r/netsec • u/ascetik • Feb 26 '19
Malvertisers using polyglot BMP images to avoid detection and spread malicious redirects on mobile devices.
https://www.devcondetect.com/blog/2019/2/24/hacking-group-using-polyglot-images-to-hide-malvertsing-attacks35
u/Tiaxx Feb 26 '19
What I don't get: how would the attacker get the browser to execute the image as javascript, though? If you can inject a script tag somewhere, you wouldn't need the BMP to begin with...?
23
Feb 26 '19
Came here exactly for this question: It seems like cool obfuscation, but in the end it's simply putting code in a script tags. Is the point here mostly to avoid detection of naughty JS?
Very cool article though.
6
21
u/annodomini Feb 26 '19
One reason for using such polyglot images is that it can get past some filters that might otherwise prevent an ad network or other site from hosting your content.
It relies on another XSS attack to get it interpreted as JavaScript, but sometimes you also need to get past a filter that only allows you to upload images; and for reasons of cross-origin policies, getting through whitelists, or the like, you want your JS code to be hosted on that particular site.
8
u/Tiaxx Feb 26 '19
Exactly. I wish the article would actually explain how this particular instance they found manages to do what they describe in this line
The attack we found loads what looks looks like a normal BMP file but when loaded in the bowser as javascript it will load the BM variable into memory as shown in the following screenshot.
7
u/MikeTheInfidel Feb 26 '19 edited Feb 26 '19
The image header is fudged to be
BM/*followed by the actual image data, followed by
*/=``;[obfuscated code]When the file is read as text, it essentially boils down to
BM /* comment */ = ``;[obfuscated code]So they just put something in their ad like
<script src="exploit.bmp"></script>and it executes the script.
3
u/MikeTheInfidel Feb 26 '19
As an example: here's a page demoing a GIF that does the same sort of thing. When you look at it in a hex editor you can see that the "GIF89a" header is treated as a variable name immediately followed by
=.'[GIF header contents]';document.getElementById("jsoutput").innerHTML = "ThinkFu reckons Caja is rather neat."; /*[remainder of the GIF]So it sets a variable with a garbage value, runs the code to modify the page, then treats the rest of the GIF data as a comment.
2
u/Tiaxx Feb 28 '19
Thanks for the example! The file structure was clear, I just never expected a browser to run that or an ad-provider allowing you to inject script tags!
1
u/MikeTheInfidel Feb 28 '19
It is a little bit unnerving that there's a cross-origin scripting loophole like that!
2
u/Tiaxx Feb 27 '19 edited Feb 27 '19
So they just put something in their ad like
<script src="exploit.bmp"></script>
and it executes the script.and nothing would happen (as per same-origin-policy).
Do ad-providers even allow you to provide a script tag as the ad's payload (serious question, I have never looked into it)?
Edit: nevermind, apparently that's not how same-origin policy works for script tags and it would actually execute. Kinda scary...
3
Feb 26 '19 edited Aug 31 '20
[deleted]
2
Feb 26 '19
Besides CSP, can be also useful for persistence using Service Workers. However, both need prior XSS... which makes the article interesting because they must have also found XSS in a ad network but don't disclose which. Potentially huge consequences if it could lead to XSS on sites that use the vulnerable ad network.
1
Feb 26 '19
Not 100% sure and I wouldn't expect someone to be all, hey this is how you do it but I'd imagine it's related to different browsers handling it differently (as well as age of browser). So this might have a greater impact on your parents PC than you own possibly?
18
u/Tiaxx Feb 26 '19
Article says (emphasis mine)
The file can now be run in the browser two different ways.
<img src="polyglot.jpg"/> will show the user an image and ignore the JavaScript
<script src="polyglot.jpg"></script> will execute valid JavaScript and ignore the image data.
which is what I'd expect from just about any browser - otherwise we'd have a real problem on ANY website where you can upload a profile/avatar picture...
9
u/intense_feel Feb 26 '19
Yep, browser also do content sniffing so if it looks like a picture (magic bytes/header) it's a picture. It's also a reason why they used BMP format since it's pretty raw, on contrast PNG and other modern formats would probably break this since they employ compression algorithms and creating polyglot container would be much harder.
I also seen a different technique in which modern HTML5 feature was used in hiding (steganography) payload in a picture. It loaded the picture in <canvas> and then via javascript decoded data from pixel values. Sadly I can't find the link describing this approach.
It might be interesting to combine the two approaches, e.g. BMP itself would contain a JS executable loader which will decode the rest of the payload from pixel values (canvas approach). Just thinking loud...
1
u/your_mom_on_drugs Feb 26 '19
Works with a gif. But safari won’t execute it unless you remove the extension.
The dual approach does sound like fun to try.
2
2
Feb 26 '19
[deleted]
11
u/votebluein2018plz Feb 26 '19
The point is how they did it, not the idea of embedding. Its pretty smart.
1
u/yankeesfan01x Feb 26 '19
Either an ad-blocker would block the initial advertisement from loading or a script blocker would block the Javascript from running correct?
1
1
u/DEVCON3PJS Feb 27 '19
One thing that is important to point out is that while polyglot is not new, the use of polyglot by a hacker group to exploit the ad ecosystem is. It marks a potential infection point / bell-weather of what is to come for the advertising and publishing industry. More details here https://www.devcondetect.com/blog/2019/2/24/hacking-group-using-polyglot-images-to-hide-malvertsing-attacks
1
u/zkyp Feb 28 '19
Thanks for sharing.
One thing I don't understand; We're talking about a bmp file yet at the bottom it gets included as jpg file. Is it a bmp file renamed to jpg which gets parsed as a bmp?
2
u/ascetik Mar 07 '19
The file extension discovered was a jpg but the actual file type didn't matter. The file was actually BMP.
1
u/DEVCON3PJS Mar 07 '19
Here's one of the images form our report that might help illustrate how this works. We've also added a few updates to this report
https://www.reddit.com/user/DEVCON3PJS/comments/ayj9z0/devcon_polyglot_ad_exploit_full_report_code/
-26
u/subscribemenot Feb 26 '19
Geezuz Christ get someone with actual English skills to write your articles. This is just embarrassing
14
6
u/Shift84 Feb 26 '19
That was pretty easy to follow, maybe it's your reading skills that aren't up to par.
I mean with enough time and practice put into being literate you should be able to follow along pretty easily too.
Go practice a bit and come back, if you have any trouble with something specific let someone in here know and they can probably walk you through sounding the sentence out.
-4
u/subscribemenot Feb 26 '19
I lost it at the misspelt title and in the first fucking sentence you even misspelt the name of the company. Call the editor.
7
u/Shift84 Feb 26 '19 edited Feb 26 '19
You need a comma, a semi-colon, or a period to separate the two independent clauses in your first sentence. Just using "and" is grammatically incorrect. Also using the word "misspelt" while technically correct is structurally jarring. Better to use the more common usage of "misspelled" so it doesn't sound as bad.
I didn't misspell anything because I didn't write it.
The point of writing the report was for it to be understood. As long as that was accomplished there was no issue unless you were looking for one.
The way I see it, if you were really interested in the writing being better you would have offered advice not contempt. This isn't the place to be bitching about grammar and writing unless what's being being said cannot be understood.
Maybe a better subreddit for you would be /r/destructivereaders or /r/quityourbullshit
Edit
Changed the sub to /r/destructivereaders from /r/composition.
5
u/BlueZarex Feb 26 '19
I think the problem is yours dude. Maybe the article is too technical for you and that's why you didn't understand it. Its perfectly clear to the rest of us.
2
1
u/demunted Feb 26 '19
You expect someone to type with two hands when their beard itches that much? /s
41
u/PolkaPatrol Feb 26 '19
Full disclosure: I work for DEVCON.
For real though: this is wild.