3

Lately, poking through my SPAM folder I have found a typical sextortion scam letter. It has a PNG file with letter text attached.

What's interesting it's asking to interact with the image and "copy-paste" wallet id because it's "cAsE sensitive" which is obviously not possible for a PNG image with text.

image with bitcoin wallet number suggesting user to "copy it"

This may look like some blooper, however I've heard that there are recent Android PNG vulnerabilities CVE-2019-1986, CVE-2019-1987, CVE-2019-1988 which seem to allow the perpetrator to execute remote code.

Am I overthinking the case? Is this attack possible at this moment and how do I protect from it?

P.S. my phone manufacturer does not seem to update Android security version very often (obviously I don't want to publish what my current security update version currently is).

Improve this question
2
  • 4
    It would seem to me that someone who is trying to exploit a PNG processing vulnerability would have absolutely no motivation for making the vessel of their exploit look like a bitcoin extortion scam. (Especially since it would generally be a ton of additional work for the attacker to make their exploit still display any image at all rather than looking like a random crash of the targeted application).
    – hmakholm left over Monica
    Mar 10, 2019 at 22:01
  • @HenningMakholm a very interesting point about crashing, I didn't think about it.
    – Boris Treukhov
    Mar 10, 2019 at 22:11

3 Answers 3

Reset to default
2

Am I overthinking the case?

Yes, you're overthinking this. The message you've received (which is a common scam) is using an image to evade keyword detection by spam filters.

Improve this answer
1

In general, you should should always keep images turned off by default in whatever email client you are using. Even if images have all of their execution level vulnerabilities fixed, there are still a number of phishy ways to exploit them. While I would not be surprised if this email is exploiting one of the vulnerabilities you mentioned, that image could also be a hyperlink designed to trick you into visiting a malicious site so that you click it when you try to select the text.

Improve this answer
0

There's only two real choices to protect yourself from this attack:

  1. Stop using a phone from such an irresponsible vendor. As a replacement, get a Pixel 3 or something else that gets timely security updates.
  2. Replace your phone's OS with LineageOS or some other third-party OS that includes the security updates.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .