OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Seth Arnold (sarnoldwirex.com)
Date: Fri Jan 18 2002 - 14:19:27 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    On Thu, Jan 17, 2002 at 09:14:50PM -0600, Nick Lange wrote:
    > If the file opens in word, then unless they know the structure of word files
    > [does anyone?], you can at least have a 90% assurance that nothing was added
    > or deleted to the file;

    Hence the requirement of "decent editor". As a direct example, vim -b.
    It won't modify the file size unless you specify to change the file
    size. Get in, find the MAC, use R to modify the bytes you don't like.

    With the GUID, the idea isn't to remove it as much as either put in
    bogus data, or a mess of zeros, or something like that -- overwriting
    the bytes directly.

    Unless MS has changed their file formats, they didn't bother with a
    checksum over this data.

    -- 
    "Soldiers quartered in a populous town will always occasion two mobs
    where they prevent one. They are wretched conservators of the peace."
    -- John Adams
    

    -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org

    iD8DBQE8SINO1XMg6PgdEDQRAszjAJ91mi/10gawsiwXoqhQ1DyNwtViJQCg8W7R Be0tAiae8Pdw/1NTSNt1jpE= =OeIm -----END PGP SIGNATURE-----