Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to store arbitrary data such as documents or a program in the form of an image file, such as a PNG image? My concern is that someone could encode data for use by malware into an image and upload it to a site like Flickr.

share|improve this question
3  
Check out the MICE exploit that gave Microsoft a black-eye a couple of years ago. –  Synetech Jul 6 '12 at 2:01
1  
Yes, that was among the links in the MICE page. If you’re arbitrarily adding links from that page, then you may as well add this, this, this, this, this, this, and most of all this. –  Synetech Jul 6 '12 at 3:15
    
@Synetech: Sorry; the link in the (now deleted) comment was from a Google search, not from the Wikipedia article. –  DragonLord Jul 6 '12 at 3:17
    
Oh okay; no worries. The Wikipedia article has some great tech specs (I linked most of the best ones from Microsoft, Sysinternals, and GRC). That thing really caused more hype than actual damage from what I recall. The last link in my comment was the third-party patch that someone took it upon themselves to make until Microsoft released and official Windows Update to patch it. :-P –  Synetech Jul 6 '12 at 3:21

4 Answers 4

up vote 18 down vote accepted

For most file formats, yes. For example, PNG files are composed of typed chunks, so you could add a chunk named aAAA or lOLZ with arbitrary data. JPEG has "application-specific" segments APPn; the Exif tags in JPEGs are actually a complete TIFF structure inside such a tag. Other formats such as GIF are not extensible, but they often do have a field for textual comments; this has already been abused.

However, there are ways to protect against this – for example, such websites as Imgur automatically process all uploads with pngcrush or similar tools, which drop anything that's not absolutely required.

But in the end, data exchange cannot be prevented. Aside from the aforementioned image steganography, you have Twitter and its clones, dozens of pastebins (in which incomprehensible posts are considered fairly normal), comment forms of old blog posts (I'm still trying to remember the book this was suggested in), ... more realistically, most malware will simply contact their "own" servers.

share|improve this answer

There is no such thing as malicious data. Data doesn't become malicious until it's executed, at which point it's no longer data. The problem with this sort of thing would not be the image, it'd be the software (Windows, Photoshop, whatever) that contains a bug that causes the data to be executed. This is obviously an important concern of major software vendors, and you can be fairly sure they would fix these bugs very soon after they've been discovered.

That said, as is stated in the other answers, it is possible to add data that is not part of the image itself to the file. However, this is often useful or even standard practice. I think it's much more important to be careful with executables than with random images you find on the internet. The risk here is not that big.

share|improve this answer

Image files, including PNG, have a specific format. The header portion of the file describes the image, and any data following would be interpreted as image data (based on the headers).

However, you can append arbitrary data to the end of a PNG, past the image data, which can then be read later. This would be fairly easy to detect - there shouldn't be any data past the end of the image data.

Alternatively, you can encode arbitrary data into the image itself, using steganography. This subtly alters the image itself in a way that is largely indetectable unless you know exactly what to look for (prior knowledge of the encoding method is often required).

share|improve this answer
    
I know that Adobe Fireworks actually stores extra data in png files (that's not part of the image). –  Jouke van der Maas Nov 16 '11 at 0:14

Another method that wasn't mentioned here (not surprising, because it isn't well known) would be to use NTFS's Alternate Data Streams feature. This feature was introduced into NTFS in Windows NT and allows the insertion of arbitrary data in the "resource fork" of a file's section of the disk. This good article on Bleeping Computer explains it better than I could:

ADS were introduced into the Windows NTFS file system starting in Windows NT 3.1. This ?feature? was implemented in order to allow compatibility with the Macintosh Hierarchical File System (HFS). In brief, the Macintosh file system stores its data in two parts, the resource fork and the data fork. The data fork is where the data is actually contained and the resource fork is used to tell the operating system how to use the data portion. Windows does a similar thing through extensions such as .bat, .exe, .txt, .html. These extensions tell the operating system how to use the particular data found in the files.

The article goes on to state:

In summary, think of ADS as hidden files that are attached to the visible ones. The main reason they are so dangerous is that they are not well known, are generally hidden to the user, and that there are few security programs that can recognize them.

So Alternate Data Streams (or ADS) are comparable to "hidden files" attached to other files, and aren't shown by default in the system.

So how does this work and why does it apply to this situation? Lets look at some examples. Since this question specifically asks about .png files I will use one in my examples.

Here I have a plain, innocuous, .png file I generated from a screenshot utility.

C:\testing>dir

 Directory of C:\testing

12/17/2013  08:27 PM           254,603 image.png
               1 File(s)        254,603 bytes  

(note that all dir output has been shortened for brevity)

Now lets say I wanted to send a secret message to a friend. I could do that by attaching a .txt file to my .png file as an ADS; like so:

C:\testing>echo "Top Secret" > image.png:message.txt  

Notice that you can't see the ADS file:

C:\testing>dir

07/24/2014  08:58 PM           254,603 image.png
               1 File(s)        254,603 bytes  

As far as you know, there is just a simple image here. But my friend knows better. He uses the /R flag on his dir commands (or uses an external program like LADS). He can see my hidden file just fine:

C:\testing>dir /R

07/24/2014  08:58 PM           254,603 image.png
                                    15 image.png:message.txt:$DATA
               1 File(s)        254,603 bytes  

Reading it is as simple as calling notepad directly on the ADS file:

C:\testing> notepad image.png:message.txt  

enter image description here

That is kind of scary you say, but text files aren't dangerous! That is where the bad news comes in. Remember when I said "arbitrary"? You guessed it. I can attach any old file I want as an ADS. Even executables. Here I add putty.exe to my text file as an ADS:

C:\testing>type putty.exe > image.png:putty.exe  

Now by this time you are probably hiding under your bed, scared at the thought that any file you download off the internet could be secretly filled with hidden files, malware, and the like. But wait! This is where the good news comes in. It is almost impossible, in modern versions of Windows, to start an executable file hidden as an ADS. Older versions of Windows (such as XP and Vista) could launch files hidden this way by calling the start command with the file's direct path.

As of Windows 7 this method has been removed, and the only current way (that I can find) to run an executable hidden in an ADS is to create a symbolic link to the file, and then call the link. Like so:

C:\testing>mklink putty.exe image.png:putty.exe
symbolic link created for putty.exe <<===>> image.png:putty.exe  

You can now run the executable by calling putty.exe.

So to answer your question, can an attacker attach a virus to a .png file and upload it to a sharing/social media site? Yes, they could. Could said attacker use this to compromise your system? Yes, they could. Is it easy? No, and it will just get harder as the feature continues to get hardened and improved.

Yet another reason for you diehard XP fans to upgrade ;)

I realize this info is largely irrelevant these days, but, seeing this question and having nothing else particular to do, I decided I would add an answer, even if it isn't much of an attack vector any longer.

share|improve this answer
    
Alternate Data Streams do not form part of the image proper, so you're not storing extra data in the image. This is simply an exploitation of file system features. –  DragonLord Jul 25 at 13:32
    
@DragonLord That's true to an extent, the data will move with the image if you upload it to a site or move it to another computer, providing they don't strip it. If you don't consider this enough of an answer so be it. –  Seth Jul 25 at 13:36
    
@Seth: Data will move with the image on upload? I disbelieve. Maybe copying from one NTFS Disk to another NTFS Disk, but I suspect they'll be dropped if uploaded over any standard protocol. This was a problem on old macs with their "resource fork". –  Sean McMillan Jul 25 at 14:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.