Is it possible to store arbitrary data such as documents or a program in the form of an image file, such as a PNG image? My concern is that someone could encode data for use by malware into an image and upload it to a site like Flickr.
For most file formats, yes. For example, PNG files are composed of typed chunks, so you could add a chunk named
However, there are ways to protect against this – for example, such websites as Imgur automatically process all uploads with
But in the end, data exchange cannot be prevented. Aside from the aforementioned image steganography, you have Twitter and its clones, dozens of pastebins (in which incomprehensible posts are considered fairly normal), comment forms of old blog posts (I'm still trying to remember the book this was suggested in), ... more realistically, most malware will simply contact their "own" servers.
There is no such thing as malicious data. Data doesn't become malicious until it's executed, at which point it's no longer data. The problem with this sort of thing would not be the image, it'd be the software (Windows, Photoshop, whatever) that contains a bug that causes the data to be executed. This is obviously an important concern of major software vendors, and you can be fairly sure they would fix these bugs very soon after they've been discovered.
That said, as is stated in the other answers, it is possible to add data that is not part of the image itself to the file. However, this is often useful or even standard practice. I think it's much more important to be careful with executables than with random images you find on the internet. The risk here is not that big.
Image files, including PNG, have a specific format. The header portion of the file describes the image, and any data following would be interpreted as image data (based on the headers).
However, you can append arbitrary data to the end of a PNG, past the image data, which can then be read later. This would be fairly easy to detect - there shouldn't be any data past the end of the image data.
Alternatively, you can encode arbitrary data into the image itself, using steganography. This subtly alters the image itself in a way that is largely indetectable unless you know exactly what to look for (prior knowledge of the encoding method is often required).
Another method that wasn't mentioned here (not surprising, because it isn't well known) would be to use NTFS's Alternate Data Streams feature. This feature was introduced into NTFS in Windows NT and allows the insertion of arbitrary data in the "resource fork" of a file's section of the disk. This good article on Bleeping Computer explains it better than I could:
The article goes on to state:
So Alternate Data Streams (or ADS) are comparable to "hidden files" attached to other files, and aren't shown by default in the system.
So how does this work and why does it apply to this situation? Lets look at some examples. Since this question specifically asks about
Here I have a plain, innocuous,
(note that all
Now lets say I wanted to send a secret message to a friend. I could do that by attaching a
Notice that you can't see the ADS file:
As far as you know, there is just a simple image here. But my friend knows better. He uses the
Reading it is as simple as calling notepad directly on the ADS file:
That is kind of scary you say, but text files aren't dangerous! That is where the bad news comes in. Remember when I said "arbitrary"? You guessed it. I can attach any old file I want as an ADS. Even executables. Here I add
Now by this time you are probably hiding under your bed, scared at the thought that any file you download off the internet could be secretly filled with hidden files, malware, and the like. But wait! This is where the good news comes in. It is almost impossible, in modern versions of Windows, to start an executable file hidden as an ADS. Older versions of Windows (such as XP and Vista) could launch files hidden this way by calling the
As of Windows 7 this method has been removed, and the only current way (that I can find) to run an executable hidden in an ADS is to create a symbolic link to the file, and then call the link. Like so:
You can now run the executable by calling
So to answer your question, can an attacker attach a virus to a
Yet another reason for you diehard XP fans to upgrade ;)
I realize this info is largely irrelevant these days, but, seeing this question and having nothing else particular to do, I decided I would add an answer, even if it isn't much of an attack vector any longer.