Hacker News Reader

So if I read this correctly, the idea is that the PNG fetch looks innocuous to traffic scanners but the fetcher code executes the included DLL? The PNG rendering code in the browser would just discard those bits.

View on HN

What I gathered is that this is just a way for malware to fetch additional instructions after already being executed through some unrelated process.

In other words, you've already been compromised, but the malignant code needs more instructions to continue effectively, so it fetches what appears to be an innocuous PNG file, which carries the instructions it needs.

So then this is nothing new. Any file which supports arbitrary header lengths can have crap dumped into in order to create a fairly lame disguise.

The article is not clear on the actual execution step. It is written by Cisco, after all, suggesting that the article is concerned mostly with how the worm spreads itself (with more focus on the command-and-control and networking). It's possible that it only spreads when it is saved locally and "opened" by the user in an application. It's also possible that it's executed in the browser upon open and/or render. Since the worm/payload is a DLL and the user-agent making the download requests is Trident, I'm guessing it's a problem with the Windows + IE code, which is likely shared, that renders PNG images.

Reply on news.ycombinator.com