Malware Hidden Inside JPG EXIF Headers
blog.sucuri.net
Malware Hidden Inside JPG EXIF Headers
1–10 of 65 posts
Re: Malware Hidden Inside JPG EXIF Headers
#2Great discovery!
Re: Malware Hidden Inside JPG EXIF Headers
#3As malicious as this may be it is pure genius. It should include a message as such:
Elk Cloner: The program with a personality It will get on all your disks It will infiltrate your chips Yes, it's Cloner! It will stick to you like glue It will modify RAM too Send in the Cloner!
Re: Malware Hidden Inside JPG EXIF Headers
#4Wow, this would bypass the execution constraints we put on the upload directories. Usually I make an uploads folder rw-rw-rw (0666); it would take another attack in conjunction with it, but that's really something.
Re: Malware Hidden Inside JPG EXIF Headers
#5Seems like itt was possible to hide it so well due to an oversight in the API for preg_replace. In-band signaling in general makes it easy for people to accidentally add security holes. What they should have done is pass the regex options as a separate parameter, then it would have been obvious that something fishy was going on here.
Re: Malware Hidden Inside JPG EXIF Headers
#6From PHP documentation (http://php.net/manual/en/function.preg-replace.php)
5.5.0 The /e modifier is deprecated. Use preg_replace_callback() instead.Re: Malware Hidden Inside JPG EXIF Headers
#7Eval in replace funtion.. But why?!
Re: Malware Hidden Inside JPG EXIF Headers
#8From PHP documentation ( http://php.net/manual/en/function.preg-replace.php ) 5.5.0 The /e modifier is deprecated. Use preg_replace_callback() instead.
True, but most value hosting platforms run anything between 5.2.x and 5.4.x. with no option to upgrade.
Re: Malware Hidden Inside JPG EXIF Headers
#9Eval in replace funtion.. But why?!
Because PHP.
Re: Malware Hidden Inside JPG EXIF Headers
#10So the real hole is in `preg_replace` which can execute arbitrary strings on the server if the /e flag is found? Why does this exist?
Any how, this seems to be a genius exploit! If a site lets users upload photos and they use this function, a user could do this.
Basically a good frame work should have 'safe' functions that are designed to accept 'user input' i.e arbitrary strings and never set up a situation where these strings are executed