Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'About OS X 'trojan horses'' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
About OS X 'trojan horses'
Authored by: aranor on May 12, '04 02:36:23PM

That's misleading. Sure, it looked like it was in the ID3 tag info but it's not a real ID3 tag, it was just benefitting from the way an MP3 file is constructed to make itself both an MP3 file and an executable.

As a side note, I once ran across an example of a .gif file that was also a .zip file. It was a picture of a dinosaur, but if you changed the extension from .gif to .zip you could decompress it. The way it worked was a .gif keeps information about the size of the file in the header, but a .zip keeps a table of the information at the tail of the file. That way you can just append a .zip file onto the end of a .gif and you have a file that's both! Cute, eh? Oh, and the .zip file was the original DeCSS code. This file was on the gallery of DeCSS obfuscations.



[ Reply to This | # ]