2

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security holes using buffer overflow or other techniques. Is the only place to store the code ready for execution, inside the EXIF data segments of a JPEG image?

Assuming that someone uses the EXIFtool or FileMind QuickFix to remove all EXIF metadata. Would this clear the image from the code that could execute when viewing the image, thus removing the threat stored inside ?

PS: The image can be viewed and it is not for example a renamed *.exe file. We are not infected by another malware that can read using steganography techniques the code hidden in the images and execute it. We are clean and we just open the image.

EDIT: Case self-executing code can be stuffed inside the actual data of the image apart form EXIF metadata, this code can be detected. If it was encrypted, it would need another malicious program to decrypt it. So how can I detect this code inside the image ?

Improve this question
6
  • If it's encrypted you can't detect it until decryption. But this scenario assumes the attacker can already execute code on your machine.
    – S.L. Barth is on codidact.com
    Commented Apr 30, 2015 at 9:51
  • 1
    Hmmm, your edit seems to point toward a completely different question, ie. how to detect encrypted malicious code.
    – WhiteWinterWolf
    Commented Apr 30, 2015 at 9:52
  • As I refer in the PS section, I am not infected by another malware. So if the code inside the image is encrypted it cannot harm me, because it needs to be decrypted. Taking that into consideration, the malicious code must be somehow visible. How can I detect it ?
    – pgmank
    Commented Apr 30, 2015 at 10:01
  • But, you are right. I should create another question to be more specific.
    – pgmank
    Commented Apr 30, 2015 at 10:08
  • Clean a file as a protective sanity measure and detect the actual presence of a malware are two different things. For your concern regarding encrypted malware, you may want to take a look toward polymorphic and metamorphic codes.
    – WhiteWinterWolf
    Commented Apr 30, 2015 at 10:18

2 Answers 2

Reset to default
7

Not necessarily.

Malicious self-executing code take advantage of bugs affecting the code of some software handling the data. You refer to a bug in the way EXIF has to be processed, but the picture data also has to be handled by the software and the code handling this data might also have bugs which could potentially be exploited.

Removing EXIF data will protect against threats trying to use bugs affecting EXIF data manipulation, but it will not do anything against threats trying to exploit actual picture data handling routines (for this you may imagine an image resizing which would alter the picture data, however you may want to take measures so that the software making this resizing cannot be exploited successfully...).

In all case, such threats can only target very specific versions of software and libraries, since they target a very specific bug they cannot be some kind of "generic exploit" affecting all users opening the image no matter with which software.

Edit: A discussion on this subject can also be found in StackOverflow.

Improve this answer
2
  • 2
    Just one thing I'd like to add: if the executable code is in the image rather than the EXIF data, it might very well show up as an artifact in the image.
    – S.L. Barth is on codidact.com
    Commented Apr 30, 2015 at 9:39
  • 1
    It all depends on the technical issue being exploited and the competency of the exploit writer. One may imagine the executable code being put as trailing data after the end of the image data...
    – WhiteWinterWolf
    Commented Apr 30, 2015 at 9:47
2

Is the only place to store the code ready for execution, inside the EXIF data segments of a JPEG image?

Not necessarily. However, it is much more likely that a bug exists inside the EXIF processing code. JPEG processing code for the actual image is pretty standard, using tried and tested algorithms. It is the EXIF processing which is more bespoke per application depending on what it is doing with the data.

Assuming that someone uses the EXIFtool or FileMind QuickFix to remove all EXIF metadata. Would this clear the image from the code that could execute when viewing the image, thus removing the threat stored inside ?

Possibly. However here you are moving the risk of an exploit from the image display code to the EXIF tool. There is still a possibility that the EXIF tool contains flaws that would allow it to be exploited. You could however run the tool on a separate machine with limited network access, and then pass the image data through once the EXIF data had been removed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .