Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I came across below article. https://code.google.com/p/doctype-mirror/wiki/ArticleContentSniffing
on of the things that brought my attention is
To be on the very safe side, it is best to actually process the image using an image manipulation library. Read the image file, convert it into a bitmap, and then convert it back to an image file in the appropriate format
how can this prevent from a malware encoded with steganography? Does conversion to bitmap ignore/skips encoded malware code?
The linked article talks about code included into the image itself. For it to be readable and interpretable by a browser, it has to be written in text.
Thus it is not steganography.
The idea behind processing the image back to bitmap then to the appropriate format is that: first you can check that the image is a valid image (it can be read). Then once you have a bitmap, no "code" can remain from the original image, since you are sitting here with plain RGB values. The article talked about putting HTML code within an "image comment". At the point of bitmap, there is no such thing anymore. Finally you reencode the image using a program under you control so that you are sure there's nothing fishy in it.
If we suppose that the image has been formed such as it triggers a vulnerability into the an image viewer (this is not steganography per se) processing the image with another program than the targeted viewer then re-encoding the image will most probably break the exploit. Most image process are lossy encoding and result in loss of information when you encode/decode an image, so you most probably won't get the exact same file after re-encoding.
