IE finds JS in Images (old xss bug!)

Domas Mituzas — Thu, 03 Jan 2008 01:31:02 +0000

Well, this fix was done more than three years ago, but this is one of most evil IE bugs in existence. Even better, it seems to have never been fixed, exists in IE7, and is being discussed in various places lately.

The problem is very simple – valid PNG files can be uploaded to various sites, and then shown to users. The problem is that IE does autodetection, and if it suspects that the file may be HTML, it executes it as HTML, with all Javascript inside. The images can be properly normal images, that show your kitten or wife or whatever. Still, IE will execute any exploit code that is included in them. Exploit code can actually load the actual image, so nobody will even realize they’re looking at image and not at an attack that hijacks their sessions, steals cookies and does all other sorts of evil things.

So, whenever anyone says IE is secure, just tell them to look at this problem.

Weird wit by Google translation technology

Domas Mituzas — Tue, 23 Oct 2007 11:10:17 +0000

I was translating some document from German to English, that had my surname in it.
It got translated to ‘Beesley’, and I immediately thought of Angela Beesley, chair of Wikimedia Advisory Board. I started playing more, and did find, that:

French ‘Domas Mituzas’ to English translates as ‘Anthere fall’
‘Mituzas’ in German is ‘Schindler’ (Matthias?:)
Spanish ‘Domas Mituzas’ to English translates as ‘Anthere Anthere’ (every wikipedian has a bit of Florence inside :)
English to Portuguese renders me as “Domas Lessig” (I have creative commons t-shirt :)
English to Chinese is “florence 100,000″…

Thats what Web 3.0 is all about. Tampering with my personality. Who am I? :)

domas mituzas » wtf

IE finds JS in Images (old xss bug!)

Weird wit by Google translation technology