Partner Perspectives  Connecting marketers to our tech communities.
11/29/2016
10:25 AM
Matthew Rosenquist
Matthew Rosenquist
Partner Perspectives
50%
50%

Beware: Scalable Vector Graphics Files Are A New Ransomware Threat

SVG files offer many advantages as far as graphics go, but hackers looking to embed malware on websites can exploit them.

Creative cyber criminals are taking advantage of Facebook's compatibility with SVG images to infect victims with ransomware. SVG (scalable vector graphics) files are dangerous on social media sites, email, and even instant messaging tools, as this format is designed with the ability to contain embedded content code such as JavaScript, which can be opened via Web browser. 

A recent incident involved spammers that leveraged Facebook to conduct a campaign to infect unsuspecting victims with the Locky ransomware. This malware is unforgiving and is designed to encrypt users’ files and hold them for extortion.

SVG images are also used on websites, making them a target. If attackers hack a website and replace the current SVG files with ones containing malware, then visitors to that site may become infected. By the time the company realizes its Web page has been infecting its customers, the situation may turn into a catastrophic business debacle.

Many organizations implement strong precautions and security to protect their internal networks from external threats, but not as many are vigilant in watching code on their websites for minor graphical changes.

Technology is great and can be used to do wonderful things. SVG files offer many advantages as graphics go, but they can be abused. Without sufficient controls to protect potential victims, I recommend blocking SVG files on social media sites. Although extreme, it may be prudent to also abandon the use of SVG images on websites until security software can catch up with features to test such embedded code for malicious actions with a high degree of confidence.

Interested in more? Follow me on Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.

Matthew Rosenquist is a cybersecurity strategist for Intel and benefits from 25 years in the field of security. He specializes in strategy, measuring value, and developing cost-effective capabilities and organizations that deliver optimal levels of security. Matthew helped ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
hieuhuule
50%
50%
hieuhuule,
User Rank: Apprentice
12/1/2016 | 10:11:28 AM
How to Block?
How do you block the SVG file in a browser?
Shantaram
50%
50%
Shantaram,
User Rank: Ninja
11/30/2016 | 5:07:54 AM
Re: 192.168.0.1
Interesting idea, and I totally agree with you :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/29/2016 | 1:18:49 PM
Bah
What with all of these advanced threats based on newer technology -- not to mention how long it takes to load modern webpages -- I think we'd be better off going back to 1990s-style websites.  :/
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17208
PUBLISHED: 2018-09-19
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell me...
CVE-2018-17205
PUBLISHED: 2018-09-19
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not ex...
CVE-2018-17206
PUBLISHED: 2018-09-19
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.
CVE-2018-17207
PUBLISHED: 2018-09-19
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
CVE-2017-2855
PUBLISHED: 2018-09-19
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HT...