Image-Borne Malware: How Viewing an Image Can Infect a Device
There's nothing dangerous about viewing pictures in a browser, right? Most users with some level of technical knowledge are familiar with typical malware concealment methods, such as document-borne malware. But there's more than one way to introduce malware. Image malware — malware that's concealed within in-browser images — has become a potential threat vector as well.
Users typically don't think of common image files (such as .jpg, .png, .bmp, and .gif pictures) as risky or insecure. But Saumil Shah, CEO of Net-Square and security researcher, explained how it's possible to conceal malicious code in an image during his presentation at the 2015 Amsterdam hacking conference, Hack In The Box. He then demonstrated how to get the browser to execute the code, resulting in a successful malware attack.
In other words, a device can be compromised, in theory, after simply opening a picture in a browser.
Referencing the ancient method of message concealment called steganography, Shah dubbed this kind of malware exploit "Stegosploit." (Steganography refers to hiding data in an image, message, or file.)
The Stegosploit technique hides malicious code within the pixels in a digital image. Shah referred to the malicious code used in the image as "IMAJS," and it's a combination of JavaScript and image code. The malware leverages the HTML 5 <canvas> tag, which is supported by commonly used browsers such as Internet Explorer and Firefox, to get the browser to read the pixel data as JavaScript.
When the picture is loaded by a browser, the hidden malware is automatically decoded. And the malicious code is executed. In one example, Shah demonstrated how to use the IMAJS code to hack into a PC and send the machine's data to the attacker.
This kind of attack is especially pernicious because opening an image isn't typically considered dangerous. The user doesn't have to enable scripts or download the image or indeed, take any action at all aside from opening the image, for the malware to infect the device.
The majority of images are safe, but it's impossible to know for sure without analyzing an image file — or rather, every image file accessed by an end user — on a granular level.
OPSWAT's Solution
Content Disarm and Reconstruction (CDR), or Data Sanitization, is one way to effectively block image-borne malware by removing embedded malicious codes, including those written in JavaScript. In Content Disarm and Reconstruction, the potentially insecure aspects of a file, such as scripts or macros, are stripped. The file is broken down and rebuilt without these elements, exactly the same as it was before and with all original functionality intact. Visit this page to learn more about CDR.
File Type Conversion is another way to ensure an image is made secure. By converting file types such as .jpg and .png into PDFs, users can avoid opening the file in an application that would read and execute the code. Thus the malicious codes are not executed. Learn more about File Type Conversion.
Attackers are always looking for new threat vectors, which is why OPSWAT is dedicated to protecting organizations from the latest threats.
h/t The Hacker News

- Academy 14
- Advanced Threat Prevention 55
- CEO's Blog 21
- Company Announcements 42
- Cross-Domain Solutions 33
- CTO's Blog 23
- CVEs 195
- Deep CDR 41
- Email Security 21
- File Upload Security 14
- Malware Analysis 76
- OACCP Certification 31
- OESIS Framework 12
- Product Announcements 176
- Reports 28
- Secure Access 23
- Secure Data Storage 15
- Technology Partnerships 38
- Vulnerabilities 21
- File Upload Protection – 10 Best Practices for Preventing Cyber Attacks
- MetaDefender Prevents Emotet - The World’s Most Dangerous Malware
- OPSWAT Expands Global Availability of Critical Infrastructure Protection
- OPSWAT Announces Expansion of Cybersecurity Training Program
- Avoiding storage data leaks and PII regulation noncompliance
- How OPSWAT Can Help Detect and Prevent the VMware WorkSpace ONE Access exploit (CVE-2020-4006)
- Protecting Critical Infrastructure from Advanced Cyberattacks
- MetaDefender Cloud Hash Reputation Database Now Exceeds 40 Billion
- OPSWAT Continues to Expand OESIS Framework with New Partners
- 6 Potential Security Gaps in File Transfer Process for Critical Infrastructure