My latest advisory exploits a buffer overflow vulnerability in CoolPlayer. The vulnerability occurs when the "PlaylistSkin" variable is set to 1534 characters, or 1538 including EIP. Besides a couple security vulnerabilities CoolPlayer is a pretty cool app!
Anyway Christmas (Thursday) is not very far away now - I'm definitely looking forward to having some time to relax.
Tonight I'll be releasing a multi-format fuzzer I wrote codenamed "TagFuzz". This fuzzer edits tag information of a supported file, then executes the target application supplying the file as an argument.
EAX 00000000
ECX 00000000
EDX 00000695
EBX 0013FD0C ASCII "AAAAAAAA..." <-- Before
ESP 0013F900 ASCII "CCCCCCCC..." <-- After my RET
EBP 00000007
ESI 0000939F
EDI 000091CD
EIP 42424242
Comments 0
I've just released (available for download) implementations of the A5/1 encryption cipher. This is the encryption algorithm that is used in Telstra GSM mobile phones to encrypt traffic.
Quoted from the wiki page (http://en.wikipedia.org/wiki/A5/1):
A5/1 is a stream cipher used to provide over-the-air communication privacy in the GSM cellular telephone standard. It was initially kept secret, but became public knowledge through leaks and reverse engineering. A number of serious weaknesses in the cipher have been identified.
I've written two implementations which are very much the same:
- PHP Version
- C# Version
Originally the PHP version was developed from a small script i created to demonstrate how the registers were to function. This later developed into a full implementation. At the time I required a C# version, so i re-wrote it.
I'm 85% of the way through creating software to manage blog entries. The software specification:
* Post blog entries, and create blog entries
* Blog entries can be created using TinyMCE (WYSIWYG) editor
* Blog entries will be grouped by months, years
Eventually it will be available for download