Do commercial AV suites examine image files (pictures) for potential malware that might be imbedded via steganography? Is this a concern for most?
I deal with a lot of imagery data and am wondering what the risk of exposure is.
1
-
1It really depends on each individual AV product, the AV product configuration, and the payload itself. Some AV product may claim to scan 'everything,' but some admin could have disabled scanning for image extensions.– SaustinSep 29, 2020 at 22:10
Add a comment
|
1 Answer
Executable code embedded in an image, malware or otherwise, does nothing without an external program capable of acting on it. Granted there have been a few cases in the past exploiting errors in the image processor code to force an overflow into the embedded malware code, but with rare exception, steg content is not a direct threat.
A common practice amongst high security sites is to translate all arriving images to a different format such as JPG to PNG in an isolated handler. You can do this a well if you like, but the threat is miniscule.
answered Sep 30, 2020 at 3:52
-
This is not really helpful and doesn't answer the question. First, malicious code in a binary does nothing until it is triggered externally, too. Second, images are currently being used to store malicious code that gets stitched together by other processes to build malware locally on the device. Third, This answer does not address what AV does.– schroeder ♦Sep 30, 2020 at 8:46
-
@schroeder - Contray to the question title, the body of the question is "I deal with a lot of imagery data and am wondering what the risk of exposure is." That is the question I answered. Yeah I know, "No soup for you!" Sep 30, 2020 at 17:14
-
@schroeder - You said, "images are currently being used to store malicious code that gets stitched together by other processes to build malware locally ..." . You're fundamentally arguing that if your machine is already running malware, images can be used to communicate. Yes that's true, but in that case you're already compromised. The same argument can be made for text, sound, or any interface. Sep 30, 2020 at 17:31
-
-
@schroeder - You said, "... malicious code that gets stitched together by other processes to build malware locally ..." Other processes is the very definition of already infected . Oct 1, 2020 at 14:57