3 ms·
If a JPEG can store data, can that data (code) also be run upon opening the JPEG? This could be really disturbing.
by behnamoh 4y ago
If a JPEG can store data, can that data (code) also be run upon opening the JPEG? This could be really disturbing.
- awestroke 4y agoOnly if there is a flaw in the jpeg decoder
- af3d 4y agoGenerally speaking, no. While theoretically a JPEG could be used to STORE a virus, the chances of that code actually running on your computer is almost nil. (Provided you don't do silly things such as clicking on a file named "img.jpeg.exe" or what have you.) Of course from time to time in the past there have been bugs. Some of the early Windows versions for example. AFAIK most (if not all) JPEG decoders in common use today have already ironed out those issues.
- bawolff 4y agoJPEG as a format allows you to add extra data to the end. ZIP as a format allows you to add extra data to the beginning. So its probably easy to make a JAR-JPEG polygot. Generally though, even if you make an executable JPEG, the thing stopping this is that normally you look at the extension to decide how to interpret a file, so when you see a .jpg ending, you don't try and execute.
- billpg 4y agoYou could store the bytes of an EXE inside an image, just like how I could paste the base-64 of an EXE on the end of this message. The trick is going from that to actually running it. TVoKSGVsbG8gdGhlcmUuClRoYW5rIHlvdSBmb3IgcmVhZGluZyBteSBlbmNvZGVkIG1lc3NhZ2Uu ClRoZSBiZXN0IHdvcmQgaW4gdGhlIEVuZ2xpc2ggbGFuZ2FnZSBpcyBSdXRhYmFnYS4KQ2hhbmdl IG15IG1pbmQ=
- jdthedisciple 4y agoyea I'm not going to run that trojan you just posted here
- billpg 4y agoOh go on.