圖示木馬：通過ICO透明通道實現的可執行文件隱寫術

Favicon Trojans: Executable Steganography Via Ico Alpha Channel Exploitation

July 11, 2025

作者: David Noever, Forrest McKee

cs.AI

摘要

本文提出了一種新穎的可執行隱寫術方法，利用ICO圖像文件的Alpha透明層在網頁瀏覽器中嵌入並傳遞自解壓的JavaScript有效載荷。通過針對非透明Alpha層圖像值的最低有效位（LSB），該方法成功地在favicon圖像中隱藏了壓縮的JavaScript代碼，而不影響視覺保真度。全球網絡流量每天加載2940億個favicon，消耗0.9拍字節的網絡帶寬。概念驗證實現表明，一個64x64的ICO圖像可以嵌入最多512字節的未壓縮數據，或在使用輕量級雙重壓縮時嵌入0.8千字節。在頁面加載時，瀏覽器作為標準行為的一部分獲取favicon，允許嵌入的加載腳本使用原生JavaScript API和畫布像素訪問在內存中提取並執行有效載荷。這創建了一個兩階段的隱蔽通道，無需額外的網絡或用戶請求。在多個瀏覽器的桌面和移動環境中的測試確認了嵌入腳本的成功且無聲的執行。我們評估了威脅模型，將其與規避基於favicon檢測的多態釣魚攻擊相關聯，並分析了對內容安全策略和防病毒掃描器的規避。我們將九個MITRE ATT&CK框架目標映射到單行JavaScript，以在ICO文件中任意執行。現有的隱寫分析和消毒防禦被討論，突出了在檢測或中和Alpha通道利用方面的局限性。結果展示了一個隱蔽且可重用的攻擊面，模糊了靜態圖像和可執行內容之間的傳統界限。由於現代瀏覽器在開發者特別未能加載ICO文件時報告無聲錯誤，這個攻擊面提供了一個有趣的例子，說明了必要的網絡行為反過來會損害安全性。

English

This paper presents a novel method of executable steganography using the alpha transparency layer of ICO image files to embed and deliver self-decompressing JavaScript payloads within web browsers. By targeting the least significant bit (LSB) of non-transparent alpha layer image values, the proposed method successfully conceals compressed JavaScript code inside a favicon image without affecting visual fidelity. Global web traffic loads 294 billion favicons daily and consume 0.9 petabytes of network bandwidth. A proof-of-concept implementation demonstrates that a 64x64 ICO image can embed up to 512 bytes uncompressed, or 0.8 kilobyte when using lightweight two-fold compression. On page load, a browser fetches the favicon as part of standard behavior, allowing an embedded loader script to extract and execute the payload entirely in memory using native JavaScript APIs and canvas pixel access. This creates a two-stage covert channel requiring no additional network or user requests. Testing across multiple browsers in both desktop and mobile environments confirms successful and silent execution of the embedded script. We evaluate the threat model, relate it to polymorphic phishing attacks that evade favicon-based detection, and analyze evasion of content security policies and antivirus scanners. We map nine example MITRE ATT&CK Framework objectives to single line JavaScript to execute arbitrarily in ICO files. Existing steganalysis and sanitization defenses are discussed, highlighting limitations in detecting or neutralizing alpha-channel exploits. The results demonstrate a stealthy and reusable attack surface that blurs traditional boundaries between static images and executable content. Because modern browsers report silent errors when developers specifically fail to load ICO files, this attack surface offers an interesting example of required web behaviors that in turn compromise security.