Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've just digitized a couple of LPs and needed some cover art. My scanner isn't big enough to scan the album so I searched for and downloaded the images off the net.

When I did so Avast reported that one of them contained the "Win32:Hupigon-ONX" trojan and immediately quarantined it. Not wishing to take any chances I downloaded a different copy which reported as clean.

Now was this just a false positive from Avast or could there really have been a trojan in the jpg?

If there was how would it get executed?

I must admit that this aspect of trojans and viruses has always baffled me. As a software developer I've always checked length of arrays etc. so I don't see why things like buffer overruns should occur. I understand that people do cut corners and make mistakes and if the software is complex enough these errors can slip through.

share|improve this question

4 Answers 4

up vote 10 down vote accepted

Exploits in image files take advantage of buffer overrun flaws in the image processing code of the OS. There were several significant such flaws found in Windows' GDI layer a couple of years ago - patches were released long ago but exploit images are still out there either just because they stayed or in the hope that they hit a machine that has not yet been patched.

The usual cause of such a security whole is passing image data between functions on the call stack and not properly checking maximum length of the data. This can be exploited by cleverly constructed data that is over-sized and arrange in such a way that it ends up overwriting code next in the stack frame (overwriting it with other code) or overwriting pointers to code that will be used to call other functions or as the called function returns to is caller (overwriting such a pointer to make it point to the exploit code), or overwriting data in such a way that causes another hole to be exposed. The exact method varies depending on the security hole in question.

Modern CPUs have a protection that stops most of these exploits if the code supports it. This works by the program/library explicitly marking which of its pages are data and which are code - the CPU will then raise an exception if anything in what should be data (such as image data) tries to be executed as code. IIRC Vista and above and recent versions of .Net have had all their libraries rejigged to support this protection, and it is supported by other OSs too, but this does not stop all such exploits and only works if explicitly turned on (otherwise a lot of old code would break).

share|improve this answer
    
Not spell-checking, but I like the "security whole" part - it's just so appropriate in the context :) –  Zabba Aug 21 '10 at 7:56

I must admit that this aspect of trojans and viruses has always baffled me. As a software developer I've always checked length of arrays etc. so I don't see why things like buffer overruns should occur.

Well, welcome to the real world ;-). Buffer overflows &c. can happen in many languages (especially in those with manual memory management like C), and as developers make mistakes, they do happen.

While normally a buffer overflow will just crash the program (segmentation violation or similar), it may allow an attacker to execute code -> trojan activated.

For example:

http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx

http://secunia.com/advisories/35216/

And for an explanation how this allows code execution:

http://stackoverflow.com/questions/460519/how-are-buffer-overflows-used-to-exploit-computers

share|improve this answer
    
I know they happen - it's just it's one of the basic checks I've always done when processing data - check I've got/allocated enough space for the data. –  ChrisF Jul 7 '10 at 10:01
    
@ChrisF, the fact that you need to ensure that you check (as opposed to the "computer" is the problem itself. –  Zabba Aug 21 '10 at 7:58

There was an exploit that did a buffer overrun on broken JPEG library that could run arbitrary code in 2006. Microsoft released a patch to fix it faster than I'd ever seen them. Your machine almost certainly isn't vulnerable and Hupigon just now generates too many false positives.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Win32/Hupigon

share|improve this answer

I must admit that this aspect of trojans and viruses has always baffled me. As a software developer I've always checked length of arrays etc. so I don't see why things like buffer overruns should occur. I understand that people do cut corners and make mistakes and if the software is complex enough these errors can slip through.

Maybe you are checking all of you pointers, arrays, etc. But are you sure, that all programmers of any 3rd-patry library you (might) use (someday) did so, too?

The simplest solution for this would be downloading a file like "image.jpg.exe" or something similiar instead of a real image.

The more advanced ways to infect your PC have already been described here (eg. Buffer Overflow,...)

share|improve this answer
1  
True - but I change the folder options to show extensions. I'm sure that hiding known extensions has caused more problems that it solves. In fact I can't think of a problem it actually solves. –  ChrisF Jul 7 '10 at 12:41
    
full ack - it's one of the first options I activate, when working with windows –  Elvith Jul 7 '10 at 13:15
    
@ChrisF: Well, obviously the problem it solves is that otherwise users can accidentally change a file's extension when they rename it. This causes the familiar problem "The icon of my document looks funny, and I can no longer open it. Help!" :-) (and yes, I sometimes do tech support for my family). –  sleske Jul 19 '10 at 10:31
    
@sleske - Windows 7 doesn't select the extension when you rename a file. –  ChrisF Jul 19 '10 at 10:55
1  
@ChrisF: Interesting, didn't know that. It used to be different, though - at least Windows Server 2003 selects the whole name for a rename. And at any rate, if users can edit the extension, they will :-). –  sleske Jul 19 '10 at 11:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.