Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)
Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)
I'm not sure if this is exactly what you're referring to, but apparently years ago there were exploits bundling JAR files into GIFs to sneakily have them executed by the Java browser plugin: https://en.wikipedia.org/wiki/Polyglot_(computing)#GIFAR_att...
Back in the day I wrote a PoC exploit for my employers app that abused an image upload api by embedding a jar file inside an svg as XXE which then got me RCE. Fun times.
if anything i would use EXIF data to enhance stego.
generally its the JPEG standard that allows the payload, manipulation by abusing EXIF is how you operate the exploit.
there is a 64k file segment specified for JPEG, and you can abuse it to hold any "data" you want, as well as extending to other segments, for more storage.
the raw steganography in most primative form is a comparison of two photos, one of which is pixelshifted to encode the data.
in advanced form, the pixels hold the encrypted data, but the application segments of the JPEG hold keys and or matrix values, and you need a reference image. you can move fairly large volumes of ASCII representation like this before its noticed
you basicly write a webpage that local caches the payload and keys, then abuses EXIF to build and execute an exploit on the target.
this is a variation on a common theme in steganography, but still interesting and giving something a name can be a useful contribution in itself