Linux got Hacked with this AI image!

Key Takeaways

Now, many of you commented on my previous video. How is this even possible? So, in this video, I'm going to demonstrate how easy it is to create a polyglot file using chat GBT to help you along the way. ChatGBT can actually create the file for you, but I'm going to show you step by step how you can do this yourself and demonstrate how a polyglot file can appear as a pretty image of a panda, but can also have malicious intent behind it by running code. In this example, we'll use something that is non-malicious, just a safe demonstration of how to use an image file like this where it can act as a different type of file. In this example, as a zip file. Hopefully, this answers the questions and hopefully this shows you how easy it is to create a polyglot file. Now, this video has got two parts. I'm going to talk about how this AI generated malware was used to hack Linux, but I'm also going to show you how you can use chat GPT to create your own image as well as your own polyglot file. So, I'm using chat GPT5 here, recently released. I've created a cute panda image and then I asked ChatGpt some information about what a polyglot file is and then how to create one. So I'll go through this and show you manually how to create your own JPEG image and show you how we can make it act like a zip file as well. So polyglot file. Jump to this timestamp if all you're interested in is the demo. Otherwise continue watching where I give you a quick overview of this hack and then show you how to create a file yourself. Now, just for any YouTube moderators or any moderators watching this video, we are going to create a safe polyglot file as a demonstration. So, there's no hack here. We're simply going to create a JPEG file that also has a hidden zip file that we can extract and then read a text file. So, there's nothing malicious here. But, this has been used in the wild to attack Linux. A hack of location data company Gravy Analytics has revealed which apps knowingly or not are being used to collect your information behind the scenes. So this data broker was hacked. Information was leaked on the dark web. Thousands of applications Candy Crush, Tinder, My Fitness Pal, etc. are being hijacked to find out your location. And I mean it just gets worse. House passes bill to prevent the sale of personal data to foreign adversaries. So, the bill bans data brokers from selling Americans personal information to countries like China, Russia, North Korea, and Iran. Okay, those countries are banned. But where's your data actually going? This is from Wyatt, a Catholic priest resigned from the church after Catholic news site The Pillar outed him by purchasing location data from a data broker on his usage of Grinder. These dodgy data brokers are collecting huge amounts of data about you. your location information, your name, your address, lots of personal data about you. And then that data is simply being sold to, you know, who knows who, news organizations, advertisers, etc., etc. And then these companies get hacked and the data gets leaked on the dark web. And that can be used by anyone. If data brokers don't have access to your data, then they can't be hacked and your data leaked or given away or purchased. So the starting point is don't allow them to have your data. And this is why I use delete me. Delete me make this process very simple. You can fill in some personal information like your name, your address, other information. And then they get data brokers to remove that data automatically. Here's a list from delete me of 750 plus data brokers. I mean there's many many of these data brokers. I don't have the time to go and manually remove this constantly because your data may be removed today but may be added tomorrow. But delete me makes this process very simple. They constantly monitor this information and then they give you a report showing you which data brokers your data was removed from. This doesn't just apply to you. It can also apply to your family. So you can pay delete me to remove your personal data but also the data of your family members. I think the less data that companies such as data brokers have about me, the better. I'm pretty sure you agree because your data is not being used for your benefit. It's being used for the benefit of others like advertisers and governments. If you want to take back your privacy, either go and manually remove your data, a lot of work, or join delete me. You can use the link below, join deleteme.com/bomble to get 20% off and get your data removed from these data brokers. If your data is not collected, it can't be stolen. It can't be sold. So, get your data removed by joining Delete Me. I really want to thank Delete Me for sponsoring this video and supporting my channel and also for helping protect both me and my family by removing our data from data broker websites. What does this look like? Just looks like an AI generated image of a panda, right? But actually, it's AI generated malware hiding in panda images that results in a persistent Linux threat. So, forgive my pronunciation. A sophisticated Linux threat shows clear signs of AI assisted development likely with help from large language models with modular payloads, evasive rootkits, and delivery through weaponized image files. Kosski represents a new breed of persistent and adaptable malware built for one purpose crypto mining. It is a warning of what is to come. So, this is from Aquasc. Their blog goes into a lot of detail showing you how the attack is launched initially. So remote code execution on misconfigured Jupyter Labs and then images are downloaded from legitimate places. So storage platforms such as free image, post image and OVH images. What they're doing is delivering code through an image because they are doing their payload delivery via polyglot abuse. This is not steography, but rather polyglot file abuse or malicious file embedding. This technique uses a valid JPEG image with malicious shell code hidden at the end. The whole idea with polyglot abuse is if you look at the image, it's just going to look like a normal image, but if an application loads it, it's going to execute payloads. It's a dual use file that evades detection by blending image data with executable payloads. So this is what the payload would look like. So this is the image file with initial bytes as JPEG ending and executable shell code. The whole idea here is you could have a single file. As an example, if you run it on Windows, it would run the Windows installer, but if you're using a Java application, it would run a Java installer. Now, a file is a valid polyglot file if it can be successfully interpreted by multiple interpreting programs. For example, a PDF zip polylot might be opened by both a valid PDF document and decompressed as a valid zip archive. To maintain validity across interpreting programs, one must ensure that constructs specific to one interpreter are not interpreted by the other and vice versa. These have been around for a long time and have been used in hacker culture since the 1990s. We have an AI created image, but it's a polyglot image file where it shows as an image when you view it, but when an application runs it, it's going to run malicious code. Notice a web hosted image contains malicious C code or malicious shell code that does something on the targeted system. As an example, downloading crypto miners. So, I asked ChatGpt, in this case, ChatGBT5, what is a polyglot file? And we told a polyglot file is a single file that's valid in one or more format or programming language at the same time. Meaning two or more different passes can read it and interpret it differently but still see it as a valid file in their own format. Think of it as a bilingual pun. One sentence that makes complete sense in English and French but with different meaning in each. Okay. So there's more information about it here. Here are some examples. PDF plus zip, GIF plus JavaScript, and there's quite a few options here. What we're going to do is use JPEG plus zip. Now, chat GPT continues about why it matters. And here's the big reason and why it was exploited in the wild. Polyglots can bypass file type checks, an upload filter that only allows JPEG might let through a JPEG plus PHP polyglot. That's actually executable code. And that's exactly what happened here. So chat GPT then asks if we want a walk through of a simple PDF plus zip polyglot file and then I got it to do that. I'm going to skip most of this because I want to show you how to do it with an image. So I told it to create a safe demonstration. Remember safe for all the moderators watching that is a cute panda JPEG image but also contains a zip file. And then I was able to download that. Now this is what it gave me. Not very nice to be honest. So the file it gave me is this Panda polyglot JPEG file. So you can see the image isn't very nice. A very basic picture. But if I open it up, notice there is the JPEG image. But if I go to my downloads folder and go to polyglot demo and then polyglot because that's where the file is and I look at this image here and use unzip to look at that image. So in other words, run this command in bash. So unzip polyglot jpeg. It's already seeing a file because it wants to overwrite the secret.ext file. I'll just say yes to replace it. So it's extracted this file here. And if I cat that file, so cat secret.ext. Notice it says you found the hidden panda treasure. So if I do lice again and let's delete those files. So, rm secret.ext rm secret1.ext. So, I'll just delete both those files. Notice there's a zip file here, but there is no secret.ext file. So, again, that's the very boring image that chatgbt gave me. And if I unzip that file, notice we are told that the a secret.ext file has been extracted. And you can see that there. And if I cat that file, notice you found the hidden panda treasure with a little image there. So that's what chat GPT gave us. I asked ChatGpt to create a cute JPEG image of a panda and it created this image. I didn't like that. So I told it to make a new image more like the image that the hackers created. So this is the image that they created again. So, I told chat GPD to look at that image and create something similar to that and it gave me a bunch of text and I told it to create the image and there you go. That's how I got this image and I downloaded it and was able to use it as part of this demonstration. So, I got chat GBT to create the image. I got ChatGpt to help me create the code for a JPEG and zip file demonstration. Now it looks like again that these hackers used an LLM to run this attack and they have this Panda image that contains malicious shell code as well as this file that contains malicious C code. So C and shell code was used there. The idea here is that we have an image file. So notice cat panda JPEG and then it has some code at the end. That's what they were using. If I cat the panda polyglot JPEG image, you'll notice it's got a whole bunch of image data here. So, here's a bunch of image data. But if I go right to the end, notice it says here secret text. You found the hidden panda treasure. So, at the end of the image is this file that can be unzipped. So, this is where ChatGpt is great. I'm going to follow their step-by-step manual to create an image. So they assuming that we have our panda image. Let's go to this demo folder. I've got a chat GPT image one file here and a secret file that has my text in it. So there's my text in my secret file, but I could get it to run bash code as an example. Here's my image. So in my text editor, I'll go back a directory. Clear the screen. So notice I am in the downloads polyglot demo directory. Alice shows me that all I've got is my image and my secret text as we can see over here. So what we're going to do now is create a zip file. So here they are creating the secret text file which I've got already and then we're going to zip that. So zip secret text. So this file here is going to be zipped. ls shows us that we've now got the secret zip file which we didn't have before. We only had those files, but now we've got that as well. Again, zip files here. Now we can combine the image and the zip file together. Back in this directory, you can see we've only got the chat GPT image secret and zip file. So all we need to do now is cat those together and put them into a new file. So simply use cat chat GPT image secret zip. And I'm going to put it into panda demo 1 jpg. And there you go. So ls shows us that we've got this image here. Back over here, you can see that's created. Double click on that. There's our little cute panda. So panda exists. So when you look at the file with an image program, it shows up as a cute panda. Simple as that. But if I use unzip panda demo1.jpeg, we told do you want to override the secret.ext file. So I'm going to say rename for this example. And I'm going to rename it as secret one.ext. That's now being extracted. So previously we had secret over there, but we've also got secret one. Now if I cat that file, secret one.ext, text. Notice we have our secret message right over there. So if I cat the Panda demo one JPEG. It's a big image file, but right at the end here, notice the zip file information is available there. So the JPEG software is only going to look at the JPEG part of the image. The unzip file looks at the end of the image and can unzip the file. Now Chat GBD very kindly shows us why this works. JPEG decoders stop reading after the end of image marker FFD9 and hex, ignoring anything afterward. Zip decoders locate their central directory by scanning backward from the end of the file. They don't care if there's image data before it. So, both formats live happily in the same file without interfering with one another. Chat GPT also provides this option. You can still edit the JPEG image in an image editor and allow to still work as a zip file which involves placing the zip inside the JPEG comment segments instead of just appending. That's a trick often used in steography challenges. This however isn't that this is a polyglot file. Okay. So I'm hoping that this quick demonstration shows you how a polyglot file actually works and how to create one. I've also shown you how to use chat GPT, in this case, chat GPT5 to help you learn how to create files like this. I actually got ChatGpt to create its own polyglot file, but then I showed you step by step how to do this yourself so that I could use a cute image. And hopefully you can see how to do the same. I did find, however, that the code that they gave me for creating a polyglot file with bash didn't work very well. But it is possible to do this yourself. I simply wanted to show you how to create a polyglot file and explain it practically rather than just reading about it. I'll link the Aqua blog below if you want to get more information about the real world example using polyglot files and how they were able to run malware on Linux computers by downloading an image from an image storage platform. Now, if you enjoyed this video, please consider subscribing to my YouTube channel and liking the video. That really does help me. So many of you who watch my channel are not subscribed.