JPEG exploit could beat antivirus, says expert

Anti-virus software looks as if it will struggle to protect corporate networks from the latest Windows vulnerability - innocent looking JPEG files that contain security attacks.

According to director of antivirus research for F-Secure Mikko Hypponen, antivirus software will strain to find JPEG malware because by default it only searches for .exe files.

"Normal antivirus software by default will not detect JPEGs," said Hypponen. "You can set your antivirus scanner to look for JPEG, but the trouble is that you can change the file extension on a JPEG to so many things."

There are around 11 similar file extensions that JPEGs can be changed to, such as .icon or .jpg2. Hypponen said that this would make searching for malicious JPEGs even more difficult because it could take up a significant amount of valuable processor power.

Internet Explorer processes JPEGs before it caches them. That could also mean that desktops would become infected before antivirus software had a chance to work.

"This means that it is not enough to scan at the desktop," said Hypponen. "You have to scan at the gateway, but this will put a huge load on your bandwidth."

Hypponen said that he expected a virus attack using the exploit to occur soon: "There has been so much interest in this vulnerability that someone is bound to do this. But saying that, there was a similar vulnerability found two months ago in Bitmaps, and no one has exploited that yet."

Yesterday code that exploits the way Microsoft Windows processes Jpegs was posted to U.S. newsgroup Easynews. Hypponen wrote on the F-Secure weblog that this was not a virus because it had no way of spreading. In order for the code to infect a machine, a user must download the image it purports to be and view it in Windows Explorer.

Yesterday Microsoft hit back at critics over its handling of the vulnerability. In a prepared press statement, it said: "Microsoft does not consider this a high risk to customers given the amount of user action required to execute the attack and is not currently aware of any significant customer impact. We will continue to investigate the situation and provide customers with additional resources and guidance as necessary."

Additional reporting by Rob Lemos of ZDNet UK sister site CNET News.com