Image spam

Image spam

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Image spam George Hester 07-25-2006
---> Re: Image spam Mark Randall07-25-2006
  `--> Re: Image spam George Hester07-26-2006
Posted by George Hester on July 25, 2006, 12:51 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Did you read that article here in the USA about the prevalence of Image
based spam and how it is sending filter makers throught hoops on how to
catch it?

Well this post is not about how to catch these image spams just how they are
using Microsoft's ingenuity against us. See in Microsoft operating systems
which still use a form of Web View in Windows Explorer such as Windows XP
and 2000, the spamming images are such that they invoke the Web View. Well
of course we all know that. But what they are doing is misnaming the images
so that when Windows Explorer tries to Web View it they can cause the
scripting to become malicious. Malicious in the sense that Windows Explorer
will assign memory to the conversion and not realease it. The only way to
get the resources back is to log out. You can see this when if you choose
another image that you know Web View works on you will find it will not Web
View. That is because the scripting is still "running." Of course you have
to strip the images out to see this behavior.

Just thought the world might like to know.

--

George Hester
_________________________________



Posted by Mark Randall on July 25, 2006, 3:24 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Did you read that article here in the USA about the prevalence of Image
> based spam and how it is sending filter makers throught hoops on how to
> catch it?

I found the best way was creating a new folder, and having all emails
greater than a small size (say 15kb) popped off to a 'probably spam' folder.

--
- Mark Randall
http://www.temporal-solutions.co.uk
http://www.awportals.com



Posted by George Hester on July 26, 2006, 8:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes that is one way. They are usally 17KB. I have not seen "them" under
that. But try this Mark and you will see what I was rambling about. Just
set up script to copy those images for a days receipt to a folder off your
drive. Then select each one. Of course you must be using Web View which is
the default view for Microsoft's operating systems. You will notice many of
them are mis-extension-named for what the images really are, are gif, jpg,
or png and they will not appear in Web View as a preview..

The png ones will cause the behavior that I mentioned below. The will
usually be mis-extension-named jpg or gif but they are in fact png. Windows
Explorer will allocate memory to the image and "hang." You can see this by
selecting another image that you know appears in Web View and the image
preview will not appear. This is because Windows Explorer is still running
to get the image previewof that previous mis-extension-named image file.

This is a security threat. I do not know if this will happen on all
machines because I do not update with every security fix Microsoft comes out
with. Rather than telling me something about my decision that I already
know please accept that I have not installed that GDI fix that Microsoft
came out with and I am wondering if that fix works to avoid the issue that I
am talking about.

--

George Hester
_________________________________
> > Did you read that article here in the USA about the prevalence of Image
> > based spam and how it is sending filter makers throught hoops on how to
> > catch it?
>
> I found the best way was creating a new folder, and having all emails
> greater than a small size (say 15kb) popped off to a 'probably spam'
folder.
>
> --
> - Mark Randall
> http://www.temporal-solutions.co.uk
> http://www.awportals.com
>
>



Similar ThreadsPosted
iTunes.exe - Bad Image - ksuser.dll is not a valid Windows image April 12, 2008, 7:10 pm
Strange image on desktop won't go away March 1, 2006, 11:50 am
Stumped by Image Displayed in Preview Pane January 27, 2006, 11:31 am
Take a stab at the hotmail FW: jpeg.image spams February 15, 2006, 1:18 pm
What are the pros and cons for placing image on external hard disk? June 28, 2008, 11:22 pm
Unknown Publisher warning msg after sysprep on Win XP Pro SP2, affects image cloning rollout project November 21, 2005, 7:10 am
If I have created recovery image in a hidden partition, should I creat bootable rescue media in addition? October 30, 2006, 4:59 am
Pop-up spam July 16, 2005, 1:28 pm
SPAM!!!! December 22, 2005, 12:05 pm
X-NAS-Validation in spam October 17, 2005, 7:00 pm

The site map in XML format XML site map

Contact Us | Privacy Policy