if you view this image, YOU GET HACKED.

Did you know you can get hacked by a picture? In this video we'll deep dive the libwebp CVE from September of last year because it is SO insane.

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🔥🔥🔥 SOCIALS 🔥🔥🔥

[KazyEXE]

I miss the days of jailbreaking my iPhone by just going to a website, but in hindsight, maybe that wasn't a good idea.

[mrsvcd]

The TIFF image format was used to hack the PSP early on.

[MrWoodward]

Seem to recall a similar bug in Internet Explorer (IE 5.0.x) from nearly 20 years ago that allowed a carefully crafted JPEG file to exploit a Windows system.

[KFLawless]

Exploits that target software used for handling media are so interesting to me because they're such an unintuitive way to hack something. The Car Hacking Village had a case study where a similar vulnerability was exploited against a tesla

[TheEVEInspiration]

So....where is the payload then?
A double free by itself will not hand over control to desired code, I like to see this explained.

[samiraperi]

3:34 He's trying say "matryoshka dolls".

[OsamaDh-hk]

0:35 Bro's parents named this guy LowLevelLearning

[peel]

thanks for making this awesome content LLL. I used to think cybersecurity and low level programming were really dry but the way you narrate how these major events unfolded makes it so engaging.

[darkpixelk]

Decades ago I was told "we use Windows at this company because it's secure and stable. You cannot run Linux". So I sent out an email to the entire company with an urgent sounding headline. It contained an HTML IMG tag with the source set to C:\CON\CON

There was absolute chaos as nobody could open Outlook after their computers blue-screened and restarted... Because it was the last message in their inbox, and it would display it before it got around to polling the exchange server for new messages. It would even crash if you went in through the web interface.

[Adreadon]

It’s kinda neat that after taking a data structures and algorithms class I now understand so much more in a lot of these types of videos.

[voidkid]

Quite a lot of evil has happened with a 1x1 image, over the years.

[MeriaDuck]

I'm so old that I think I remember something like this has also happened to JPEG images; maybe in the exif data. May be all the way back to the very early days of the interwebs. Edit: discovered in 2004 apparently.

[JessicaFEREM]

Reminds me of the discord videos that crash discord. also turns out WebM has an infinitely adjustable dynamic resolution that can change on the fly, the speed bottleneck is the player. you can change the resolution of a WebM videos 60 times a second even.
discord didn't put a box limit so users were making videos that would seemingly disappear (turn into 1x1) the second you clicked on it, also videos that look like a game character dancing and it's bouncing the discord chat up and down with it.
personally I think they should keep it but they removed it.

[LeeLikesFrenchFries]

at my work, we called these types of attacks compression bombs. that kind of terminology helped put my mind in the right frame of reference when i evaluate useful compression code.

[jpsousa]

At "maristroika dolls" I lost it. I think you made a portmanteau of matryoshka (the doll), and perestroika (the 1980s transparency policy used by gorbechev in the USSR)

[CHmix]

Nice, just in case WebP doesn’t get more hate

[cesaraugustomarcelinodossa]

How is it possible that you can do so nice videos, in a very simple arrangement and good explanations, causing time to fly so fast!!! Never looks like it's an almost 10min video 😊
Thanks for the good quality material you have been donating to the internet

[mrt_]

Technically not the picture will render the picture, the picture will be used to render a picture.

[blacklistnr]

The sad part is that it doesn't even surprise me, CVE after CVE I see that complexity + interaction => exploit.

Given the complexity stack of anything today, the only way to avoid exploits is to avoid interactions with untrusted data. i.e. no internet, no file sharing.

Next best thing is to separate everything, but that is really hard without carrying 3 phones in your pocket.

I'm going with option 3 which is eat popcorn while reading the news.

[Amipotsophspond]

the people that make and catch these things are geniuses.