Exploiting SVG Files: A New Frontier for Adult Sites
In an evolving landscape of cyber threats, adult sites have found a novel channel for garnering Facebook likes – malicious code embedded within .svg image files. These files possess unique qualities that render them ideal candidates for exploitation in digital schemes.
The SVG format, commonly known as Scalable Vector Graphics, is a widely recognized protocol for rendering two-dimensional graphics. Unlike the more prevalent .jpg or .png formats, SVG files utilize XML-based text to dictate the image's appearance. This feature ensures images maintain quality when resized, preventing pixelation. However, this text-based approach also allows for the integration of HTML and JavaScript, introducing the potential for various attacks, including cross-site scripting, HTML injection, and denial of service.
Recently, cybersecurity experts at Malwarebytes highlighted the use of .svg files by adult sites to trick users into liking their Facebook posts. The subterfuge begins when a user interacts with one of these images, leading to a concealed endorsement of the site via their Facebook account.
The obfuscation of JavaScript within SVG files presents a challenge. In this case, the attackers employed a complex technique known as “JSFuck,” which encodes JavaScript with a minimal set of characters, creating a heavily disguised script. Once decoded, this script downloads additional encrypted JavaScript, including a well-known malicious entity termed Trojan.JS.Likejack. This particular script automatically registers a 'like' on specified Facebook posts, contingent on the victim being logged into Facebook at that time.
This type of exploitation isn't unprecedented. A couple of years ago, hackers leveraged a similar SVG tag to breach security through a cross-site scripting flaw found in the Roundcube webmail application. Moreover, instances have been recorded where SVG files contained code leading to fraudulent login interfaces.
Malwarebytes' scrutiny revealed a plethora of adult sites utilizing SVG-based tricks to amass social media engagement, notably operating on the WordPress content management platform. While Facebook actively weeds out such abusive accounts, perpetrators often circumvent bans using new profiles.
As threats evolve, users must remain vigilant, particularly when engaging with multimedia files that might unsuspectingly harbor malicious scripts.
