3 ms·
Indeed. The clever part though is that since the code is never loaded as text, the normal ways of detecting and combating it will have a hard time. Such an imag
by Drakim 13y ago
Indeed. The clever part though is that since the code is never loaded as text, the normal ways of detecting and combating it will have a hard time. Such an image can be hosted on imgur or imageshack, and anti-virus/anti-malware mechanisms in the browser would never look over it like they would if it were a .js file.
- nwh 13y agoIt's not unknown though, there's been PHP malware that executes an images exif data previously. $exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg'); preg_replace($exif['Make'],$exif['Model'],''); This particular one operates in a similar way but with significantly more stealth, even if you were looking right at it you wouldn't immediately suspect that it's a backdoor executing code. Looks a bit odd, but if it was shoved in a thumbnailing function or something similar you might never notice, doubly so if the code it's executing is a client supplied image. http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exi...