Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a small number of employees who use a company computer but these people aren't very tech savvy. They use an email client and a messaging client.

I'm pretty sure they wouldn't click on .exe or .zip file in an email without thinking, and I know that's one area of concern.

However, I'm thinking about images. In fact, regardless of how capable a person is with technology I believe that attaching things (code or anything else) to an image can be a security risk.

What can be attached to images to harm another?

I believe that images can pose a security risk as they 'automatically execute' or something.

There are so many ways that images can be received by a computer (including phone or tablet of course):

- email
- iMessage (or any other messaging app)
- someone right-clicking and saving an image from a web page
- just viewing a web page of course downloads the image to cache

What precautions do I need to take regarding the above four things? Can someone just attach some code to an image and it execute?

What do I need to do to prevent images being used against my computers?

I'm guessing you couldn't just attach code to an image and iMessage someone's iPhone. What about Android?

share|improve this question

8 Answers 8

up vote 26 down vote accepted

The other answers mostly talk about attaching arbitrary code to images via steganographic techniques, but that's not very interesting since it requires that the user be complicit in extracting and executing that. The user could just execute malicious code directly if that's their goal.

Really you're interested in whether there's a possibility of unexpected, arbitrary code execution when viewing an image. And yes, there is such a possibility of an attacker constructing a malicious image (or something that claims to be an image) that targets specific image viewing implementations with known flaws.

For example:

In general, these sorts of things are difficult to protect against. The best thing you can do is to keep your systems and applications updated. Enabling DEP for all programs also should help, as should avoiding running programs with administrative privileges.

share|improve this answer
4  
This, to me, is the only correct answer. All the other answers involve the user deliberately, maliciously, extracting malware hidden in an image file - and the OP said the users weren't tech savvy, so this is very unlikely. –  James_pic Apr 8 at 8:24
3  
The OP asked about prevention, so probably also worth mentioning that the issue can be largely prevented by ensuring that security updates are applied to systems promptly, and installing anti-virus software on any Windows based systems. –  James_pic Apr 8 at 8:27

Yes, there are ways to 'exploit' buffer overflows.

Sometimes the code may need to be executed via a separate script, and in theory you could assemble a virus from multiple images that contained code hidden within the picture using stenography but there are easier ways.

Basically many computer systems expected images to comply with the exact specification for the type and the failed to correctly range check the formats/parameters being passed.

By 'engineering' an image so that externally it looks like it complies but internally it does not, it was to be possible to trigger stack corruption/buffer overflows that would allow code hidden in an image to be executed under the authority of the user.

But note that this does not ONLY apply to images, it can apply to ANY file, take a look at the recent RTF exploit in MS word.

share|improve this answer

You can always hide files/programs/anything in the 'slack space' of any file. Then you could run a script later to extract and/or compile what you have hidden... For instance, you could embed a malicious executable (or smaller script) within multiple images on a website. When a user goes to the website, they download the images.

Learn more about Slack Space here: http://www.computerhope.com/jargon/s/slack-space.htm and then play around with it yourself by grabbing a hex editor (http://mh-nexus.de/en/hxd/) and messing around.

share|improve this answer
2  
Thanks, some good info. What about running the malicious code though? Your answer explains how someone could hide the code. Surely they can't just embed a .exe in an image and every web visitor has that file execute. I see it is very easy for someone to embed the code, but can't believe anything will just run willy nilly. Does the hacker need to do something specifically to trigger the code to run? –  user2143356 Apr 7 at 22:04
    
There are two basic ways that an attack can occur from the slack space. The easiest is to simply store the really bad code (what is most likely to get detected from a virus scanner) in the slack space and then 'activate' the code by a more traditional method. For instance, you could go to a torrent site and not directly dl a virus itself but only the seemingly harmless (to your Virus Scanner) torrent file all-the-while your browser is dl the actual virus in all those banner ads' slack space. The other way is to embed the call method inside the 'real' image part. –  Matthew Peters Apr 7 at 22:27
    
Here is a nice article about all the different types of slack space viruses and such computervirus.uw.hu/ch04lev1sec2.html section 4.2.13.6 is probably most helpful in describing my second method. –  Matthew Peters Apr 7 at 22:27
    
Embedding the call in the image part will not work. the only way to execute a virus like this would be to directly invoke the code in the harmful image by another executable or script. –  Kotzu Apr 7 at 22:40
1  
@MatthewPeters Whether malicious code can be run when the image loads is a quality-of-implementation issue. Image decoders can have bugs that lead to buffer overflows (which then could lead to code execution). –  jamesdlin Apr 8 at 2:02

Yes, it is possible to hide malware in an image. It is not very common attack at all but recently it seems that malware authors start hiding malware inside images.

Malware analysis is not my thing. if you want more information search for "Steganography Malware".

One advice is do not open emails from untrusted/unknown source.

share|improve this answer

Exploits are just that, exploits. Someone finds a vulnerability in some widely used code, and then sets out to set the stage for that vulnerability to do its thing. Let's pretend for example someone out there figured out that some widely-used email client has a bug that leads to a buffer overflow in some specific circumstance. If enough malformed data is fed into the buffer, it overruns onto the stack. Now you can take an image, malformed exactly like it needs to be to cause the buffer overflow, embed into it some malware, and pad the end of the data with a bunch of NOPs and then a clever small assembly routine that get dumped on the stack, which when run points directly to the malware that is already loaded in memory in the image buffer. All a user has to do to get infected is have the malformed image be displayed in the vulnerable application. This is a more common channel of attack in highly specific zero-day exploits.

Remedies to these problems are fortunately easy to apply. Configure the machines to only allow plain-text messages. Make sure you use only well maintained software and apply all updates automatically.

share|improve this answer
    
"Configure the machines to only allow plain-text messages" But you can easily embed malware in plain text. Say, shell scripts or VBScript. –  el.pescado Apr 8 at 12:50

For pretty much any file format, the programs who read it might have some bugs exploitable by a maliciously crafted file.

It can happen (and has happened) also for images; but it'd generally be limited to a single particular program (or library) reading it, not a general "image with malware" that attacks all such programs.

Even text files aren't theoretically safe if the programs try to do something interesting with them. A sql injection in a blog comment post is essentially "malware attached to text"; there was a vulnerability in Python allowing crash (=denial of service) by submitting malicious text data and claiming that it's in UTF-7 encoding, exploiting a bug in that decoder; and there exist attacks based on breaking XML parsers by, again, malicious near-text data.

share|improve this answer

There are programs called binders which will normally attach an executable to an image. Malware found in images tend to be RATs(Remote Administration Tools) which is some skid stuff that some skid will use to gain access to your computer. Normally this is only used though on websites where horny idiots talk to these skids, and the skids pretend they're a girl and tell them to download an image. Personally I think there are much better ways of spreading things, also most anti-viruses should detect these "bindings" even if the virus is FUD(fully undetected).

share|improve this answer

The of plain text messages is that when the mail client is only reading plain text, none of the potentially dangerous or hidden scripts will be interpreted or run at all. It will just be a string to the mail client.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.