PNG Image Metadata Found Leveraging iFrame Injections

It's a clever idea, but not a malware attack - just a way to hide what the attack does and make it more difficult to detect. It still needs some javascript code to extract the malicious payload from the image.

I don&#x27;t see how the embedded JavaScript can be used without the accompanying malicious loader script.<p>As I see it, this is just another form of obfuscation. Not an entry vector.

Not really newsworthy, just obfuscation. If it was yet another libtiff CVE, then I&#x27;d be worried.

Article calls this steganography but...I&#x27;m not sure it really is, as the payload is hidden in the file format&#x27;s metadata...not _encoded_ into the pixel data.

Yet another reason to leave javascript off.

So it&#x27;s javascript code that won&#x27;t be caught by a virus-scanner... imho, once you need a virus-scanner for javascript, you&#x27;ve already failed. Serving <i>any</i> javascript from an un-trusted source is a failure. Sad that half of the web-based advertising industry is based on this principle.

This technique has been around since prior to 2008 at least, the biog entry below introduced the code[1], along with providing a tool to compress your js into an image using ruby [2].<p>The technique has a legitimate use as a suave compression method and was termed &quot;super packing&quot; in 2011 [3]<p>[1]<a href="http://blog.nihilogic.dk/2008/08/imageinfo-reading-image-metadata-with.html" rel="nofollow">http:&#x2F;&#x2F;blog.nihilogic.dk&#x2F;2008&#x2F;08&#x2F;imageinfo-reading-image-met...</a><p>[2]<a href="http://www.nihilogic.dk/labs/canvascompress/" rel="nofollow">http:&#x2F;&#x2F;www.nihilogic.dk&#x2F;labs&#x2F;canvascompress&#x2F;</a><p>[3]<a href="http://daeken.com/superpacking-js-demos" rel="nofollow">http:&#x2F;&#x2F;daeken.com&#x2F;superpacking-js-demos</a>

It seems like this is allowed by design, so am I missing something? Why hasn&#x27;t such a &quot;feature&quot; been turned off by all the newest browsers and rendering engines?<p>I know this method could have been made available for canvas image editing purposes but is there any legitimate reason for allowing javascript to be executed as well and not to strip it out automatically?

&gt;relatively new way to distribute malware<p>&gt;JavaScript code stored in an obfuscated PNG<p>they reinvent the wheel agian?