0

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous.

Are there any good reasons not to ignore the scanning of .jpg and .png files to reduce the load on the scanner?

1

Are there any good reasons not to ignore the scanning of .jpg and .png files to reduce the load on the scanner?

One reason is that if you ignore certain files based on their file extension (e.g., ".jpg" or ".png") then attackers can upload malicious files of any type as long they just change the file extension (e.g., replace ".exe" with ".jpg").

1

No, it is not safe to skip scanning images. Do a search on the CVE database for JPEG and PNG and there's no shortage of entries. A more in-depth search of the NVD shows 6 critical-level JPEG CVEs for the last twelve months, and 3 for PNG. Granted, none of the descriptions I skimmed suggest that they're vulnerabilities in default, core OS services the way that the classic MS04-028 was.

1

Ignoring the question of absolute safety as it cannot be answered.

"Are there good reasons," is dependent upon localized criteria.

So with the absolutes out of the way let's explore the issues

First, what constitutes an image, is it the extension, or the magic number extracted via a files command? Does it matter?

Given that an image file is obtained, through upload or whatever mechanism you're using, it could be a false extension containing malware or it could have encoded/Stego'd malware in it, but what if it does? In either case, it's incapable of doing something on its own. There would have to be another piece of code to parse out the stego or run the wrong extension file.

Now it becomes a question of your objective, find compromised websites. Arguably a file extension in conflict with actual content is suspicious but not absolutely wrong. A full virus scan of the conflicting image file may be of value, but again it does nothing without some other malicious program to kick it off. An image file with stego'd malicious content would likely not be detected in the first place, and again it would need some other malicious parsing program to use it. This same other program parsing concept applies equally well to any file, it's unrealistic to expect virus scanners to catch more than the simplist variants.

There have been a couple of extremely rare exploits in the past where the image file content exploited an image program overflow directly. If an even rarer exploit of the scanner was encountered, it wouldn't matter because it would be too late when you scanned it.

What high security systems do with images is to simply transcode them, JPG to PNG, PNG to JPG for example. This will damage any potentially hidden malware. Again, what is your goal, detection or prevention?

Bottom line

Virus scanning images tend to give little return, with a significant potential for false positives.

A file (Linux) command to check the content for comparison to extension might be useful, but ask yourself what action you'd take. No action means no point.

Transcoding would be even slower than scanning.

Skipping image scanning is not without some risk but it's a pretty low risk in most cases in my opinion, of course this depends upon your operational criteria.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.