Checking potentially infected photos for stegonography

Question

A friend of mine has an old family PC with a bunch of important photos on it. Unfortunately, from what he told me, it seems like they have fallen victim to a tech support scam some five years ago, during which the scammer had remote access to their machine. They haven't used this PC ever since that incident, because they were afraid that the scammer might have put some sort of malware onto their system. Since they aren't super tech-savvy, my friend asked if I could help him safely recover their photos.

My idea would be to connect his HDD to my laptop using a SATA-to-USB adapter, boot into a Linux live environment, mount the HDD there, and copy the photos to either an external HDD or to my NAS. I see one problem with this, however. I'm by no means a security professional, but form what I've learned, it's rather easy to embed a malicious payload into an image file (or at least a file that looks like an image; "steganography", "stegosploit"). So, it seems entirely possible that someone with remote access could have either copied an infected image to their hard drive, or run some sort of malware that infected their own photos. I think it's unlikely that a tech support scammer would do this sort of thing, but the last thing I want to do is recover their photos and at the same time infect their current devices with malware.

Is there a reliable way for me to check their image files for such embedded malicious payloads (ideally from a Linux system)? My best guess would be to scan these files using an AV program such as ClamAV - do you think that would be good enough? Other than that, all I found were research papers looking into methods for detecting steganography, which leads me to believe that this is still a rather difficult problem to solve...

Edit: I have played around with OpenCV a while ago, which lets you read an image file into a Numpy array. So, theoretically, I could write a Python script that reads each of their photos into a Numpy array and exports it as a completely new image file, for a more of a "sanitizing" approach, rather than a "scanning" one. Do you think this is a good idea (especially of done by someone who's not a security expert)?

Answer 1

Start by copying every image file on their infected device to a media card. Then on your recovery machine launch a VM running an OS that is immune to Windows malware (Linux), install ImageMagick, mount the media card, then use a script that calls ImageMacick to transform each image to PNG format. This will neutralize malware that leverages flaws in JPEG handling, while preserving the pictures. Consider stripping away all existing thumbnails contained in the original files and regenerating them from the source image.

Answer 2

They haven't used this PC ever since that incident, because they were afraid that the scammer might have put some sort of malware onto their system. Since they aren't super tech-savvy, my friend asked if I could help him safely recover their photos.

If the only thing you're recovering is photos, don't worry. Simply copy only jpeg files.

If there's hidden data in them, it won't really matter. If it's steganographic data, who cares? A special tool would be needed to extract the data anyway. And why on earth would an attacker bother doing this?

If it's an exploit targeting image viewers, it's probably patched by now. Exploits that trigger by viewing a file happen, but they are high profile - because it's so trivial to exploit for an attacker, so they tend to be noticed and fixed. The chance of such an exploit both being well known to be used in a mass attack, and unnoticed enough not to be patched five years later is slim.

This may be a worry if you're a high profile target where a persistent access is valuable. As a random victim of a mass attack, such levels of sophistication is unlikely.

So I'd say that you're perfectly fine just copying the data; just make sure you only copy JPEG files. If you're paranoid, you can run all images through a conversion with ImageMagick or similar tools.

Answer 3

If you're after learning this and maybe writing some tools others can use, by all means go ahead. The community will be grateful.

If you're after only making sure the files are clean 100+ %, you won't be able to do that. There will always be 1% unknown at the minimum (in reality, it is much more than that but we ignore those). You can consider 99% percent safe after an anti-virus scan. You can consider 98% even without an anti-virus scan (for pictures only).

It's extremely unlikely for a tech support scammer to deal with this kind of scheme unless these computer owners are very very valuable targets (rich? high level IT at large corp?) - in that case, the tech support scam itself would be a cover and you should just forget about the data / laptop (or write in their will to be opened back up in 30 years).

Think about this: They were able convince the owner to hand over the access to them. Why should they go extreme depths to hide things from people who can hand over their computer easily? If they wanted a back door, they could simply install a few malware. Since, many people realizes they got scammed after they lost money, installing malware is not sustainable because a) Many will format their computers. b) They will complain to authorities and all of your bots will be known to them (i.e not stealth at all).