As you may have noticed, a lot of spam exists for the specific purpose of tricking you into visiting a particular website–often one that intends to download malware. Images can play a big part of that. You probably already know not to click a link in a suspicious email, but photos can be embedded in emails as they are in webpages—and do their dirty work when you open the mail.
Fortunately, most modern mail clients don’t display such pictures by default. Best to keep it that way.
Another trick is the double extension, which takes advantage of Windows’ file-naming conventions. If a file is named adorable.jpg.exe, most Windows computers will display it as adorable.jpg. Most users, therefore, will think it a harmless image file, even though it’s really an executable program. And when you run the program, it probably will show you an adorable picture…while it infects your PC.
And finally, there’s steganography, which in a digital context means the art of hiding data in another type of file. A .jpg can easily contain additional bits interwoven within the image, without noticeably effecting the image’s appearance. That additional data can include code, which is encrypted to make it harder to identify.
Luckily, such an altered image can’t do much by itself. No image viewer will see or know what to do with that code, even if it isn’t encrypted. But malware developers often break up their code into multiple pieces and distribute them separately to avoid detection. The information hidden in a picture could contain instructions useful to another piece of malware on your computer. See Zeus banking malware hides crucial file inside a photofor one recent example.
How do you protect yourself? Giving up on images seems a bit extreme. There are better methods.
Keep your operating system, browser, and antivirus software up-to-date. Of course, you should be doing that already.
Be wary of photos whose origins you don’t know.
And finally, have Windows show you file extensions so you won’t be fooled. In Start menu’s Search field, or in Windows 8’s Search charm, type folder options. Select Folder Options. On theView tab, uncheck Hide extensions for known file types.
