Can PAN detect this kind of malware?

[emr_1]

I found following article.

Sucuri Research

This is pretty interesting technique, though if people hits this kind of malware, is Threat Prevention (or might be wildfire?) able to detect this malware?

Regards,

[mikand]

Hopefully PA will add this as a general threat that a jpeg contains a malformed exif-header (or rather the exif-header contains data which shouldnt exist there in normal situations).

Such as the /.*/e^ or for that matter eval, base64_decode and the other stuff.

This would also be interresting to exploit regarding as a tunneling technique.

That is similar to how What2Code – IT Security Blog used ssh within web-browsing session (and later ssh within dns session) now you can take it a step further and use proper http etc but tunnel through jpegs which is being sent back and forth 🙂 (and this way you would be screwed as soon as you let the client use web-browsing as appid)