Malicious code purification in the body of graphics files
An information handling system improves removal of steganography data embedded in a graphics file by processing graphics files stored in a file system or transmitted through a network by processing the graphics files in a steganalyzer. The steganalyzer converts the body segment of the graphics file into binary code, and then compresses the binary code into a graphics file. This process results in the removal of any potential malicious code. The body segment location can be determined by parsing the portable network graphics file to determine a location of a pre-fix graphics file signature and a post-fix graphics file signature, with the graphics files signatures being specific to a particular type of graphics file.
1. A method, comprising:
determining, by a processor, a presence of a body segment of a file beginning at a first location following a pre-fix graphics file signature and ending at a second location at a start of a post-fix graphics file signature, the body segment comprising graphics data such that the file is a graphics file;
converting, by the processor, the body segment of the graphics file into representative binary code based on determining that the file is a graphics file;
converting, by the processor, the representative binary code into a replacement body segment for the graphics file; and
writing, by the processor, a new graphics file comprising the replacement body segment.
2. The method of claim 1 , wherein the step of converting the representative binary code into the replacement body segment comprises executing a lossless data compression algorithm.
3. The method of claim 1 , wherein the step of determining the body segment comprises parsing, by the processor, the graphics file to determine a location of a graphics file signature in the graphics file.
4. The method of claim 3 , wherein the step of parsing the graphics file comprises:
determining the first location of the pre-fix graphics file signature; and
determining the second location of the post-fix graphics file signature.
5. The method of claim 4 , wherein the graphics file comprises a portable network graphics (PNG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00”.
6. The method of claim 5 , wherein the post-fix graphics file signature comprises hexadecimal values comprising “00 00 00 00 49 45 4E 44 AE 42 60 82”.
7. The method of claim 4 , wherein the graphics file comprises a Joint Photographic Experts Group (JPEG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 00 01 00 00 FF DB 00 84 00 09 06 07”.
8. The method of claim 1 , further comprising scanning a plurality of files to determine an existence of a graphics file, wherein the plurality of files comprises graphics files and non-graphics files.
9. An information handling system comprising:
a processor; and
a memory having code stored thereon that, when executed by the processor, performs a method comprising:
determining, by a processor, a presence of a body segment of a file beginning at a first location following a pre-fix graphics file signature and ending at a second location at a start of a post-fix graphics file signature, the body segment comprising graphics data such that the file is a graphics file;
converting, by the processor, the body segment of the graphics file into representative binary code based on determining that the file is a graphics file;
converting, by the processor, the representative binary code into a replacement body segment for the graphics file; and
writing, by the processor, a new graphics file comprising the replacement body segment.
10. The information handling system of claim 9 , wherein the step of converting the representative binary code into the replacement body segment comprises compression algorithm.
11. The information handling system of claim 9 , wherein the step of determining the body segment comprises parsing, by the processor, the graphics file to determine a location of a graphics file signature in the graphics file.
12. The information handling system of claim 11 , wherein the step of parsing the graphics file comprises:
determining the first location of the pre-fix graphics file signature; and
determining the second location of the post-fix graphics file signature.
13. The information handling system of claim 12 , wherein the graphics file comprises a portable network graphics (PNG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00”.
14. The information handling system of claim 13 , wherein the post-fix graphics file signature comprises hexadecimal values comprising “00 00 00 00 49 45 4E 44 AE 42 60 82”.
15. The information handling system of claim 12 , wherein the graphics file comprises a Joint Photographic Experts Group (JPEG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 00 01 00 00 FF DB 00 84 00 09 06 07”.
16. A non-transitory computer-readable medium including code for performing a method, the method comprising:
determining, by a processor, a presence of a body segment of a file beginning at a first location following a pre-fix graphics file signature and ending at a second location at a start of a post-fix graphics file signature, the body segment comprising graphics data such that the file is a graphics file;
converting, by the processor, the body segment of the graphics file into representative binary code based on determining that the file is a graphics file;
converting, by the processor, the representative binary code into a replacement body segment for the graphics file; and
writing, by the processor, a new graphics file comprising the replacement body segment.
17. The non-transitory computer-readable medium of claim 16 , wherein the step of converting the representative binary code into the replacement body segment comprises executing a lossless data compression algorithm.
18. The non-transitory computer-readable medium of claim 16 , wherein the step of determining the body segment comprises parsing, by the processor, the graphics file to determine a location of a graphics file signature in the graphics file, and wherein the step of parsing the graphics file comprises:
determining the first location of the pre-fix graphics file signature; and
determining the second location of the post-fix graphics file signature.
19. The non-transitory computer-readable medium of claim 18 , wherein the graphics file comprises a portable network graphics (PNG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00”, and wherein the post-fix graphics file signature comprises hexadecimal values comprising “00 00 00 00 49 45 4E 44 AE 42 60 82”.
20. The non-transitory computer-readable medium of claim 18 , wherein the graphics file comprises a Joint Photographic Experts Group (JPEG) file, and wherein the pre-fix graphics file signature comprises hexadecimal values comprising “FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 00 01 00 00 FF DB 00 84 00 09 06 07”.