Re:When GIFs serve JavaScript
by zyx321 on Monday November 24, 2014 @03:52AM
(#8651532)
This is neither particularly new, nor particularly dangerous.
One possible attack vector would be abusing a filename/MIME mismatch to trick people into executing it locally.
If you have a website that allows image uploads and keeps the original filename, you could create an image that displays normally when displayed on the web, but executes arbitrary code when downloaded and executed locally.
This was inspired by the 2011 incident that lead to the use on CAPTCHA on 4chan. A spambot known as Cornelia would flood the boards with copies of itself that contained instructions how to execute it in the image data. Of course, that only worked because people would knowingly execute a virus just to spite the mods.
One possible attack vector would be abusing a filename/MIME mismatch to trick people into executing it locally.
If you have a website that allows image uploads and keeps the original filename, you could create an image that displays normally when displayed on the web, but executes arbitrary code when downloaded and executed locally.
This was inspired by the 2011 incident that lead to the use on CAPTCHA on 4chan. A spambot known as Cornelia would flood the boards with copies of itself that contained instructions how to execute it in the image data. Of course, that only worked because people would knowingly execute a virus just to spite the mods.