Printable View
I found today!
read the rest hereQuote:
A new computer virus is the first ever to infect picture files, an anti-virus firm reported Thursday, making sharing family photos on the Internet a potentially dangerous activity.
Now ... am i the only one who is concerned about that news?
The potential for this is astronomical.
As of now though the extractor is simply a .exe file that arrives via email/disk/etc.
It does not self proprogate...for now, which is a good thing.
The trick is to pre-package the whole deal. Extractor/payload/delivery I give it till the end of the year before we see one in the wild.
*Goes to Sybari...blocks all incoming .jpg extensions on the network*
=P
I am confused...the security update says it uses a .exe, but that it could use just a .jpg. How could you 'run' a jpg? Some sort of IE6 problem?
You have the have the 'extractor' program already installed on your computer before infected .jpg will execute when you open them.
This extractor checks to see if the .jpg is infected...if yes then it will execute the payload within the .jpg
hmm, interesting and yes as you say dangerous...
i read about a similar thing before:
it is possible to causse a buffer overflow by opening a mp3 or wav file. normally players ignore any executable text, but if there is a specific situation (e.x. in winamp the browser is open) opening such file can causse your comp to break down....
------------------------------------------------------------------------------------------------------------------------"Knowledge is the Real Power"
This certianly concerns me, as it should anyone who is responsible for a large number of computers. This is why we have places like antionline, so professionals and wannabes like myself can discuss what we can do about it.
Humm, this really doesn't sound like anything new to me.
Exactly. Don't open executable attachments. Thats just plain stupid.Quote:
The virus arrives via e-mail or a floppy disk as an executable file. Security experts always warn against opening programs sent as e-mail attachments.
This is nothing more then a trojan horse that recieves it's instructions via an encoded piture (probably using stenonography) instead of via IRC. You still have to install an executable (the extractor) first.Quote:
Once run, the file drops an "extractor" component onto the victim's hard drive. When a computer user clicks on a picture file with the extension .JPG – a common picture file found on the Web – it is infected before it appears. Because the picture displays normally, Gullotto said, the victim may not know there's anything wrong.
BS. You still have to execute something. Therefor it can't be a jpeg.Quote:
In its current form, an infected JPG file sent to a friend or placed on a Web site isn't dangerous without the extractor file. But Gullotto said there's no reason a virus writer couldn't stuff the entire virus code into the JPG, making the picture file a virus itself.
McAfee probably created this proof of concept virus so they could sell more software.Quote:
McAfee researchers received the virus from its creator. Gullotto declined to identify the author, and McAfee anti-virus software can detect and remove Perrun.
Right now thiat's the case. BUT all you have to do is modify it so that yhe extractor code is in the picture too....thus when you click on the JPG file it executes and drops the payload without the need for the external EXEQuote:
Originally posted here by souleman
Humm, this really doesn't sound like anything new to me.
Exactly. Don't open executable attachments. Thats just plain stupid.
This is nothing more then a trojan horse that recieves it's instructions via an encoded piture (probably using stenonography) instead of via IRC. You still have to install an executable (the extractor) first.
BS. You still have to execute something. Therefor it can't be a jpeg.
McAfee probably created this proof of concept virus so they could sell more software.
Right, with modification this could make jpegs more than a simple data file, now it has the potential, with modification, to contain the executable within the code and virtually make jpegs exe files. The problem is not what it does today, but what it can potentially lead to tommarrow. I personally see this as a huge milestone and it could open the flood gates for new virii. It is like when you find an exploit, at first it is harmless because you don't plan to damage anything, but once the exploit is released and people know it is there; the gates are open for attacks.
I see great potential for this concept cause us lots of trouble in the future. But maybe I am wrong. I hope I am.
not good.........yeah, I hope you're wrong too, but it makes sense, so I think I'll set my email to never open .jpg or ANY type of pic attachments (I've got it set to ignore everything except for pics right now)........
thnx for the info!
You can NOT make a jpeg executable. Maybe on a unix system, by using chmod, but it still isn't executable. When you open a file (double click or whatnot) the OS determins what to do with that file, not the file itself. So when you double click a jpg, the os says, hey, its a jpg, show me the picture in MS Paint (or whatever program you use. Try it sometime. Take notepad.exe and rename it to notepad.jpg. What happens? You get an error saying that the jpg file is corrupted. It does NOT execute notepad. So the only way that this would be possible is if you installed a picture editor that was designed to run exactly what was in the jpg, not just show the jpg. As far as I know, there isn't any. The closest thing would be an animated gif, but that is still not executable.... Open an animated gif file in paint or photoshop, and it doesn't run. It just sits there.... You want animation, you have to open the file in a web browser or a program designed for viewing/editing animated gif files..
btw> meister, that is old news, and was posted on here a long time ago.
Quote:
Originally posted here by Reality
Right, with modification this could make jpegs more than a simple data file, now it has the potential, with modification, to contain the executable within the code and virtually make jpegs exe files.
No. No. No.Quote:
Originally posted here by Ratman2
Right now thiat's the case. BUT all you have to do is modify it so that yhe extractor code is in the picture too....thus when you click on the JPG file it executes and drops the payload without the need for the external EXE
I agree with Souleman, this article is either a hoax or a seriously mis-stated mis-understood subject. The only way I can think of that a picture file could execute arbitrary commands is to specially craft a file that would crash or cause a buffer overflow WITHIN the image viewing program, such as MSPaint or Photoshop, etc.
There is a big difference between a program and a data file, which you can't just ignore.
B.S. That's all I can say. It was possible to make a 'viral' mp3/playlist/streaming audio sequence once, but that was only because there was a bug in Winamp which caused it. The data itself is just inert. The article has a high FUD factor, which translates to: "Buy McAffee NOW or else something BAD will happen!."Quote:
In its current form, an infected JPG file cannot infect another computer on its own. But Gullotto said there's no reason a virus writer couldn't make the picture itself able to infect other computers.
Personally I scan my computer maybe once every month. Clean for a few years.
Lets hope you guys are right, and before reading this article I would have laughed too. But then I asked myself the popular question, "what if."
What if it is possible to embed code in a jpg? Ok so you have code in the jpg, big deal you can't do much with it. I mean it is not like photoshop will execute scripts... but IE will.
What if IE or other browers read the code within the jpg as it is loading and executes it like it is any other script. *ponders*
There are plenty more IFs and conditions that would have to be met for this to work, but what if it truely is possible. A little imagination the answer can easily be that is *could* be possible to execute code from within a jpg.
But lets hope you are right and that it is impossible, the next few months should tell us. BTW Norton, Mcafee, and housecall have the virus listed. Now does that make it real? No, but it brings a little more credability to the story.
I agree with Soulman, it has to do with file associations, the computer has to know what to open what with what program. Sounds more like to me a hidden file extension type thing like jpg.exe (Anna Knroncivia (sp), most people read to the first dot and computers look at the last dot, not to mention that the icon would appear different then again most people blindly click, and viri writters say see how stupid they are, like it takes real high thinking to know people are going to mindlessly click any file attachment, so who is really lame? Ah err go figure
This sounds a lot like the "multiplatform" virus that Symantec recently announced. What would be the purpose of announcing a "proof of concept" virus to the public?
Preacherman upon reading the full content of how this works and dah it is not a real new concept what a bunch of crap. First the person must get and run a program that does nothing more then change file associations, then click on the viri pic. This is lame I'm sorry this concept proves nothing cause to infect a pic you have to first run a program that reads the pic...wow. Lets all take a lesson in manually changing file associations. I cannot believe the hype on this crap. Then again maybe I have the wrong concept in programming here program looks for file associated with it, not file wants to run program...something is amiss here in this press release.
Ok here is the concept at least my twist on this "New Concept" viri and the resulting press release.
Sender
Step 1. Create a viri no pay load or for that matter use a tool kit, now how to make the viri infectable.
Step 2. Write a Word Doc, and just record a little mico for the word doc that changes file associations.
Step 3. Fill the body of the document with your concept then attach to an email send of to anti viri company explaining that the attached document explains and proves your concept.
Step 4. Send off email.
Recept: Anit-Viri Company
Step 1. They read the concept say ok this is valid, they are not running any virus scanning software because they are the experts and they can spot anything. So they reply to the sender ok the concept is valid but we did not get the other file to see how it all works and send a reply.
Sender: I'm sorry I forgot to include the file it is attached here, and it's sent off.
Anti Viri gets email opens the email and sure enough the concept worked but wait the anti-vrir defenders were just social engineered cause they got infected. Issue press release they fooled us you are next, press eats it up.
Result viri writter laughing his head off, Anti Viri makes a few mill more, your dumb and they are smart, cause it makes the mmoney but hey you can brag about it all to friends on-line you have never met.
As long as the antivirus guys stay on top of it I will be happy!
Viri are bound to get more technical as everything else does, AO will keep me prepared and ready.
:D
That's what I was referring to when I mentioned bugs or overflows within the viewer program. The thing is, most of the time any functions that process the images are so basic and speed-intensive that they are probably in assembly or somesuch for speed optimization, and are likely so well known that it is a bit of a stretch for a bug to be found this late in the game.Quote:
Originally posted here by Reality
What if IE or other browers read the code within the jpg as it is loading and executes it like it is any other script. *ponders*
Now, you know what would be really sneaky?
A combo of an extension-hidden program, that masquerades as a picture, and the program automatically finds the default program to open files of it's pretended type, and then generates a picture and opens it with that photoviewer when run. That way the user doesn't say: "Hmm... this picture isn't opening up..."
But it's still a program. I agree that the article seems to refer more to a trojan horse that can send messages to itself in images.
I'm with Terr and Souleman here, unless the virus writer was able to get an image viewer to execute the virus code for which you'd need either a very badly written image viewer or a program that patches the image viewer (for which you'd need an executable anyway). Quite frankly, i think this is just a load of bull. An image viewer that reads the executable code will probably have to written that way on purpose, thereby negating the assumption that the jpeg spreades the virus.
Cheers,
cgkanchi
andQuote:
W32.Perrun is a virus that infects JPEG files. The malicious content of files that it infects will not spread to other computers. Indications of infection are that .jpg files will have increased in size by approximately 11KB, and the presence of the file Extrk.exe.
Variants: W32.Perrun.dr
Type: Virus
Infection Length: 11,780 bytes
Systems Affected: Windows 3.x, Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Check it here http://securityresponse.symantec.com...32.perrun.htmlQuote:
If a .jpg file that has been infected by W32.Perrun is opened on another, uninfected computer, it will not execute malicious actions on that computer because the virus requires the presence of the Extrk.exe file for it to execute and infect other files.
Upon execution of the viral executable, detected as W32.Perrun.dr, the virus does the following:
It drops the files:
Reg.mp3. This is a registry file that the virus uses to modify the registry.
Extrk.exe. This is the executable that will be configured in the registry to open all JPEG files.
Extrk.exe is then configured to open all JPEG files by changing the (Default) value of the registry key
HKEY_LOCAL_MACHINE\Software\Classes\jpegfile\shell\open\command
to
extrk.exe %1
proof of concept?... yes.. jpg infection.. f*** no, you still need to extract the info from the JPG, so there for it is a two part virus. the extractor is the first part and the code in the jpg is the second.. the "infected" JPG on its own is useless.
So could the extractor be considered a bomb?
Cheers
I got that ! that's not my point!Quote:
proof of concept?... yes.. jpg infection.. f*** no, you still need to extract the info from the JPG, so there for it is a two part virus. the extractor is the first part and the code in the jpg is the second.. the "infected" JPG on its own is useless.
This is the scary part (from the article) :
Now what if the journalist didn't quote Gullotto wrong (head of the research departement at McAfee fot those who didn't see it)?Quote:
In its current form, an infected JPG file sent to a friend or placed on a Web site isn't dangerous without the extractor file. But Gullotto said there's no reason a virus writer couldn't stuff the entire virus code into the JPG, making the picture file a virus itself.
I find that hard to beleive too but what if :(
It uses camuflage technologie, in other word's....the .JPG is not dangerous, unless you have already been infected, which make's it useless.
My theorie:
The virus Set's a pipeline on the command line's, when a JPG if open's, It encode's the virii into it, using Camuflage Technologie....without this pipeline, and the Modulator, the virus is a good as dead.......and if Windows don't go doing something stupid like making a file exstention where script's can be imprinted upon, then we'r safe..... :P
------------------
That's my 2 cents
- Noio
Bleah, over 10 minutes formulating a reply and my connection crashes when I hit submit thread and loose everything. Anyway, this isn't nearly as nice as the last one, but I will try...
IE can run scripts, but to get the jpeg to do anything, there would have to be a script (activeX, javascript, VBscript, etc) to acually do anything to the file. Unless of course MS tries to patch something in IE, and causes the problem themself (which could happen).
Its a lot like the PDF virus a couple years back.. http://news.com.com/2100-1001-271267.html?legacy=cnet You had to have Acrobat (not Acrobat reader) to get infected. It exploited a "feature" in acrobat. There were rumors of this becomming wide spread, but never did.
Also, look at Vincent Gullotto. They don't want a virus tech as the VP/Director/Head/whatever of the AniVirus Emergency Responce Team. They want someone who knows how to manage people with Project Management skills. I would bet that most of his information is fed to him, and he really doesn't know much about what he is talking about. Nothing more then a PR guy. To prove my point.. http://www.osopinion.com/perl/story/14733.html
What the hell is move like worms are supposed to move???? Sounds like a marketing ploy to me... and "a little bit here, a little bit there"???? Neither one of those two worms moved a little bit. They both took over as much as they could as fast as they could. That is why they became very high profile. They cause a lot of infections quickly.Quote:
"Worms are designed to be out there as long as they can be,"
Network Associates' McAfee AVERT senior director
Vincent Gullotto told NewsFactor Network. "These [Magistr and Sircam] just kind of
move like worms are supposed to move -- a little bit here, a little bit there. The
ultimate success is how long they can stay out there."
Like I said, this reply isn't nearly as good as the one I wrote before. I hope the power company stops messing with my ISP....
New features in windows 2003 (to be released december 2005):
With new and exciting accessibility features, every file will have the ability to execute code for extra rich content for the end user. Naturally, this code will have full permission to edit files so as to give the user the easiest and most enjoyable computing experience.
You laugh now, but...
Noia: Erm... what are you trying to say?
Deadcrow: If the McAffee guy WASN'T misquoted, then I'd say he is lying. Not an intentional lie, however, but a misunderstanding or a lie of someone else's.
Wow, it's been a while since I've posted (months!!!)
Hello Everyone,
I noticed this thread, and I thought that maybe I could help by offering a programming perspective:
When I first read the Security Focus article on the virus, I was real curious and so I created my own JPEG Infector. I wrote a paper on the concept of JPEG infecting.
http://www.geocities.com/pharmicomlabs/jpg/
The paper has a sample program and source code for embedding messages and files into images without distorting them. (The process is really easy!!)
I'm sure you'll find it interesting! But to sum up a few things, and put a few minds at rest, here is what I concluded:
1. As someone has already mentioned, (As of right now) JPEG's CAN NOT act as executable files.
2. As someone else has already mentioned... This "new" form of file infection is just Steganography (An old technology)
3. The JPEG infector requires an extractor to run embedded code/files
I noticed there was a big dispute on this issue... the way it works is very simple:
An extractor program is installed/downloaded/whatever and registers itself as the default handler for images. (This is similiar to going to Folder Options > File Type in explorer.)
When an image is "opened" the extractor extracts the file/code, executes the file/code and then starts the real image program (paint, IE, photoshop, etc)
:D See how simple that works
In conclusion:
As someone was so gracious to mention... without the Extractor, the "infected" JPG is just an image with "junk" data added at the end.
Hope this helps put some minds at ease:
Simon Templer :)
Yes, LTNS! ("Wibbles.")
yeah..that's really scary...infact the internet is a scary place to be without knowledge of security and computers...i am going to set m e-mail to not accept images