Software Icons safe?

Question

I recently heard about these Adobe Icons that someone made for some of the best free and open-source applications on a Ubuntu based news site.

"http://www.omgubuntu.co.uk/2016/04/adobe-style-icons-for-gimp-and-inkscape"

They are .svg file icons.

I've read up some on how different images can be malicious and was wondering if this is possible with these icons.

The directions give the following steps:

Step 1: Copy the SVGs to any directory you like. I recommend placing them in a directory which you're unlikely to mess with. Never rename, move or delete the icons.

Step 2: Go to Computer/usr/share/applications.

Step 3: Right-click on 'GIMP Image Editor' in the directory (or any of the apps we support for that matter) and select 'Copy'.

Step 4: Open the Terminal and type this: sudo gedit "Paste the thing that you copied in Step 3" (without the inverted commas) Hit Enter and type in your password.

Step 5: The .desktop file of the app will open in Gedit (a simple text editor). Just find the line that begins with 'Icon=...'

Step 6: Minimize Gedit and go to the directory where you pasted the SVGs. Right-click on the respective file and select "Copy".

Step 7: Return to Gedit. Remember the line I mentioned in Step 5? Just go that line, delete whatever is written in front of "Icon=" and hit 'Paste' there. The address of your SVG should get pasted there.

Step 8: Just hit 'Save' in Gedit and you're done!

I went to virustotal and uploaded the file.

Not a single one of them detected anything.

I want to hear what you guys have to say. Should I do what the directions state?

And as always thanks! :)

Answer 1

I've read up some on how different images can be malicious and was wondering if this is possible with these icons.

Theoretically. But the instructions you quote are for replacing the displayed icon with the one in the SVG, which is harmless. At most you can mark the Gimp with a Calculator icon and mess with people that way; hardly a "vulnerability" if you ask me.

My desktop manager does not interpret Javascript in the SVG, which could (and has been) a vulnerability, nor does it attempt to open the referring schemas (which could be used for clickverting campaigns or even DDoS, if one succeeded in distributing bazillions of forged SVGs and induce people to adopt them).

The reason why VirusTotal did not classify your SVG as harmful is because it isn't:

<svg
   xmlns:dc="http://purl.org/dc/elements/1.1/"
   [...other namespaces...]
   width="64px" height="64px" id="svg3765" version="1.1"
   inkscape:version="0.48.4 r9939" sodipodi:docname="gimp.svg">
  <defs id="defs3767" />
  <sodipodi:namedview id="base" [...sodipodi properties...] />
  <metadata id="metadata3770">[...metadata in RDF format...]</metadata>
  <g id="layer1"
     inkscape:label="Layer 1" inkscape:groupmode="layer">
    <rect id="rect3773"
       style="fill:#00222b;fill-opacity:1;stroke:#00ccff;stroke-width:3;stroke-miterlimit:4;stroke-opacity:1;stroke-dasharray:none"
       width="61" height="61"
       x="1.5" y="1.5" />
    <g id="text4283"
       style="font-size:144px;font-style:normal;font-weight:bold;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#00ccff;fill-opacity:1;stroke:none;font-family:Sans;-inkscape-font-specification:Myriad Pro Bold Italic">
      <path id="path3064"
         d="m [...graphic path...]"
         style="font-size:61px;font-variant:normal;font-stretch:normal;fill:#00ccff;font-family:Myriad Pro;-inkscape-font-specification:Myriad Pro Bold Italic" />
      <path id="path3066"
         d="m [...graphic path...]"
         style="font-size:61px;font-variant:normal;font-stretch:normal;fill:#00ccff;font-family:Myriad Pro;-inkscape-font-specification:Myriad Pro Bold Italic" />
    </g>
  </g>
</svg>