“Virtual Worlds, Real Exploits” Presentation Posted
Charlie Miller and I presented our research into exploiting SecondLife at ShmooCon 2008 and they have just posted our materials online. Check out the video to see Charlie and I running our Linden-stealing QuickTime exploit in SecondLife, live and on ice stage. For more information, check out the slides or more details at Independent Security Evaluators. This year was my first ShmooCon and I really had a blast, so props to the Shmoo crew for putting on a fun con.
UPDATE @ 20080605: An authoritative reader corrected me on the slides that, “http://www.kb.cert.org/vuls/id/112179 was a heap overflow parsing the Reason-Phrase. I think the vulnerability was actually CVE-2007-6166 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6166 which was a stack buffer overflow in the parsing of the Content-Type and which had a PoC by h07.”
Very true, we got the links wrong, the exploit was for the Content-Type stack overflow.
