Podcast Detail

SANS Stormcast Tuesday, September 22nd, 2026: PNG Stego Analysis; NPM BTree Malware; Pi-Hole Advisory

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10104.mp3

previous
Podcast Logo
PNG Stego Analysis; NPM BTree Malware; Pi-Hole Advisory
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Tuesday, September 22, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ulrich, recording today from Las
 Vegas, Nevada. And this episode is brought to you by
 the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Today's diary comes from Didier and
 Didier wrote about an image that was used as part of a
 terminal fix campaign that Microsoft did recently write
 about. Now what was interesting about this PNG
 file is that it's 100% valid PNG file. It's not one of
 those cases where the executable is just sort of
 being added as garbage data at the end of a PNG file.
 Instead, the executable itself is encoded inside the PNG
 pixel data. So actual steganography, what's a little
 bit different from how steganography is usually used
 is that typically only a couple bits are being changed
 in the image for normal steganography. While here the
 entire image data was the executable. So the image
 itself while it's still displayed didn't really
 display any real image per se just more or less noise with
 some lines through it. Now what was interesting here also
 is that when you just looked at the image data itself, you
 did not recognize the actual PE data like the typical
 headers and such that you see in PE files. Instead, what you
 saw was well what looked like sort of garbage. What the
 trick being used here was that PNG files can be encoded by
 really just encoding the differences in pixel values
 and that had to be undone that encoding or obfuscation in
 this particular case in order to arrive at the actual pixel
 data. Now, DDA of course has a python tool for that that he
 shared that's pngdump.py and DDA's diary walks you through
 how to use this tool to decode and extract the executable
 from this particular file. And check marks discovered yet
 another supply chain attack against NPM. They called it
 the B3 melder campaign because the library that's being
 introduced here is called indexed B3 apparently to mimic
 a legitimate sorted B3 library. What makes this
 campaign different and noteworthy is that it takes a
 different approach than what we have seen often in the past
 from running malicious code. Usually in the past, the
 supply chain attacks have heavily relied on install
 script. So whenever the developer installs the
 library, there is an option to run install scripts and those
 install scripts were then usually exploiting the system
 in part because that way even if the library is never used
 the malicious code still runs. It only really runs them on
 the developer's system. Now, GitHub and many detection
 techniques and such relied recently on identifying these
 malicious install scripts. So in order to evade this kind of
 detection, this particular library does not use the
 install script. Instead, it just executes the malicious
 code as part of the library's own code. So the drawback here
 is that the attacker needs to wait for the code to actually
 execute. It does not run immediately after installing
 the library. But then again, that's probably not such a
 long stretch. And well, they this particular malware does
 evade most current detection techniques, which as
 checkmarks points out leads to the library actually still
 being in GitHub as of checkmarks writing their post.
 What can you do about this? Well, not really much other
 than being careful what you're installing. In particular, of
 course, these sort of naming conflicts or similar names
 that has always been sort of that good old typo squatting a
 kind of technique that has been heavily used. This
 particular malware does also heavily relied on blockchains
 for command and control and in order to exchange crypto keys.
 And then we got an update for a Pi-Hole, something should
 probably take serious and patch as you get around to it.
 Out of the four vulnerabilities, two of them
 are remote code execution vulnerabilities. However, they
 do require authenticated sessions. So only if you're
 running it like a no password mode, that may be not an
 issue. And of course, you would also have to expose the
 Pi-Hole for the attacker to be able to access the web
 interface. So like I said, nothing really super urgent,
 but the all of your tools should be patched. And it's a
 reminder to occasionally also check in on your Pi-Hole.
 Well, and that's it for today. Thanks for listening. Thanks
 for liking. Thanks for subscribing as always. And
 talk to you again tomorrow. Bye.