greengaq.blogg.se

That's a different kind of macOS attack, something we've covered in another article.

To be clear, double-clicking the image file will not cause the embedded command to execute. A stager will then be created to download the image, extract the metadata, and execute the embedded command. The attacker would host the malicious image on a public website like Flickr, making it accessible for anyone to download.

In this attack scenario, a malicious command will be embedded directly into the EXIF metadata of an image file. In addition to obfuscating the true nature of an attack, this technique can be used to evade network firewalls as well as vigilant sysadmins. Complex shell scripts can be implanted into photo metadata and later used to exploit a MacBook.