JPEG virus

This is going to suck.
From Slashdot

*****edit****
Ooops...too much late night for me, what was I thinking, mods please move it to The Cafe...thanks!

That is going to suck. MS does have a patch for it, but it appears a lot of apps have their own problems.

It was only a matter of time before something like this came out.

I think this is pretty scary, consider the potential it has. All you have to do is to open a jpeg picture and you will get it. Also, seems like even after you apply the patch or the SP2, you are still not 100% safe from it...you can still get it from 3rd party applications. /ubbthreads/images/graemlins/icon15.gif

Actually, opening a jpeg that's infected isn't enough. You first have to open an executable that installs a couple of files and makes a change to the register. Then, if you open an infected jpeg image, a call is made to one of the files that's been installed and your troubles start.

The trouble is that too many people open attachments, so the needed execution files will likely get installed on a lot of computers.

Since it still depends on a buffer overrun, I'd advice getting the fix from Microsoft to patch the GDI buffer problem. The GDI doesn't check the buffer against overrun, as is, and that's what's being exploited.

I seem to recall that the vulnerability doesn't effect IE or Outlook/OE, so at least those mass-distributed malware vectors won't spread this problem like wildfire.

[ QUOTE ]
Empath said:
Actually, opening a jpeg that's infected isn't enough. You first have to open an executable that installs a couple of files and makes a change to the register. .

[/ QUOTE ]

Empath,

Are you sure about that? Where did you read that?

Jan

[ QUOTE ]
JanCPF said:
Empath,

Are you sure about that? Where did you read that?

[/ QUOTE ]

Symantec's page tells about it.

[ QUOTE ]
from Symantec

Technical Details

If a .jpg or .txt file that has been altered by W32.Perrun is opened on another, uninfected computer, it will not execute malicious actions on that computer because the virus requires the presence of the Extrk.exe or Textrk.exe file for it to execute and append its malicious content to other files.

Upon execution of the viral executable which is detected as W32.Perrun.dr, the virus does the following:

It drops the files:

* Reg.mp3. This is a registry file that the virus uses to modify the registry.
* Extrk.exe or Textrk.exe. This is the executable that will be configured in the registry to open all JPEG or TXT files.

[/ QUOTE ]

The situation with a jpeg is that a jpeg doesn't execute. It's only loaded into a buffer area and then interpreted by the GDI or some graphics rendering application. If you can force the process into an error situation, then recovery by your system will do what it's suppose to do. By loading a virus executable sytem beforehand, you can alter how the system recovers, and instead of doing what it would ordinarily do, it runs the virus file.

Actually, even with the Microsoft patch to insure checking the buffer for an overflow, you're not assurred of anything. As long as an error can be introduced, and a system has a preloaded virus executable, then it can do anything the writer designed it to do. The buffer overflow works out so well for virus writers because the instruction routine can be written into it.

ok for us with the brain of homer simpson . can we get this virus just veiwing a jpg ona website thats infected?

One of my bosses will get it because he makes Homer Simpson look like Albert Einstein. He opens everything. I can't run Zone Alarm on his machine because he clicks yes to accept every request that it pops up. And his buddies send him jpegs constantly. Especially those off color ones that will most definitely become infected.

Raggie, you can get infected jpegs, but they can't do anything without the executables to tell them what to do.

I don't know if the antivirus software can yet tell you if a jpeg is infected, although they can detect the executable.

The JPEG cannot be the source of infection itself - it can only transmit exploit code for an exploit loaded via some other means. A bit cumbersome.

Good. The fabled "JPEG virus" hasn't really appeared yet.

Of course, given the penchant for people to "subscribe" to websites, this does provide a means to automatically reprogram botnets...

Thanks Empath /ubbthreads/images/graemlins/thumbsup.gif