Should I be afraid of a malicious GIF file?

security internet-explorer gif animated-gif

14,570

Solution 1

This is by design and by default, Windows 7 opens .gif images in Internet Explorer because the basic picture viewer application does not support the animation features of the gif file format while Internet Explorer does.

If you are really worried just make sure your computer has up to date security patches and decent antivirus, as far as I know you cannot get a virus from opening a gif image.

Can a virus "hide" in a GIF or JPEG file? Answer - No

This appears to show a virus payload in a gif file, but the user has to go through a big hoop to actually activate the payload. It cannot be simply run by viewing the image.

Solution 2

There have been image exploits before, I remember a libjpeg exploit on Windows long since patched (I couldn't find it easily).

The way programs work, there is an area called the stack (and less so, a place called the heap) where data and code are somewhat mixed. If I can give you data in a different format and/or size than what you are prepared to take, maybe I can really mix my data into your code and make it code. Meaning, I con you to run me instead of your program. Now, instead of running Internet Explorer (or whatever) you're running me, scary.

Technically this wouldn't be a virus - it spread as a trojan. But it doesn't matter much how it got on your system, you're running it.

There are some limits. There has to be a bug in the reading code. Its non-trivial to get the code to run. You need to know assembler and how to call Windows code from it. Windows and other OS's have made efforts to make actually using these bugs harder and harder (though very smart people still can).

Keep your system updated. Much of the damage is from bugs, they can be patched.

What was in the torrent package? A video? An executable? An executable doesn't even need to 'hack' your system, you just ran it, gave it permission. Videos are much more complicated than a gif. Much more likely to have bugs in code that lead to exploits. A gif is a simple file format, code has been around before the web existed, fewer holes for bugs. New video codecs come out all the time. Windows WMV files used to/still can (not sure) call out to web pages for ads or codecs. Many of these webpages have IE exploits and you just pwned your computer. I'd be much more worried about what else was in the torrent than the gifs.

Solution 3

Upload it to VirusTotal to be sure.

Exploits are possible (example), although if your computer is up-to-date you shouldn't worry.

Solution 4

It's always good to have proper anti-virus/malware/firewall etc. There were some virus which can embed itself into gif files and spread:

http://www.pctrojan.com/content/109-streamviewers-gif-images-embedded-encrypted-malware

In your case, you're most likely not infected, but better to double check.

View more solutions

14,570

Vass

This is the third phase of my StackOverflow/Stackexchange experience. Maths/Stats and the IT means to do it! (does AI fit into it or does it revolve around it? or... do they revolve around I?)

Updated on September 18, 2022

Comments

Vass over 1 year

I downloaded a torrent which had some gifs with pirate logos on it. There was a gif with the text 'we are watching you'. I clicked on one of them and it opened my internet explorer browser. I turned it off quickly after, but it was loaded for a short time.

What are the potential risks of opening a gif, and in this situation what are the possible incurred dangers?
- Almir Sarajčić almost 13 years
  
  The way you describe it, it sounds quite normal IF the file type GIF is associated with IE.
- Mokubai almost 13 years
  
  Which it is by default in Windows 7 at least...
- deprecated almost 13 years
  
  Apologies but this made laugh out actually loud.
- hicklypups almost 13 years
  
  This begs the question, why would you click on something so suspicious in the first place??
- Moab almost 13 years
  
  Question should be "what are the potential risks of opening anything I download using bittorrent?"
Mokubai almost 13 years

Isn't that page you linked about an already infected machine using the gif format to hide a supplemental payload? I can't see anything to suggest that the gif format is the direct infection vector.
Mokubai almost 13 years

If I remember rightly there was some problems a few years ago with either the emf or wmf file formats, but an up to date and patched OS is immune.
Mokubai almost 13 years

That was the one I was thinking of, though it only affects WMF images as the format specifically allows certain types of post-processing to occur. From the vulnerability section: "A remote code execution vulnerability exists in the Graphics Rendering Engine because of the way that it handles Windows Metafile (WMF) images." So it does not apply to GIF images
Mokubai almost 13 years

But as always it is best to err on the side of caution.
user1686 almost 13 years

Re "Windows 7 opens .gif images in Internet Explorer because the basic picture viewer application does not support the animation features of the gif file format" -- is it true? The basic picture viewer application displayed animated GIFs in Windows XP just fine...
Mokubai almost 13 years

On my machine "Windows Photo Viewer" and "Windows Live Photo Gallery" will both view but not animate gif images... this is just my experience and YMMV... :)
user1686 almost 13 years

Meh, I was just curious. It's not the first time Windows loses a feature anyway.
Tamara Wijsman almost 13 years

@Mokubai: Updated the example, check this one. :)
Mokubai almost 13 years

:O I didn't know about that one. I wonder what other image formats are potential sources of infection...