I was reading an article about malware active in ad-banners, limited to systems with IE-browsers with some settings.

Millions exposed to malvertising that hid attack code in banner pixels

Researchers from antivirus provider Eset said "Stegano," as they've dubbed the campaign, dates back to 2014. Beginning in early October, its unusually stealthy operators scored a major coup by getting the ads displayed on a variety of unnamed reputable news sites, each with millions of daily visitors. Borrowing from the word steganography—the practice of concealing secret messages inside a larger document that dates back to at least 440 BC—Stegano hides parts of its malicious code in parameters controlling the transparency of pixels used to display banner ads. While the attack code alters the tone or color of the images, the changes are almost invisible to the untrained eye.

To execute the hidden payload, the malicious ads load a heavily modified version of Countly, an open-source package for measuring website traffic. That JavaScript extracts the hidden code out of the image and executes it. Because there's nothing per se malicious in the JavaScript, ad networks fail to detect what's happening.

Might it possible that a javascript(or other)-stegano file saved on a hd, could be active when an internet connection is online ?

  • 1
    The alpha channel of the image is just a creative way to hide the code. That doesn't make the image itself dangerous. – Arminius Dec 10 '16 at 21:02

Files are not inherently dangerous; attack files like this are either programs that need to be executed, or make use of issues in another program when loaded into that one as data.

From your article:

To execute the hidden payload, the malicious ads load a heavily modified version of Countly, an open-source package for measuring website traffic. That JavaScript extracts the hidden code out of the image and executes it.

That is, the image contains a small JavaScript program, which is extracted and run by some code that the ad network places on a webpage, and viewing that webpage causes your browser to execute it.

If the image were to just sit on your hard drive, nothing happens. If you open it in an image editor, nothing happens. You have to execute it.

Now, many pieces of malware will take advantage of vulnerabilities in image viewing software, audio players, etc., so it is not generally safe to open up suspicious files in them; I don't mean to imply that web browsers are the only way to run an exploit. Similarly, malware will often try to get itself added to a machine's "run at boot" list, so that the OS will execute it automatically. But in this specific case, it appears the exploit runs through a browser.

Anyways, when it is run, an exploit can do (more or less) anything it wants, so yes, it could check for the presence of a valid network connection. It's mentioned that this one performs a series of checks to try and determine if it's being run in a vulnerability-checking environment, and those are probably much more sophisticated than merely checking if it can access an external server. But again, this can only happen if it's running.

  • A question of ignorance: How should a non-expert effectively check the "run at boot" list? – Mok-Kong Shen Dec 11 '16 at 11:28
  • Thank you for the explanation an deep understanding of these themes. Seems it's somehow also possible to add ELF/EXE/COM code to such files too. But it must running. – Tech-IO Dec 11 '16 at 15:36
  • @Mok-KongShen That depends on your operating system. In the Windows XP years (the last version of Windows I used regularly), there was a Startup folder in the start menu that would auto-start anything put in it, as well as several registry keys; on Linux, it's most commonly something listed in /etc/profile or a variety of other shell configuration files, something registered with the init system. You'd be best off asking at Super User, Ask Different, or Unix & Linux for a more complete list. – Xiong Chiamiov Dec 11 '16 at 21:56

It is possible to have "polyglot" files which are both a valid image file, but also have malicious code embedded in them. There may also be flaws in a specific application triggered by reading a file with certain attributes embedded in metadata or in the "data" portion of the file itself.

Ultimately, the file would need to be executed or viewed in some way. An image file simply sitting on a filesystem will not run on its own, but its possible that the exploit code could be run when the file is scanned by antivirus, search indexing application, or some other process which tries to view or execute the file.

It is not that the browser is downloading the file, its that the malicious image file is being executed by the browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.