Usenet-related site EasyNews published a notice today that pornographic images containing hidden code were posted to at least 10 of the alt.binaries newsgroups, including alt.binaries.erotica.breasts and alt.binaries.erotica.beanie-babies.
The images first started to be posted at around 7 p.m. on Sunday, according to Godzilla, an administrator at EasyNews.
The corrupted images, which look exactly the same as a normal image, exploits the recently-announced JPEG flaw in Windows’ Graphic Device Interface Plus (GDI+) with a buffer overflow attack.
“Once this JPEG overflowed GDI+, it phoned home, connected to an FTP site and downloaded almost 2 megs of stuff,” stated Godzilla.
After downloading the files, the malicious code sets the infected computer up as a server and installs an IRC client.
According to Godzilla, 93 users were logged into the FTP site when he checked it last.
The release of the infected images came less than a week after sample code appeared on the Internet that explained how to exploit the GDI+ JPEG flaw.
According to the F-Secure Antivirus Research Team, the corrupted images don’t seem to be attempting to spread themselves.
“These JPEGs did not replicate, so this is not a virus,” the team wrote in their weblog. “Apparently, they tried to use these JPEGs to download Trojans to vulnerable computers… but the download sites should be down by now.”
Even though the threat posed by the these specific postings may have passed, F-Secure is concerned that it might signal a large problem on the way.
“Things are heating up,” wrote Mikko, a member of F-Secure’s antivirus team. “I have a nasty feeling we might sooner or later see a massmailer worm using a JPEG image as the attachment.”
