A new attack recently was published with multiple new agencies saying that by using Stegosploit just an act of viewing an image in a browser can hack your system. When I first read this it seems scary because any site which hosted user generated images would be vulnerable to XSS attacks. (Hint: It isn’t)
A little background on the subject. What the author of the exploit Saumil Shah suggests on Vice.com Some definitions so that we are all on the same page. Now lets break down what the author is trying to say here. Points 1 and 3 are perfectly good and safe. But I almost leaned forward from my chair when I heard read point 2. Something was not right. I dug a little deeper and found the author’s main paper where he describes the attack in a little more detail. Generally all images are inserted in an <img> tag in a HTML page. A JavaScript is inserted as a <script>. On further examination the author is actually injecting his modified image in a script tag like <script src=”cat.png”> Boom! this is where it all goes south! If you already have access to the <script> tag then you can inject even a .js file or any other JavaScript. What this exploit does is obfuscation via steganography and nothing more. All the articles you have read stating otherwise is sensationalism and blowing nothing but hot air. Rest assured you can continue to view and search for pictures of cute cats.
Have something to add?