The EXE Image Exploit
Michael Shrenk details michael Schrenk: The Executable Image Exploit domain images; like MySpace or eBay.
Summary
Architecture and Background
Michael Schrenk: The Executable Image Exploit domain images; like MySpace or eBay. By uploading the following line of HTML to a community website,[img src=" you can launch a dynamic program that masquerades as a static image and capable of reading and writing cookies, analyzing referrer (and other browser) variables and access databases.
Vulnerability Analysis
It is even possible to create an image the causes a browser to execute JavaScript. A previous DEFCON Speaker (DC10 & DC11), Michael Schrenk has created Internet strategies for companies like: Disney, Nike, AOL and Callaway Golf.
Exploitation and Demonstrations
He is the author of ?Webbots, Spiders, and Screen Scrapers? (2007, No Starch Press), and has written for Computer World and Web Techniques magazines.
Remediation and Defensive Strategies
Currently, he has an article (about webbots) in the July issue of php|architect. Mike has also taught college courses on web usability and Internet marketing. You can contact him at
Related talks
Main Stage·40 min
Zac Franken
Zac Franken details zac Franken: Is that a unique credential in your pocket or are you just happy to see me.
Main Stage·34 min
Vic Vandal
Vic Vandal explores keeping secret secrets secret and sharing secret secrets secretly at DEF CON 16, examining cyber-policy and practical defenses.
Main Stage·49 min
Eric Smith · Dr. Shana Dardan
Eric Smith and Dr. Shana Dardan explores medical identity theft at DEF CON 16, examining cyber-policy and practical defenses.