4 ms·
I wonder why and how does security software read a PNG file. Sure it's not tough to parse a PNG file, but what does it look for exactly?
by hnthrowaway0328 2y ago
I wonder why and how does security software read a PNG file. Sure it's not tough to parse a PNG file, but what does it look for exactly?
- Sohcahtoa82 2y agoSome file formats allow data to be appended or even prepended to the expected file data and will just ignore the extra data. This has been used to create executables that happen to also be a valid image file. I don't know about PNG, but I'm fairly sure JPEG works this way. You can concatenate a JPEG file to the end of an executable, and any JPEG parser will understand it fine, as it looks for a magic string before beginning to parse the JPEG. A JPEG that has something prepended might raise an eyebrow. A JPEG that has something executable prepended should raise alarms.
- skydhash 2y agoWhy make something like that executable in the first place? I like the Unix model where things that should be executable are marked so. I know bad parsers and format decoders can lead to executable exploits, but I've always felt uncomfortable with the windows .exe model. Also VBA in excel, word... I believe a better solution would be to have a minimal executable surface than invasive software.