Bagle Does What?

Here is the article. Is it possible to detect words in image files? Are AV companies just blowing smoke and actually attempting to get the password? Why not just use normal pattern detection after partial/complete decryption?

-Cheers-

Sure it's possible to detect words in images. That's what OCR is all about. I'm not sure I'd like my AV taking the time to do that scan, but life goes on.

Steganography - The practice of hiding one piece of information inside of another.


Reverse steganography or using the right decryption will show the words hidden inside an image. That might include passwords.

OCR is not very good, yet, about detecting words in images where there are varying contrasts close to the target. Not very good at all.

Quote:

---

Bagle Does What?

---

what is - Taste good with Cream Cheese and coffee.

RoadClosed, you obviously haven't recieved one of those emails have you? The text is generally a primary color, with a white background, sharp edges. Ideal for OCR. As far as not being very good, about 4 years ago, I got a scanner and some trial software from a leading OCR company, and it could easily read book text and printed text. That's all it would be required to do here. Think how far they've probably come since then.

Cyber1d, no, they're not talking about steganography. It's cool, but there talking about a literal picture of a password. See the attached, it's not the virus, just the pic that's in one of their emails, it's just a green pic of '02350'

UpperCell: I use OCR too for some tasks. It is very good at basic stuff... like books and such.

Try to fead it forms and it'll crap all over the screen. The formatting gets all messed up and its faster to recreate the form than to try to fix a form scanned in.

At least... the software I was using... I believe it is omniscan pro version 12?
They are a couple of versions higher now... maybe I'll try the upgrade.

Though, most of what I fed it, it scanned quite well.
I only had to go back over and correct about 5 or so words that wern't in the dictionary.

the reason they want the pwd is to be able to open the file to scan it to make it easier to detect. the virus writers are using multiple compression methods and file morphing to try and hide their virus

Here is what I'm pulling from it...

It looks like a normal email, but one of the words in the email isn't actually text, its a .gif with a picture of what looks like normal text. So, you can read through it without noticing there is a picture there. When you search text with whatever programming language, you look at the actual characters. By having a picture of characters instead of actual characters, it puts a step between AV signatures and the virus.

Most web hosts, email sites require you to type in a word as shown on a .gif image to prevent bots from opening numerous accounts. Usually the word has lines going though is a bunch or different colors to prevent those same bots from reading what word is on the .gif. Sort of like image recognition. Maybe AV will pick up this to prevent image text like that, and will be able to distinguish between legit images and fake text.

Basic text on a single color background is easy to read, but draw a line through it or add additional data into the background and it will crap out, like contrasting greens or lines through the text. I am one of those who uses graphics to hide email adresses from automated bots or spiders. Until now, it would take a human eye to harvest the e-mail address and start spamming. Less likelely considering the are billions of web sites. So this virus writer takes that idea and uses it to disquise data that could otherwise be easily picked up by text scanners and tries to turn the book on them. But sophos picked up on it and wrote some code to pull it out of a graphic file. I wonder if it's traditional OCR technology or something along the lines of looking at the code in terms of binary not optical. To use traditional OCR definition in this case is wrong because the software isn't looking at it from a optical standpoint. It's not OCR they are using, is my point?

I think I get your point. I agree with you RoadClosed, about OCR being easy to fool.

What do you mean about binary instead of optical? to my knowledge computers interpret 'optical' as a string of bits with a specified width forming it into a rectangle. Much like text files are just strings of bytes with predetermined end lines and EOF's every once and a while. What's the difference between optical and binary in your analysis? The process of 'optically seeing' the password and 'digitally analysing for words' is the same to a computer. Unless I'm mistaken.

Regardless, it's a cool, if not new trick. And the irony is undeniable.

:p

Jon

I agree it is cool, by optical I mean a camera or scanning device using the spectrum of light that we and machines can see.

When a computer get's hold of this 'optical picture' it's still just a string of bits. Even with edge detection, there's still a string of bits that it has to process first.

Get my point, there is no magical 'optical' or 'data', to a computer it's the same thing. A string of bits. The computer always has to start with that unles there's a human involved. Do you know another method? I would be very interested in it.

Oh I know, and to be frank I don't know sh*t about OCR expecpt how it translates an image into a grid and asigns values based on where the image intersects each predifned border. I was thinking though that to use OCR technology in the sense that I see it, they would have to first render the object in visual form that I could recognize (that doesn't mean it has to be displayed to the screen) just rendered in memory, and then the OCR program could run on that. I was thinking that wouldn't be as cool. If they already know something about the file then they could just look for values of say the RGB value equal to green, and not even have to figure out what is actually contained in the file just the "signature". Not sure they even could gather recognizable info, just some copied or predefined pattern of values stored, otherwise all those spam bots would be able to break the picture authenitication part of Ticketmaster and all the sites that use it to verify human vs non-human components. That would suck even though it's cool. Like I said, I am just not sure they can, and if they are I don't see OCR being the source. In fact Optical Charecter Recognition isn't even mentioned.

ahh, I gotcha. thanks.

So to detect if it's picture or text you Ctrl+A. If it's a big box.. picture, else text. That is quite interesting. I wonder if Lycos supports images in body.. Or you could turn html off?

-Cheers-