Partner Perspectives  Connecting marketers to our tech communities.
11/29/2016
10:25 AM
Matthew Rosenquist
Matthew Rosenquist
Partner Perspectives
50%
50%

Beware: Scalable Vector Graphics Files Are A New Ransomware Threat

SVG files offer many advantages as far as graphics go, but hackers looking to embed malware on websites can exploit them.

Creative cyber criminals are taking advantage of Facebook's compatibility with SVG images to infect victims with ransomware. SVG (scalable vector graphics) files are dangerous on social media sites, email, and even instant messaging tools, as this format is designed with the ability to contain embedded content code such as JavaScript, which can be opened via Web browser. 

A recent incident involved spammers that leveraged Facebook to conduct a campaign to infect unsuspecting victims with the Locky ransomware. This malware is unforgiving and is designed to encrypt users’ files and hold them for extortion.

SVG images are also used on websites, making them a target. If attackers hack a website and replace the current SVG files with ones containing malware, then visitors to that site may become infected. By the time the company realizes its Web page has been infecting its customers, the situation may turn into a catastrophic business debacle.

Many organizations implement strong precautions and security to protect their internal networks from external threats, but not as many are vigilant in watching code on their websites for minor graphical changes.

Technology is great and can be used to do wonderful things. SVG files offer many advantages as graphics go, but they can be abused. Without sufficient controls to protect potential victims, I recommend blocking SVG files on social media sites. Although extreme, it may be prudent to also abandon the use of SVG images on websites until security software can catch up with features to test such embedded code for malicious actions with a high degree of confidence.

Interested in more? Follow me on Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.

Matthew Rosenquist is a cybersecurity strategist for Intel and benefits from 25 years in the field of security. He specializes in strategy, measuring value, and developing cost-effective capabilities and organizations that deliver optimal levels of security. Matthew helped ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
hieuhuule
50%
50%
hieuhuule,
User Rank: Apprentice
12/1/2016 | 10:11:28 AM
How to Block?
How do you block the SVG file in a browser?
Shantaram
50%
50%
Shantaram,
User Rank: Ninja
11/30/2016 | 5:07:54 AM
Re: 192.168.0.1
Interesting idea, and I totally agree with you :)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
11/29/2016 | 1:18:49 PM
Bah
What with all of these advanced threats based on newer technology -- not to mention how long it takes to load modern webpages -- I think we'd be better off going back to 1990s-style websites.  :/
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11232
PUBLISHED: 2018-05-18
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVE-2017-15855
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in u...
CVE-2018-3567
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.
CVE-2018-3568
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.
CVE-2018-5827
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.