Re: Infected jpeg files?

[HackHawk <hugh () hackhawk net>]

This (finding an algorithm flaw) is the most interesting post I've seen 
about infecting JPEG images.

However, I've seen no mention of files on the Macintosh.  Isn't it true 
that on a Macintosh, you can give an executable file ANY extension you 
want?  And isn't it also true that you can associate ANY image you want 
with your executable file?

A MAC friend of mine once showed me how he got somebody to open a Mac 
Script file because the target thought it was a zipped archive of some 
sort.  The script setup a special access password on the targets system, 
then downloaded and opened the actual archive from somewhere else.

I spent a few hours attempting to create such a file using Code Warrior on 
the MAC a few months back, but due to lack of time gave up the effort.  I 
was able to name an executable with any extension I wanted (.JPG to be 
precise), but I was never able to associate the image I wanted with the 
executable file.

Any MAC people want to correct my belief if it is incorrect?

- hh

At 09:13 AM 11/9/01 -0800, J Edgar Hoover wrote:

> On Tue, 6 Nov 2001 jove () gaza halo nu wrote:
>
> >       If there was some sort of buffer overflow/other way of causing the
> > code to function in a manner inconsistant with it's design due to the
> > content/formatting of the .jpg image then yes, there could be a payload
> > designed to be set off upon viewing of the .jpg image.  Otherwise, the
> > .jpg image specifies (simplified) values of pixels in a compressed format
> > and thus the .jpg specification does not include the ability to run code
> > by default.
>
> The most likely route to an overflow is probably through one of the
> compression algorithms. Something similar to the massively compressed huge
> file that DoS'es antivirus scanners.
>
> Find a bug in any one of the "family of compression algorithms" supported
> by the standard that allows you to write 'image data' past the end of the
> allocated buffer.
>
> Cross-platform shellcode written to the most likely offsets for common
> architectures could effect a lot of boxes.
>
> I'll bet the specs aren't available online for a reason. ;]
>
> If anybody can fork me a copy, I'll work on a proof of concept.
>
>
> z