6

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? Suppose the image is sent via WhatsApp/any other messenger.

Also what exactly happens when someone renames a malicious apk to .jpg or .png or .mp4. Will the malware/spyware execute if you open the image/video?

  • In short: yes. It depends on the app, as any app can in theory implement it's own image-rendering algorithms, with unique possible vulnerabilities. – Martin Fürholz Oct 10 '18 at 2:31
  • @MartinFürholz Most applications will use the same libraries used by everything else. There are only two popular libraries for the JFIF standard (JPEG format), for example. – forest Oct 10 '18 at 4:48
  • @forest sure, that's why I said in theory they could implement their own image-rendering algorithm. It's possible, and I would not completely rule out that it will happen again. It's highly hypothetical, of course. – Martin Fürholz Oct 10 '18 at 6:51
  • @MartinFürholz True, and some applications use complex libraries above the low-level decoders, e.g. imlib2 (which is quite insecure) which uses libjpeg, libpng, etc. as backends. – forest Oct 10 '18 at 6:58
5

I am aware that on Windows this is very much possible. But is it possible on Android [...] Can you install a virus/malware/spyware by just clicking on an image?

Yes, it is possible, although difficult. There is no fundamental difference between Windows and Android in terms of image decoder vulnerabilities. In fact, chances are that both systems are using the same library for decoding, with identical vulnerabilities. The precise mitigations (DEP, ASLR, stack canaries, etc) applied by the operating systems are similar as well.

The only way this can be done is if there is a severe security bug in the image library. A security bug may be able to hijack the library and trigger arbitrary code execution. In these cases, the malicious image is not actually an executable itself, but rather contains a slightly modified format that is not so different that it causes an error, yet is similar enough that it is processed by the library, triggering unintended behavior. These kinds of bugs are pretty rare, and they are fixed rapidly when they are discovered. You should keep your software up to date (preferably with automatic/unattended updates) in order to avoid having a vulnerable image library for long.

Also what exactly happens when someone renames a malicious apk to .jpg or .png or .mp4. Will the malware/spyware execute if you open the image/video?

If someone renames a malicious executable file so it has an image extension or otherwise find a way to pass it to the media decoder (e.g. changing the MIME type), you will simply get a message that the image cannot be displayed. The decoder will not automatically recognize the file and execute it if it is not an image. Decoders work by first checking for so-called magic bytes at the beginning of the file which specify the type of file. The bytes for an APK and for a JPEG file, for example, are completely different. If it does not see the JPEG bytes it will simply refuse to even try to parse the file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.