A photo that can steal your online credentials

August 4, 2008 – 9:07 AM

At the Black Hat computer security conference in Las Vegas next week, researchers will demonstrate software they’ve developed that could steal online credentials from users of popular Web sites such as Facebook, eBay, and Google.

The attack relies on a new type of hybrid file that looks like different things to different programs. By placing these files on Web sites that allow users to upload their own images, the researchers can circumvent security systems and take over the accounts of Web surfers who use these sites.

“We’ve been able to come up with a Java applet that for all intents and purposes is an image,” said John Heasman, vice president of research at NGS Software.

They call this type of file a GIFAR, a contraction of GIF and JAR, the two file types that are mixed. At Black Hat, the researchers will show attendees how to create the GIFAR while omitting a few key details to prevent it from being used immediately in any widespread attack.

To the Web server, the file looks exactly like a .gif file, however a browser’s Java virtual machine will open it up as a Java Archive file and then run it as an applet. That gives the attacker an opportunity to run Java code in the victim’s browser. For its part, the browser treats this malicious applet as though it were written by the Web site’s developers.

Here’s how an attack would work: The bad guys would create a profile on one of these popular Web sites — Facebook, for example — and upload their GIFAR as an image on the site. Then they’d trick the victim into visiting a malicious Web site, which would tell the victim’s browser to go open the GIFAR. At that point, the applet would run in the browser, giving the bad guys access to the victim’s Facebook account.

Source:
http://www.infoworld.com/article/08/08/01/A_photo_that_can_steal_your_online_credentials_1.html