The OS doesn’t have to be hacked, there just has to be a common exploit available. If the default program that views your jpegs has some type of buffer overflow reading the jpeg, the overflow could allow code in the jpeg to execute. Although I've never heard of a buffer overflow in a jpeg viewer, never underestimate MS's ability to mass-produce “innovative” security flaws.
Any data file can potentially contain a virus. It just has to depend on a popular default executable (Notepad, IE, WMP?), with some type of weakness. I used to tell my virus paranoid friends that *.txt files were safe from viruses. Unfortunately, that isn't always the case.
Note: Unfortunately I deleted the virus after finding this out. For some stupid reason I didn't save a copy to send to someone who could do something with it. So, I guess I'm asking you to take my word for it. Also this was several months ago, I may not remember the file names correctly. At the time I was running WinMe.
I was unaware that My Documents on my PC was shared, and not long after I installed my cable modem several files were added to My Documents and it's subfolders. These files had extensions along the lines of *.eml (or was that emu, don't remember the icons looked mail related).
I figured they were viruses, and out of curiosity wanted to take a look at them before deleting. Since I didn't have a hex editor installed yet, I just appended .txt to the files and double clicked. Notepad started up, realized the file was to big for it and launched WordPad. WordPad crashed with some kind of error (can't remember text anymore).
A quick check of my temp folder showed a file named something along the lines of TMP1423563.tmp.EXE. I bought up task manager, and sure enough TMP1423563.tmp.EXE was running. I killed it, deleted every thing in the temp folder, and tried again to verify that the renamed file was the source of TMP1423563.tmp.EXE, it was.
Obviously this is not the way the virus was designed to work, but that doesn't change the fact that a *.txt file managed install and launch an executable on my PC.
I know this doesn’t affect all you *nix users, but then again most viruses don’t.
|
