Check Point Technologies security researchers have identified a new attack vector, named ImageGate, which embeds malware in image and graphic files.

Attackers are embedding malicious code into image files and uploading them to social media websites including LinkedIn and Facebook exploiting a security misconfiguration on such sites. When you click on an image, the file is downloaded instead of opened resulting in an immediate infection.

For the past three days’ ransomware-variant Locky, has been spread via ImageGate. Check Point says it advised Facebook and LinkedIn of the potential attack vector in early September, but the loophole still exists.

Oded Vanunu, head of Check Point’s Products Vulnerability Research, said, “As more people spend time on social networking sites, hackers have turned their focus to finding a way to use these platforms. Cyber criminals understand these sites are usually ‘white listed’ and they are continually searching for new techniques to use them as hosts for malicious activities. To protect users against the most advanced threats, Check Point researchers strive to identify where attackers will strike next.”

Check Point recommends the following preventive measures:

• If you have clicked on an image and your browser starts downloading a file, do not open it. Any social media website should display the picture without downloading any file.
• Don’t open any image file with unusual extension (such as SVG, JS or HTA).

A detailed and technical disclosure will be published by Check Point after major social media sites fix the vulnerability to minimise attackers from taking advantage of this information.

Comment

It is not the first time that malware has been found in images – its called steganography where code and messages can be hidden in images.

In March 2014, some .jpg files were found to contain the malicious Zeus banking Trojan code. Phishing emails encouraged you to visit websites where clicking on a cute kitten or funny dog caused “drive-by” infections. On the whole, Browsers were updated to prevent such attacks.

This, however, is the first time that social media sites – a new attack vector - have been targeted, apparently with considerable success because they were slow to respond to Check Point's warnings.

Check Point has a brief video about ImageGate here.