the user, and people lost all their hard work and their mmf game collections? or was it avg? one of those. anyway, just because it detects something doesn't mean it's there, i get tons of false positives. likely one here too (especially since it's a .gif)
Logged

Shade Jackrabbit
Level 10
*****


TIME RANGER


View Profile WWW Email
« Reply #11 on: July 19, 2009, 07:59:02 AM »

@Paul: I know AVG did that, except it asked you ahead of time. I wouldn't be surprised if they did though. Both MMF and Construct have memory holes in their programming, which is a security risk and why DEP prevents them from running properly. (Hence why I had to turn it off). AVG at one point managed to find a way in through one of those and assumes MMF was a trojan. At least, that's how I remember it happening. It was in February or something.
Logged

["Thread Reader" - Read a thread.]
Pages: [1]
Print
Jump to:  

Theme orange-lt created by panic