0
Is there a known way to do the following:
- I have 1
.mp3file and 1.jpgfile - Combine the 2 such that the
.mp3file is played when an mp3 player is used, and the.jpgis displayed when an image viewer is used
Another way of using such a feature is to save a .exe inside a .docx file, such that only the Word file is read when the .docx extension is used and the .exeis run when the .exe extension is used.
On Windows, changing which file type to read can be as easy as changing the extension. However, I'd like to be able to do this even on Linux where I can (or have to) choose which of the 2 embedded files is read by choosing the program to read it (an audio vs image software). I'm aware that "magic numbers" are used to tell Linux systems the file types. I can just make the magic number that of the "safe" file type (jpg, mp3, odp,...) while hiding a malicious file (shell script, ELF, js,...)
I'm just looking for methods of embedding and hiding files. The security implications won't be discussed here.
John Zhau
Posted 2019-12-25T02:53:14.740
Reputation: 137
2Are you saying to want to hide a malicious file? I will have to mark you down for this. – vssher – 2019-12-25T03:15:43.500
I'm actually in Information Security. I want to learn about ways to hide malicious files so I can find ways to process such files. There has been many cases where programs like WhatsApp run malicious files embedded in mp3/jpg/gif files. – John Zhau – 2019-12-25T03:18:54.690
@vssher If you look at security.SE, you'll see people asking how to hack and exploit things quite a lot. Since this question is just about file embedding and not (yet) about its security implementations, I'm asking it here on su.SE rather than sec.SE. I believe asking such questions isn't a bad thing. – John Zhau – 2019-12-25T03:21:42.757
please edit your question to include that you are in security then I can change the downvote, until then I cannot change it. – vssher – 2019-12-25T03:30:34.597
@vssher While the end goal of this question is for security, the main subject of it is file embedding. This is not a security question. If you ignore the "embedding malicious files" part, which is just an example, and just focus on the example of "mp3 + jpg", it's a valid question for this site. What the asker intends to do with the results is not in the scope of this question. I'm only looking for methods. – John Zhau – 2019-12-25T03:33:47.683
@This site will not allow me to change it unless it is edited. Sorry – vssher – 2019-12-25T03:34:44.983
@ "I'm actually in Information Security.". - and I am Santa Claus. – Michael Harvey – 2019-12-25T09:57:03.850
@MichaelHarvey It's still not a reason to not ask/answer the question though. Anyone can later see this, including criminals. We have plenty of open-source hacking tools and materials to learn about hacking and criminal stuff. Also, if I'd wanted to secretly use this for criminal stuff, I wouldn't have included that 2nd example. – John Zhau – 2019-12-25T13:41:51.757
Have you looked into Alternate Data Streams (ADS) for NTFS? Maybe extended/named attributes Linux world. I guess these operate at the file system level so moving the files off of such a file system would typically lose the data but it may be part of what you're after. – HelpingHand – 2019-12-25T19:39:11.843