C Viruses

Hello,
I remember somewhere I've seen the trick when someone attaches something to the picture and it gives access to the machine where the pic was downloaded on, was this my dreams or it is possible in real world? At those times it was looking like fiction, should I care about such things or still need to be paranoid?

Thanks
 
Hello,
I remember somewhere I've seen the trick when someone attaches something to the picture and it gives access to the machine where the pic was downloaded on, was this my dreams or it is possible in real world? At those times it was looking like fiction, should I care about such things or still need to be paranoid?

Thanks
Taking advantage of an attack vector like that requires the ability to look at the library's source code and realizing that something about that code is not quite right. It could be something as simple as outdated dependencies, not checking for buffer overflows, or something going totally the other way, and doing something it's not supposed to do.

As an example of why the ability to look at a program's source code and think about it in certain ways is important: Stuxnet was discovered by use of a debugger. The design was compact, but you have to be comfortable with the Brainfuck programming language just to understand what the Stuxnet code even does, and why that makes it dangerous.
 
eternal_noob : Umm... the thread has C/C++ tag... So Javascript is going off on a tangent a bit. 😅 But it does a good job of demonstrating the point I'm trying to make - the ability to look at code in certain ways and see issues with the very design behind it - that's what it takes to make an informed decision, no matter the programming language in use. 😩 So, nice walk-through! :)
 
astyle But I wonder if the OP is thinking just that. There is a well-known issue with images being infected like that but I'm not sure if such a thing exists with C/C++
C/C++ are not memory-safe languages. Java was invented to address that. Memory safety problem was solved, but the way Java did it - other issues cropped up in the process.

Besides, if you think about it, it's not even the image itself that gets infected, but the libraries handling the file. If you mess up the pixel representation, OpenGL libs will complain, and you won't even have an image to look at, much less handle.
 
eternal_noob : Umm... the thread has C/C++ tag... So Javascript is going off on a tangent a bit. 😅
Weirdly not. Because C or C++ is pretty much behind every other language and library (i.e the Javascript interpreter, the image decoder, etc) most, if not all of these buffer overflow bugs still stem from these system languages. They are necessary and a pain in the butt at the same time!

Obviously we are all waiting for the Rust lot to prove their point and actually finalize an OS so that the platform's foundation no longer has a memory unsafe language at its core (yes, I don't expect this to be in my lifespan).
 
Not all exploits similar to this use memory corruptions as an attack vector though. I remember vaguely windows one, I think gnome's preview had something similar too ? I wouldn't put my money on it though ..

Similarly you can put lots of junk in pdfs too.
 
But there must already be exploited code in the user's system in order to execute the code in the image. So many of these exploits we hear about sound terrible but often they assume the user's system has been compromised already. Images containing code do not execute on their own by just opening them.
 
Depends on the attack - the code can be in the "image". If there's a bug in the image parsing library that causes it to fallover and run the exploit code in the bogus image.

So if someone can trick you into opening a malignant image and your image parsing libraries are out of date and vulnerable - they can run the exploit code on your machine. In theory.
 
The unfortunate part about all this is that it's difficult to educate the users. Admins sometimes have to resort to the exact same techniques as hackers to get users to update properly. 😩 Just how do you think BIOS firmwares get updated on motherboards? or the bootcodes on your phones? A lot of times, it comes down to educated trust vs. blind trust.
 
To the best of my recollection, MICE aka WMF exploit was a good example.

WMF is a SVG-like image format, which was being used in Windows in the past, to draw vector and also bitmap images. A bug was discovered in 2006, in the gdi32.dll file – GDI is Windows way of drawing objects on screen. Windows 2000 and other NT-based OS'es had been affected. By merely clicking-on and/or viewing a hacked-WMF image file, one could have hosed himself; via Windows/Internet explorer, Outlook, messengers, etc., for example.

P.S. At the time, RAW-socket Steve Gibson, the HDD-guy, had made a fool of himself, by accusing Microsoft of shoehorning backdoor into users' machines, which turned out to be false. It was just a bug.
 
P.S. At the time, RAW-socket Steve Gibson, the HDD-guy, had made a fool of himself, by accusing Microsoft of shoehorning backdoor into users' machines, which turned out to be false. It was just a bug.
Hey, this part is interesting... do you have a link to a good blog/article that walks people through the story?
 
Hey, this part is interesting... do you have a link to a good blog/article that walks people through the story?

[The Accusation]
* 2006.01.12 : SN #22 The Windows MetaFile Backdoor | Steve Gibson
Security now, episode no.22
Audio: https://media.grc.com/sn/sn-022.mp3
Transcript: https://www.grc.com/sn/SN-022.htm

[Backfires]
* 2006.01.13 : WMF Vulnerability is an Intentional Backdoor | SlashDot

* 2006.01.13 : Windows backdoor theory causes kerfuffle | Cnet

* 2006.01.16 : Tinfoil hats, Gather criticism (and Darth pix) | Computer World

* 2019.06.26 : Inside the WMF Backdoor | Microsoft
 
Back
Top