The hidden using steganography malicious code runs when you view the image in the browser.
Indian security researcher Saum Shah (Saumil Shah) published a report on the attack method developed by him, based on the popular among users sharing links to pictures. The expert was able to hide the harmful executable code in an arbitrary pixel images, thus leaving his exploit in the most prominent place.
Part 1:
Part 2:
The researchers note that hide malicious code directly in the image was the most difficult, and for this he had to use steganography. Parts of malicious code distributed in Shah pixel image that allows you to decode them back using Canvas element of HTML 5, a conductive dynamic rendering of images.
"For a successful attack I do not have to worry about hosting your own web-site. I do not even need any domain, - the expert emphasizes. - I can take a picture, post it in the public domain, and if the victim load it in your browser, it will compromise the system. "
Separately, an expert noted that the changes occurring in the final image of the presence of extraneous code, visible only at multiple zooming images. His attack technique called Shah Stegosploit, and its details he revealed in a recent held in Amsterdam conference on Information Security Hack In The Box. Video with the details of attack, and expert commentary published on YouTube.
