Right at the beginning of this article – I must admit that I’m definitely not a specialist for the newest trends in web development. Consider following contemplation only as a thinking of an amateur. Today I’ve noticed an article about the first MP3 codec written in JavaScript (http://jsmad.org/play/160426) in order to support this media format in all browsers (even when they have no native support/codec for such media). Sounds great for such kind of inexact specification like <audio> and <video> tags, that can encapsulate variable media formats. The particular media format does not matter (MP3, OGG, FLAC etc.), the only thing you need is to provide a codec.
And here begins the chain of my concerns. Remember, I’m not a specialist on this topic, thus… everything written here might be a complete nonsense. But I can imagine a scenario:
- prepare a specially crafted “media” file – generally an encrypted file with a shellcode/payload
- encapsulate its reference in an <audio> tag
- have a JavaScript close at hand.. it will carry the decryption of the “media” file content and the exploitation, subsequently followed by the malcode execution.. the goal is that the JavaScript will be called as a regular codec for the specified media file
Does it sound impossible to you? Use the comments section bellow to share your opinions. I’m quite afraid of such a huge door open for new ways of exploitation/infection.
04. 05. 2013 00:51
28. 03. 2013 13:30
27. 03. 2013 17:21
Fear of the HTML5
Right at the beginning of this article – I must admit that I’m definitely not a specialist for the newest trends in web development. Consider following contemplation only as a thinking of an amateur. Today I’ve noticed an article about the first MP3 codec written in JavaScript (http://jsmad.org/play/160426) in order to support this media format in all browsers (even when they have no native support/codec for such media). Sounds great for such kind of inexact specification like <audio> and <video> tags, that can encapsulate variable media formats. The particular media format does not matter (MP3, OGG, FLAC etc.), the only thing you need is to provide a codec.
And here begins the chain of my concerns. Remember, I’m not a specialist on this topic, thus… everything written here might be a complete nonsense. But I can imagine a scenario:
Does it sound impossible to you? Use the comments section bellow to share your opinions. I’m quite afraid of such a huge door open for new ways of exploitation/infection.