Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system.

How is this possible?

share|improve this question
    
Do you mean image as in picture file like JPEG/BMP or disk image? –  JBRWilkinson Mar 15 '12 at 22:32
    
Picture file. I can't image how easy it must be place a virus into a disk image. –  AedonEtLIRA Mar 15 '12 at 22:33
add comment

4 Answers

up vote 11 down vote accepted

Using this would generally depend on a fairly simple fact: most images are compressed. Along with this, the code to de-compress an image is often written assuming that the data in the image was compressed according to a fairly specific set of rules.

At times, however, people have found various vulnerabilities, chiefly that old standby, the buffer overrun, in image decompression code. By writing a file that does not follow the rules expected by the decompressor, they can figure out a way to overrun a stack-allocated buffer, and write data outside the allocated space on the stack.

From there, it's a fairly typical buffer-overflow attack, which are widely enough documented that there's no real point in my trying to go into it here.

share|improve this answer
1  
Yepp, the correct answer. Wikipedia's article on buffer overflow is fairly informative, and even links to the famous GDI+ JPEG buffer overflow vulenrability which may well be exactly what the OP was asking about. –  Daniel B Mar 16 '12 at 8:37
    
Note that there are other things in image files that can be exploited if improperly implemented, such as image metadata. –  tdammers Mar 16 '12 at 8:53
add comment

It's possible to hide information (text, data, anything) in a image using steganography technique.

If an executable is hidden in a image, it still needs to be executed to infest your system. In practice, it depends on how you open the image, depending on the software/OS you use to open it.

share|improve this answer
    
I know about stenganography injection, but I didn't think it could be executed with out the used a decryptor. Naturally the software would have to be executed, but as I recall, it was executed after as the image opened (my memory may be faulty on this), but if that is the case, then I am further boggled.... –  AedonEtLIRA Mar 15 '12 at 21:54
add comment

Simple. He also smuggled in a (most likely) vbs script, that did the actual job of extracting the virus code from the picture and executing it. Not very different from just double clicking the BeautifulGirls.exe attachment that was arriving in your inbox 5-6 years ago.

share|improve this answer
    
and the vbs script will be launch / execute by ? –  Nettogrof Mar 15 '12 at 22:03
    
Strictly hypothetically speaking, by autorun.inf script on a cd/usb. –  Jas Mar 15 '12 at 22:14
    
why is that better than just putting the virus code in the vbs script directly? –  psr Mar 16 '12 at 3:41
    
@psr - Who said anything about being "better" ? –  Jas Mar 16 '12 at 9:35
add comment

Suppose there is a buffer overflow bug in an image loading/processing module. It could be possible to create an image that triggers the bug and injects malicious code this way.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.