How can uploading an image lead to a heap buffer overflow? Let's look at the libheif bug used in the OpenAI Discourse hack, with a visualization of image overlays, negative offsets, and what goes wrong when transparency is involved.
This video is sponsored by Hextree.io, our cybersecurity learning platform.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
PREVIOUS VIDEOS
How OpenAI got hacked with an image: https://www.youtube.com/watch?v=gjHh9g7yo9Y
OpenAI Hacked with a 1-Year-Old Bug: https://www.youtube.com/watch?v=qypnjORyWNI
RESOURCES
Hacktron's original research, Hacking OpenAI: https://www.hacktron.ai/blog/hacking-openai
libheif source code and format documentation: https://github.com/strukturag/libheif
Upstream commit, simplify overlay overlap area computation: https://github.com/strukturag/libheif/commit/85e21ad44eba931314337300a2376b8d28f085ae
Discourse security advisory: https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335
CHAPTERS
00:00 - Recap
01:05 - What's inside a HEIF or HEIC image?
03:46 - Visualizing image overlays and clipping
05:28 - What goes wrong with negative offsets?
07:59 - alpha blending
09:37 - The heap overflow
11:18 - Learning with AI
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#BinaryExploitation #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
This video is sponsored by Hextree.io, our cybersecurity learning platform.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
PREVIOUS VIDEOS
How OpenAI got hacked with an image: https://www.youtube.com/watch?v=gjHh9g7yo9Y
OpenAI Hacked with a 1-Year-Old Bug: https://www.youtube.com/watch?v=qypnjORyWNI
RESOURCES
Hacktron's original research, Hacking OpenAI: https://www.hacktron.ai/blog/hacking-openai
libheif source code and format documentation: https://github.com/strukturag/libheif
Upstream commit, simplify overlay overlap area computation: https://github.com/strukturag/libheif/commit/85e21ad44eba931314337300a2376b8d28f085ae
Discourse security advisory: https://github.com/discourse/discourse/security/advisories/GHSA-vhm9-85gw-x335
CHAPTERS
00:00 - Recap
01:05 - What's inside a HEIF or HEIC image?
03:46 - Visualizing image overlays and clipping
05:28 - What goes wrong with negative offsets?
07:59 - alpha blending
09:37 - The heap overflow
11:18 - Learning with AI
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#BinaryExploitation #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.