Hacker News Reader

Comment by bigmac | Hacker News Reader

“About a month ago I was chatting on skype to a colleague about a payload for one of our clients,” he wrote. “Completely by accident, my payload executed in my colleagues skype client.

That means this thing is either BS or it is an egregious bug by the Skype team. Remote code execution doesn't happen by chance.

View on HN

It doesn't happen by chance (usually), but it's not an infrequent occurrence either.

Take an example from earlier today: there's a vulnerability in Exim that can allow arbitrary remote code execution (http://www.vupen.com/english/advisories/2011/1185). For anyone who doesn't know what Exim is, I refer you to Wikipedia (http://en.wikipedia.org/w/index.php?title=Exim&oldid=421...):

"Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.

...

A large number of Exim installations exist, especially within Internet service providers[1] and universities in the UK. Exim is also widely used with the GNU Mailman mailing list manager, and cPanel."

Not if skype renders javascript somehow. Amazon had a similar vulnerability in the "preview this book" feature a few months ago. If you used it to preview certain books that had example XSS payloads, you would get owned.

What does XSS have to do with remote code execution? I mean, it's possible for a Javascript parser to have vulnerabilities that can lead to arbitrary code execution, but the Amazon example seems in no way relevant here.

Well, it's a Register article. I left open the possibility that they called "remote script execution" remote code execution. They already said it gains root access, but then later said it gives shell access, which is not the same thing (since skype does not run as root).

I have no idea what the bug is, all I meant was that it wasn't completely out of the realm of possibility to have something render a payload.

Fair enough. The article does link to the actual blog post though (http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v...).

After seeing the abortion which is the latest interface redesign, I chalk it up to either incompetence or sadism.

Wasn't there that bug in android where if you would type in anything it would execute it as a shell command as root?

The original builds of Android for the G1 had a root terminal running in the background that used keyboard input even though it was invisible and not focused. This allowed you, eg, run telnetd and then connect from your PC to run commands as root, which included the ability to re-flash the bootloader and jailbreak the OS.

Reply on news.ycombinator.com