RE: FUD - was FAX a virus

["Craig Wright" <cwright () bdosyd com au>]

Sorry, wrong.

This does not apply. As I stated, even with the best white noise based
error corrections, you can not send a binary as a fax.

You are assuming a binary input. This is the requirement you have
decided to ignore in the paper that you have pointed us to.

The input used to overflow a binary (in this case jpeg) can not be
delived in a fax transmission. The attack is interactive (I suggest that
you read the CERT paper on the issue - I will not attach it as CERT has
a search function). Fax as I did state and as seems to be missed is
non-interactive.

Even in scanning the image, the attack you have mention is a crafted
jpeg designed to overflow the GDI. It is not an image in itself. Please
understand this distincion. It is a crafted binary. A scanned image is
created by the system and not altered after this event.

Please try again. Chin forward. Eyes closed. Waiting...

Craig

PS - you are trying to imply that fuzzing is a valid attack.
http://www.blackhat.com/presentations/bh-jp-05/bh-jp-05-sutton-greene.pd
f

The fuzzing attack is not valid if you read the details and not a quick
googlised version of the alert you may have discovered this yourself.




-----Original Message-----
From: wesleymcgrew () gmail com [mailto:wesleymcgrew () gmail com] On Behalf
Of Robert Wesley McGrew
Sent: Wednesday, 7 March 2007 8:48 AM
To: Craig Wright
Cc: TheGesus; security-basics () securityfocus com;
alcides.hercules () gmail com; Scott.Ramsdell () cellnet com
Subject: Re: FUD - was FAX a virus

On 3/6/07, Craig Wright <cwright () bdosyd com au> wrote:
> With email you attach a binary. Please I would love to know how to
> attach a binary executable to a scanned image?

Like this:

http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

Never put too much trust in how you're parsing input.

--
Robert Wesley McGrew
http://mcgrewsecurity.com

Liability limited by a scheme approved under Professional Standards Legislation in respect of matters arising within 
those States and Territories of Australia where such legislation exists.

DISCLAIMER
The information contained in this email and any attachments is confidential. If you are not the intended recipient, you 
must not use or disclose the information. If you have received this email in error, please inform us promptly by reply 
email or by telephoning +61 2 9286 5555. Please delete the email and destroy any printed copy. 

Any views expressed in this message are those of the individual sender. You may not rely on this message as advice 
unless it has been electronically signed by a Partner of BDO or it is subsequently confirmed by letter or fax signed by 
a Partner of BDO.

BDO accepts no liability for any damage caused by this email or its attachments due to viruses, interference, 
interception, corruption or unauthorised access.