Malicious PNGs: What You See Is Not All You Get

http://blogs.cisco.com/security/talos/malicious-pngs

by 2510c39011c5 • 11 years ago

25 5 11 years ago

blogs.cisco.com

ChuckMcM• 11 years ago

So if I read this correctly, the idea is that the PNG fetch looks innocuous to traffic scanners but the fetcher code executes the included DLL? The PNG rendering code in the browser would just discard those bits.

thephyber• 11 years ago

The article is not clear on the actual execution step. It is written by Cisco, after all, suggesting that the article is concerned mostly with how the worm spreads itself (with more focus on the command-and-control and networking). It's possible that it only spreads when it is saved locally and "opened" by the user in an application. It's also possible that it's executed in the browser upon open and/or render. Since the worm/payload is a DLL and the user-agent making the download requests is Trident, I'm guessing it's a problem with the Windows + IE code, which is likely shared, that renders PNG images.

bryondowd• 11 years ago

What I gathered is that this is just a way for malware to fetch additional instructions after already being executed through some unrelated process.

In other words, you've already been compromised, but the malignant code needs more instructions to continue effectively, so it fetches what appears to be an innocuous PNG file, which carries the instructions it needs.

extc• 11 years ago

So then this is nothing new. Any file which supports arbitrary header lengths can have crap dumped into in order to create a fairly lame disguise.

drostie• 11 years ago

Important: This is not like the old PDF exploits where the code would run when the file was viewed. This is instead a form of obfuscation where the compromised DLL has been concatenated with a valid PNG file. PNG readers will simply display the file normally; they are oblivious to the DLL code. The Graftor trojan, if it is already in your system, will try to download the PNG and, if antivirus/network filtering does not stop it from a successful download, will use the DLL that came bundled with the PNG.

Malicious PNGs: What You See Is Not All You Get

Related Stories