I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system.
How is this possible?
-
Do you mean image as in picture file like JPEG/BMP or disk image? – JBRWilkinson Mar 15 '12 at 22:32
-
Picture file. I can't image how easy it must be place a virus into a disk image. – ahodder Mar 15 '12 at 22:33
Using this would generally depend on a fairly simple fact: most images are compressed. Along with this, the code to de-compress an image is often written assuming that the data in the image was compressed according to a fairly specific set of rules.
At times, however, people have found various vulnerabilities, chiefly that old standby, the buffer overrun, in image decompression code. By writing a file that does not follow the rules expected by the decompressor, they can figure out a way to overrun a stack-allocated buffer, and write data outside the allocated space on the stack.
From there, it's a fairly typical buffer-overflow attack, which are widely enough documented that there's no real point in my trying to go into it here.
answered Mar 15 '12 at 22:01
-
1Yepp, the correct answer. Wikipedia's article on buffer overflow is fairly informative, and even links to the famous GDI+ JPEG buffer overflow vulenrability which may well be exactly what the OP was asking about. – Daniel B Mar 16 '12 at 8:37
-
Note that there are other things in image files that can be exploited if improperly implemented, such as image metadata. – tdammers Mar 16 '12 at 8:53
It's possible to hide information (text, data, anything) in a image using steganography technique.
If an executable is hidden in a image, it still needs to be executed to infest your system. In practice, it depends on how you open the image, depending on the software/OS you use to open it.
-
I know about stenganography injection, but I didn't think it could be executed with out the used a decryptor. Naturally the software would have to be executed, but as I recall, it was executed after as the image opened (my memory may be faulty on this), but if that is the case, then I am further boggled.... – ahodder Mar 15 '12 at 21:54
Simple. He also smuggled in a (most likely) vbs script, that did the actual job of extracting the virus code from the picture and executing it. Not very different from just double clicking the BeautifulGirls.exe attachment that was arriving in your inbox 5-6 years ago.
-
-
-
why is that better than just putting the virus code in the vbs script directly? – psr Mar 16 '12 at 3:41
-
Suppose there is a buffer overflow bug in an image loading/processing module. It could be possible to create an image that triggers the bug and injects malicious code this way.
