3

So I recently stumbled on multiple cases suggesting there's a JPG/PNG exploit which is able to silently execute malicious code when simply viewing the image? Just looking for some insight as to whether this vulnerability requires the user to open the png or just simply " view " it.

videos showing POC -

https://www.youtube.com/watch?v=LsJFJkj8uiY ( Discord to distribute )
https://www.youtube.com/watch?v=1x6CLoKySoQ ( Gmail to distribute )

In the above videos the malicious code executes from just viewing the image inside your browser, not even downloading and opening locally. I mean if this is the case and I'm interpreting this correctly then surely at this current state the internet is " gg ", in basic terms don't open your browser lol?

10
  • Looks like they're opening in a program... that program probably reads meta-tags in the image. I think the meta-tags contain the exploit. They can also be used to exploit servers who read meta info. – pcalkins Feb 6 '20 at 22:16
  • @pcalkins In the video regarding gmail, the image is never opened locally and/or with a program, it's simply viewed inside the browser and the malicious code is executed so I'm guessing gmail reads the meta data automatically and therefore executes malicious code locally? – user226594 Feb 6 '20 at 22:32
  • I thought I saw him open it in a program... if not, then I suppose yes. Gmail could possibly have a vulnerability if they read meta-data from the image. Seems unlikely though... if the server were compromised, it could then send javascript back to the browser to do something... but they'd still be in the browser's "sandbox". – pcalkins Feb 6 '20 at 22:35
  • @pcalkins a more indepth video suggests gmail alone youtube.com/watch?v=oV8TX2GWZa0 – user226594 Feb 6 '20 at 22:40
  • I guess this is fuckery especially if it effects discord and other ims, send image to one channel with 1000s of users is catastrophic surely – user226594 Feb 6 '20 at 22:41
2

There is almost 0% chance this exploit works at all. This is a scam.

First, I'd be very skeptical about this kind of a thing. He's got comments disabled, no real technical explanation of what's going on here and there are a ton a ways this could have been faked video. In addition, the CVEs referenced in the description of the video would not have caused that kind of an exploit. They are all vulnerabilities for programs not shown here except for "bypass gmail" which is not what this exploit is attacking and not how that kind of an exploit would be described by anyone who has any technical prowess in the security field.

The way this kind of an exploit should work is it attacks the interpreter that reads the image binary and displays it. Since he shows it working both when loaded in chrome and on the desktop, it would have to attack the windows kernel. Meaning that yes, this would be pretty detrimental for the internet. That being said there are countless other exploits in the wild right now that are far worse than this one. Be careful who you open emails from.

2
  • He's not the only one promoting this " Exploit " I'm guessing it's apart of a scheme to fund a group of individuals, only thing I found suggesting it may be legitimate was it was listed on " 0day.today " for sale which once was a reliable source for buying exploits, however in recent times I'm not sure. Thanks for your insight on whether this could be legitimate or not though :). – user226594 Feb 7 '20 at 1:38
  • 2
    "reliable source for buying exploits" - no such thing – pcalkins Feb 7 '20 at 20:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.