-1

Why does viewing an image in a web browser or any other email can pose a security concern? Do some viruses pose as images?

Improve this question
0

3 Answers 3

Reset to default
2

Actually, it is one of the very common methods to spread viruses. And a quick Google will show many many forums and blogs discussing how it is being done. I am posting a few here,

https://stackoverflow.com/questions/9675941/how-can-a-virus-exist-in-an-image

http://www.symantec.com/security_response/writeup.jsp?docid=2002-030110-3845-99&tabid=2

But as long as you don't open the image, there is no way a virus code can get executed.

Improve this answer
3
  • 1
    How come websites do not have this issue, but only email?
    – agz
    May 3, 2013 at 7:01
  • 1
    I am no expert in this matter :) ... but I think when you view an image online you are actually downloading that image temporarily on your system and because of that you could get infected if you system is not well protected (like un-updated OS, no AV, use of IE :) etc)
    – JackLock
    May 3, 2013 at 12:56
  • obviously there is, if there's a bug in the image decoder. There are lots of CVEs and known attacks that requires only viewing the website in the browser or email client to spread the virus
    – phuclv
    Sep 20, 2022 at 1:39
0

I believe you are referring to the fact some email viewers block the downloading of images in HTML emails. This isnt so much a security concern, but a profanity filter. If the email client sees an email with images as from an unverified source, it will block the images from downloading as it might contain images that some find offensive (porn spam). This feature should be able to be disabled in every email client and allow all images to be downloaded with the mail.

Improve this answer
3
  • The usual reason to not download images immediately is to save time and bandwidth while opening mail.
    – chepner
    May 2, 2013 at 20:45
  • 2
    If I open an HTML file, and it opens an Image, it leaves a log somewhere. This means I leak info that the image was opened. If I give a globally unique filename, then I know when that particular email was opened. If I'm a spammer, this info leak is valuable. I can also set cookies.
    – Rich Homolka
    May 2, 2013 at 21:11
  • 1
    It also is for privacy - downloading the image generates a web-request which will be tracked by certain email marketing campaign generators. You therefore have told them that the email address is valid and that you opened the email.
    – James
    May 2, 2013 at 21:14
0

In its infinite wisdom, some versions of Windows show a file named e.g. xyz.jpg.exe as if it was an image (JPEG), you ask to open it, and it is run as it is an executable... game over.

The image formats are quite complex, and so are the programs/libraries that process them. There have been bad bugs in those. Add that the images gotten via email/WWW are (by definition) from untrusted sources, that a bug can very well lead to run code specified by the attacker and loaded into the image, and you are in the exactly same situation as above.

Improve this answer
1
  • 1
    How come websites do not have this issue, but only email?
    – agz
    May 3, 2013 at 7:01

Not the answer you're looking for? Browse other questions tagged .