3 ms·

I don't see how the embedded JavaScript can be used without the accompanying malicious loader script. As I see it, this is just another form of obfuscation. No

• Drakim 13y ago
  Indeed. The clever part though is that since the code is never loaded as text, the normal ways of detecting and combating it will have a hard time. Such an image can be hosted on imgur or imageshack, and anti-virus/anti-malware mechanisms in the browser would never look over it like they would if it were a .js file.
  • nwh 13y ago
    It's not unknown though, there's been PHP malware that executes an images exif data previously. $exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg'); preg_replace($exif['Make'],$exif['Model'],''); This particular one operates in a similar way but with significantly more stealth, even if you were looking right at it you wouldn't immediately suspect that it's a backdoor executing code. Looks a bit odd, but if it was shoved in a thumbnailing function or something similar you might never notice, doubly so if the code it's executing is a client supplied image. http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exi...