Security Market Segment LS
Friday, 25 November 2016 08:44

Cute doggy – 'I won't bite' Featured

By

As if malware-ridden apps and drive-by infections from websites are not enough, now you can get malware from clicking on an image on social media sites.

Check Point Technologies security researchers have identified a new attack vector, named ImageGate, which embeds malware in image and graphic files.

Attackers are embedding malicious code into image files and uploading them to social media websites including LinkedIn and Facebook exploiting a security misconfiguration on such sites. When you click on an image, the file is downloaded instead of opened resulting in an immediate infection.

For the past three days’ ransomware-variant Locky, has been spread via ImageGate. Check Point says it advised Facebook and LinkedIn of the potential attack vector in early September, but the loophole still exists.

Oded Vanunu, head of Check Point’s Products Vulnerability Research, said, “As more people spend time on social networking sites, hackers have turned their focus to finding a way to use these platforms. Cyber criminals understand these sites are usually ‘white listed’ and they are continually searching for new techniques to use them as hosts for malicious activities. To protect users against the most advanced threats, Check Point researchers strive to identify where attackers will strike next.”

Check Point recommends the following preventive measures:

  • If you have clicked on an image and your browser starts downloading a file, do not open it. Any social media website should display the picture without downloading any file.
  • Don’t open any image file with unusual extension (such as SVG, JS or HTA).

A detailed and technical disclosure will be published by Check Point after major social media sites fix the vulnerability to minimise attackers from taking advantage of this information.

Comment

It is not the first time that malware has been found in images – its called steganography where code and messages can be hidden in images.

In March 2014, some .jpg files were found to contain the malicious Zeus banking Trojan code. Phishing emails encouraged you to visit websites where clicking on a cute kitten or funny dog caused “drive-by” infections. On the whole, Browsers were updated to prevent such attacks.

This, however, is the first time that social media sites – a new attack vector - have been targeted, apparently with considerable success because they were slow to respond to Check Point's warnings.

Check Point has a brief video about ImageGate here.

 

BUSINESS WORKS BETTER WITH WINDOWS 1O. MAKE THE SHIFT

You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer

Timezones

QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.

REGISTER!

ADVERTISE ON ITWIRE NEWS SITE & NEWSLETTER

iTWire can help you promote your company, services, and products.

Get more LEADS & MORE SALES

Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]

OR CLICK HERE!

Ray Shaw

joomla stats

Ray Shaw [email protected]  has a passion for IT ever since building his first computer in 1980. He is a qualified journalist, hosted a consumer IT based radio program on ABC radio for 10 years, has developed world leading software for the events industry and is smart enough to no longer own a retail computer store!

VENDOR NEWS & EVENTS

REVIEWS

Recent Comments