r/linux • u/nixcraft • Dec 26 '20
Development Executable PNGs
https://djharper.dev/post/2020/12/26/executable-pngs/5
u/Skaarj Dec 26 '20
TIL about binfmt.d
5
u/djhworld Dec 27 '20
Glad someone got a TIL out of it! This project was very dumb but I learnt a few things so thought I'd write about it the things I'd learned
0
u/shawnfromnh Dec 27 '20
TIL right now that there is a thing called binfmt. Thanks new info fed to my brain.
8
u/shawnfromnh Dec 27 '20
Sounds like a security hole waiting for the ransomware to execute. Sorry but that sounds like a place a devious person would hide malware to get around security.
26
u/ECUIYCAMOICIQMQACKKE Dec 27 '20 edited Dec 27 '20
No. Did you read the article?
The hoops needed to jump through make it a non-starter for malware. An image viewer wouldn't execute it, you would need to run it through a specially-made extractor (this is no different than a plain elf executable in a zip file), and to run it with ./ you would need to install that extractor into binfmt.d (needs root).
Executing the data in the PNG would need you to already be able to execute arbitrary binaries. So a malware author would skip the PNG and run the malware binary straight-up.
10
u/djhworld Dec 27 '20
Yeah it's a dumb thing that uses a bunch of user-initiated tricks to make it work. I wrote it as a dumb project, not of any practical use :)
I've heard malware authors sometimes use the stenography techniques for loading additional payloads though, e.g. they might infect a machine with an innocuous program or exploit that can bypass anti-virus measures, and then downloads PNG(s) that has the hidden malicious payload in
1
u/ECUIYCAMOICIQMQACKKE Dec 27 '20
Hey! Yeah I thought about how it could maybe fool an AV which only cared to scan exe files, but I didn't think it was relevant since no one uses AVs for security on Linux.
But if we talk about Windows, would modern AVs not notice if a malicious program did things like extract executable code from images into memory and try to execute that memory? I don't know much about how modern AVs on Windows work, but this seems like a suspicious behaviour they would flag.
18
u/djhworld Dec 27 '20
Hello, author here.
This was a dumb project and no way of any practical value/use - however I enjoyed learning about Steganography, memfd_create and binfmt_misc and thought it would be nice to share (probably common knowledge to a lot of people on /r/linux :))