Timeline for Can malware be attached to an image?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 8, 2017 at 0:30 | comment | added | Free Consulting | But network transmitted data has no slack until written to storage... | |
| Apr 8, 2014 at 12:45 | comment | added | Léon Pelletier | Windows have their virus-friendly executable videos (WMA), do they have also the image equivalent? | |
| Apr 8, 2014 at 2:02 | comment | added | jamesdlin | @MatthewPeters Whether malicious code can be run when the image loads is a quality-of-implementation issue. Image decoders can have bugs that lead to buffer overflows (which then could lead to code execution). | |
| Apr 7, 2014 at 23:35 | vote | accept | user2143356 | ||
| Apr 8, 2014 at 13:39 | |||||
| Apr 7, 2014 at 23:25 | comment | added | Matthew Peters | @Kotzu, is right in that malicious code can't run just because the image loads (so far as I know). However, the code is still there and can be called by any number of other vectors. There was a time when browsers even allowed direct links to local files directly from a webpage... For instance, 'bad code' in the nonSlack space could still be dangerous if it exploits an issue by the legitimate program loading the image (similar to a SQL injection, you could toss some bad metadata and have firefox interpret it). To answer your question, I'd say the average user is safe for 90% of the time. | |
| Apr 7, 2014 at 23:09 | comment | added | user2143356 | So can I be safe that even though images can have all sorts of malware embedded in them (slack space, EXIF etc.) that just be viewing and downloading images isn't going to infect my computer and that the code in these images needs to be executed by a separate script? | |
| Apr 7, 2014 at 22:40 | comment | added | Kotzu | Embedding the call in the image part will not work. the only way to execute a virus like this would be to directly invoke the code in the harmful image by another executable or script. | |
| Apr 7, 2014 at 22:27 | comment | added | Matthew Peters | Here is a nice article about all the different types of slack space viruses and such computervirus.uw.hu/ch04lev1sec2.html section 4.2.13.6 is probably most helpful in describing my second method. | |
| Apr 7, 2014 at 22:27 | comment | added | Matthew Peters | There are two basic ways that an attack can occur from the slack space. The easiest is to simply store the really bad code (what is most likely to get detected from a virus scanner) in the slack space and then 'activate' the code by a more traditional method. For instance, you could go to a torrent site and not directly dl a virus itself but only the seemingly harmless (to your Virus Scanner) torrent file all-the-while your browser is dl the actual virus in all those banner ads' slack space. The other way is to embed the call method inside the 'real' image part. | |
| Apr 7, 2014 at 22:04 | comment | added | user2143356 | Thanks, some good info. What about running the malicious code though? Your answer explains how someone could hide the code. Surely they can't just embed a .exe in an image and every web visitor has that file execute. I see it is very easy for someone to embed the code, but can't believe anything will just run willy nilly. Does the hacker need to do something specifically to trigger the code to run? | |
| Apr 7, 2014 at 21:48 | history | answered | Matthew Peters | CC BY-SA 3.0 |