0

Do commercial AV suites examine image files (pictures) for potential malware that might be imbedded via steganography? Is this a concern for most?

I deal with a lot of imagery data and am wondering what the risk of exposure is.

1
  • 1
    It really depends on each individual AV product, the AV product configuration, and the payload itself. Some AV product may claim to scan 'everything,' but some admin could have disabled scanning for image extensions. – Saustin Sep 29 '20 at 22:10
-1

Executable code embedded in an image, malware or otherwise, does nothing without an external program capable of acting on it. Granted there have been a few cases in the past exploiting errors in the image processor code to force an overflow into the embedded malware code, but with rare exception, steg content is not a direct threat.

A common practice amongst high security sites is to translate all arriving images to a different format such as JPG to PNG in an isolated handler. You can do this a well if you like, but the threat is miniscule.

6
  • This is not really helpful and doesn't answer the question. First, malicious code in a binary does nothing until it is triggered externally, too. Second, images are currently being used to store malicious code that gets stitched together by other processes to build malware locally on the device. Third, This answer does not address what AV does. – schroeder Sep 30 '20 at 8:46
  • @schroeder - Contray to the question title, the body of the question is "I deal with a lot of imagery data and am wondering what the risk of exposure is." That is the question I answered. Yeah I know, "No soup for you!" – user10216038 Sep 30 '20 at 17:14
  • @schroeder - You said, "images are currently being used to store malicious code that gets stitched together by other processes to build malware locally ..." . You're fundamentally arguing that if your machine is already running malware, images can be used to communicate. Yes that's true, but in that case you're already compromised. The same argument can be made for text, sound, or any interface. – user10216038 Sep 30 '20 at 17:31
  • I'm not saying that the machine is already infected. – schroeder Sep 30 '20 at 19:23
  • @schroeder - You said, "... malicious code that gets stitched together by other processes to build malware locally ..." Other processes is the very definition of already infected . – user10216038 Oct 1 '20 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.