JPEG Exploit Targeting Porn Newsgroups

CYBERSPACE — The first attacks using the Windows JPEG flaw have shown up on adult-oriented newsgroups, according to warnings issued by Internet security organizations today.

Usenet-related site EasyNews published a notice today that pornographic images containing hidden code were posted to at least 10 of the alt.binaries newsgroups, including alt.binaries.erotica.breasts and alt.binaries.erotica.beanie-babies.

The images first started to be posted at around 7 p.m. on Sunday, according to Godzilla, an administrator at EasyNews.

The corrupted images, which look exactly the same as a normal image, exploits the recently-announced JPEG flaw in Windows’ Graphic Device Interface Plus (GDI+) with a buffer overflow attack.

“Once this JPEG overflowed GDI+, it phoned home, connected to an FTP site and downloaded almost 2 megs of stuff,” stated Godzilla.

After downloading the files, the malicious code sets the infected computer up as a server and installs an IRC client.

According to Godzilla, 93 users were logged into the FTP site when he checked it last.

The release of the infected images came less than a week after sample code appeared on the Internet that explained how to exploit the GDI+ JPEG flaw.

According to the F-Secure Antivirus Research Team, the corrupted images don’t seem to be attempting to spread themselves.

“These JPEGs did not replicate, so this is not a virus,” the team wrote in their weblog. “Apparently, they tried to use these JPEGs to download Trojans to vulnerable computers… but the download sites should be down by now.”

Even though the threat posed by the these specific postings may have passed, F-Secure is concerned that it might signal a large problem on the way.

“Things are heating up,” wrote Mikko, a member of F-Secure’s antivirus team. “I have a nasty feeling we might sooner or later see a massmailer worm using a JPEG image as the attachment.”

Copyright © 2025 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More News

TeamSkeet, MYLF to Launch New Website FamilyStrokes.com

Sister studios TeamSkeet and MYLF are launching a new website, FamilyStrokes.com.

AV Bulletin: Age Verification Hits the Mainstream, Ofcom Sets a Date

Industry stakeholders and free speech advocates have anxiously been awaiting the Supreme Court’s decision in Free Speech Coalition v. Paxton, which could significantly impact state age verification laws around the country. In the meantime, state legislatures continue to weigh and pass AV bills, AV tech providers continue to tout their services, and legal challenges continue to play out in the courts — with some cases on hold pending the SCOTUS ruling in Paxton.

Segpay Names Kristi Greer VP of Sales

Segpay has promoted long-time employee Kristi Greer to the position of vice president of sales.

BranditScan Names Subgirl Newest Brand Ambassador

BranditScan has named content creator Subgirl its newest brand ambassador.

Arcom Reports Age Verification Enforcement Actions Against 5 Adult Sites

French media regulator Arcom released a statement Tuesday detailing recent actions to enforce age verification rules as set forth under France’s Security and Regulation of the Digital Space (SREN) law.

Pineapple Support, Clips4Sale to Host Performers' Partners Support Group

Pineapple Support and Clips4Sale are hosting a free online support group for partners and family members of adult industry professionals.

FSC Mourns the Loss of Board Director Emeritus Mark Kernes

Free Speech Coalition has released a statement regarding the passing of Board Director Emeritus Mark Kernes.

Alexa Creed Launches New Paysite

Creator Alexa Creed has launched a new membership site through MyMember.site.

Choice Talent Management Launches Fan Platform 'ChoiceFilmz'

Choice Talent Management CEO Chris Crisco has launched a new fan platform called ChoiceFilmz.

Dredd to Launch Official Site

Dredd has announced his new website OfficialDreddXXX.com, launching April 20.

Show More