I have been analyzing malware and I am seeing many 1x1 png and gif files. What could these be used for?
1
-
tracking.– MCWNov 11, 2014 at 15:27
Add a comment
|
3 Answers
Single pixels are used for traffic monitoring. There is at least one legitimate usage known to me: The German organisation VG Wort uses so-called Zählpixel to distribute some money to authors of copyrighted texts on the internet based on visits to their texts.
There are also tracking devices by advertising agencies (including the Referer Header they learn which IP visits what web page) one might consider legitimate.
Also authors of malware want to know their "customers", and single pixel images are a stealth way to learn about them.
answered Nov 11, 2014 at 15:52
Depends. These have typically been inserted into iFrames, and other injection attacks likely because they are rarely visible (think about it, it is one pixel). Strangely it's easier (more covert) to just assign a height=0 width=0 along with the image, but that's another story. Most of these images process code from PNG's metadata which you can read about here, with GIF's processing code, you can read about that one here. For the most part, they are used to execute code. Even a simple dropper can lead to greater infections.
They could be used for anything. Depends on the nature of the malware.
Most common use of 1x1 graphics is in tracking. E.g., http://en.wikipedia.org/wiki/Web_bug
"Malware" is about as broad as "Software"
