This topic contains 1 reply, has 2 voices, and was last updated by ben247x1 1 week, 3 days ago.
- April 8, 2021 at 5:07 pm #381341
There exists a file that, when posted as a link and recognized as/converted to an animated .gif by Dscord, will crash the viewer’s discord application when the final frame loads.
It is hosted on Tornadus.net, specifically Tornadus.net/orange
What is this website doing to crash Dscord? Is it designed to do anything else? I’m kind of intrigued by its weird design, and when I looked into the HTML I think I saw a reference to Metamask and Ethereum (is it trying to mine crypto???), but maybe that was just because of my extension.
Curious what someone with more knowledge regarding this kind of exploit can discover about how it’s doing this, why, and what else the site can do
- April 8, 2021 at 5:07 pm #381342
From a higher level it looks like the video (its an mp4 file) has an invalid pixel format part way through and that causes a crash in the code that is trying to render/play the video. Would need more time to look into why exacttly that causes a crash and if its a potentially exploitable crash or just a DoS vector.
- April 8, 2021 at 5:07 pm #381343
It’s not a gif, it’s an mp4 video. The crash is actually kind of abuse of the video format. In the beginning, the video size in 42×42 pixels, but at the end it changes to a whopping **12000×12000** pixels! The decoder probably causes the crash because it runs out of memory or something.
Also, for some reason, the crash does not happen for me on Linux – Discord just casually uses 4 GB of ram and a lot of CPU but manages to go through the video lol
- April 8, 2021 at 5:07 pm #381344
Maybe this is why, but I tested this on myself and it just slowed my discord down for a second and caused a static sound. This is interesting how this works. I would assume there is some type of corruption in the file put there to overload discord or maybe something else, not sure.
- April 8, 2021 at 5:07 pm #381345
do you have the file by chance?
- April 8, 2021 at 5:07 pm #381346
Doesn’t crash Linux clients for Discord.
- April 8, 2021 at 5:07 pm #381347
Does this overload the Discord owners server or just the users who open said section of discord then view the tornadus file?
You must be logged in to reply to this topic.