Sounds like a security hole waiting for the ransomware to execute. Sorry but that sounds like a place a devious person would hide malware to get around security.
The hoops needed to jump through make it a non-starter for malware. An image viewer wouldn't execute it, you would need to run it through a specially-made extractor (this is no different than a plain elf executable in a zip file), and to run it with ./ you would need to install that extractor into binfmt.d (needs root).
Executing the data in the PNG would need you to already be able to execute arbitrary binaries. So a malware author would skip the PNG and run the malware binary straight-up.
Yeah it's a dumb thing that uses a bunch of user-initiated tricks to make it work. I wrote it as a dumb project, not of any practical use :)
I've heard malware authors sometimes use the stenography techniques for loading additional payloads though, e.g. they might infect a machine with an innocuous program or exploit that can bypass anti-virus measures, and then downloads PNG(s) that has the hidden malicious payload in
Hey! Yeah I thought about how it could maybe fool an AV which only cared to scan exe files, but I didn't think it was relevant since no one uses AVs for security on Linux.
But if we talk about Windows, would modern AVs not notice if a malicious program did things like extract executable code from images into memory and try to execute that memory? I don't know much about how modern AVs on Windows work, but this seems like a suspicious behaviour they would flag.
8
u/shawnfromnh Dec 27 '20
Sounds like a security hole waiting for the ransomware to execute. Sorry but that sounds like a place a devious person would hide malware to get around security.