Malware Hidden Inside JPG EXIF Headers
Although this obfuscation is very clever, I think the article overstates a bit. The author claims that the following two commands "harmless by themselves":<p><pre><code>  $exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg');
  preg_replace($exif['Make'],$exif['Model'],'');
</code></pre>
I don't agree with that. While the first command is indeed harmless, the second one is executing a REGEX machine with a dynamic regex param. This is almost like having a user-defined format string to printf(), and thus very suspicious and should be found by any decent security analysis tool.<p>Even without the "/e" feature of preg_replace, this could result at least in a denial of service attack via some specially crafted regex parameters.<p>So I agree that this is clever, but I don't agree that this call to preg_replace() should normally be considered harmless by itself. So the question remains why the authors overstate the cleverness of this attack, and I think they give the answer in the last sentence of the article:<p><i>"Note: Any of Sucuri clients using Server Side Scanning are protected against this type of injection (detected by us)."</i>