The Anti-virus Times

Tuesday, April 16, 2019

Many people are already aware of the fact that malicious code can be concealed in an image. However, in such cases, the image simply serves as safe storage, and another application is needed to extract the code. Or rather, that's how things worked until recently.

Here you can learn in detail how an attacker can trick a computer into interpreting file data in two ways.

Let's open a BMP file.

The first two bytes (the red square) are the hexadecimal representation of the characters BM for a BMP image. The next 4 bytes (8A C0 A8 00) are the size of the image file. This is followed by 4 null bytes (00 00 00 00) and the data offsets (8A 00 00 00). This gives the computer most of the information it needs to know how to execute this file correctly.

Now here is a header for a Polyglot BMP image file:

They look about the same. It still starts with BM. The size and data offsets are all still there. The clever trick here is that an attacker can control the size of the image, and the hexadecimal characters can be manipulated so that they are interpreted by the computer as something else. The attacker here has changed the size of the image bytes so that they happen to also be the character codes for /**. This combination of characters creates a JavaScript comment. JavaScript comments are used to make the JavaScript Interpreter ignore everything in between these characters. i.e., /* ignore me */.

Let's look at the part of the exploit that comes at the end of the file.

As expected, the JavaScript comment is terminated with */. The attacker then adds the characters = and `. What the attacker has done here is turned the file type BM into a JavaScript variable and set it to another heavily obfuscated payload.

The file can now be run in the browser two different ways:

• <img src = "polyglot.jpg" /> will show the user an image and ignore the JavaScript;
• <script src = "polyglot.jpg"> </ script> will execute valid JavaScript and ignore the image data.

Try locating script code in the file below!

#cryptography #JavaScript #exploit