Users question JPEG virus; McAfee stands firm

IDG News Service - Users and antivirus vendors are questioning the seriousness of a virus announced last week by McAfee Security, a division of Santa Clara, Calif.-based Network Associates Inc., as well as the manner in which McAfee doled out details about the virus.
On June 13, McAfee issued a press release about the W32/Perrun virus, which it said is the first virus to infect JPEGs, a type of image file (see story). Perrun, which McAfee received from its author, uses an executable file to infect image files and then tries to spread the infection to other image files in the same directory, according to McAfee. The virus requires the presence of the executable and can't work without it, McAfee said.
The discovery of the virus could lead to the rearchitecting of antivirus programs, as well as possible mutations in which the virus would be executable embedded in image files and on the Web, said Vincent Gullotto, senior director of McAfee's Anti-Virus Emergency Response Team.
Since McAfee's original announcement of the virus, users on Web pages and e-mail lists have disputed Gullotto's statement that executable files could be embedded in JPEGs.
"Viruses are more than just pieces of self-replicating code; they need to be delivered in such a way that causes them to be executed," wrote Kevin Austin, assistant professor of computer science at Fitchburg State College in Fitchburg, Mass., in an e-mail to the IDG News Service. "JPEG files are never executed. They are instead opened as data files by application programs." Applications don't look for executable code in data files, and therefore wouldn't run it, he explained.
Images that contain executable code would either appear damaged or wouldn't open at all when double-clicked, wrote David Stidolph, a programmer and consultant based in Austin, Texas, in another e-mail to the IDG News Service.
"Images may or may not appear 'damaged,' but in no case will any of the picture code be executed, so you could never replicate a virus this way," he wrote.
Even some of Gullotto's colleague's in the antivirus field disagree with him. Abingdon, England-based Sophos PLC, an antivirus firm that competes with McAfee, issued a press release discounting the seriousness of the virus. Sophos had the virus in its labs two days before McAfee announced its existence, but the firm chose not to say anything because the virus was "really just a proof of concept ... a real non-event," Chris Wraight, technology consultant at Sophos, said in an interview Friday.
However, Gullotto isn't backing down from McAfee's original warning. McAfee "still [stands] behind what it was we said," he said Friday.
The original virus warning wasn't about the immediate threat posed by Perrun, which is tiny, but rather about the possibility that future changes in software and technology could cause greater problems, he said.
Gullotto acknowledged that embedding an executable file into a JPEG "probably wouldn't work today, as things are," but stressed that McAfee's "concerns are still more so for the future." Because of the changes made to software and file types, the ability to run executables could be added to image and other data files, which could make this virus a problem, he said.
"I'm only saying what possibly may exist if the technology moves in that direction," he said. McAfee has to keep an eye on possible developments in order to keep its customers apprised of potential vulnerabilities, he said.
The way McAfee went about warning users in this case -- saying that a large number of data types could eventually be unsafe -- was a problem, said Wraight.
"The other companies have been more prone to hype viruses to get attention and sales [than Sophos]. We just, as a company, don't act that way," he said, calling it "an approach we don't subscribe to."
Gullotto reaffirmed his support for McAfee's handling of the matter but said that "there are clearly some disagreements in the antivirus industry."
The disagreements can run deep and have serious consequences, Wraight said.
Hyping viruses unnecessarily "hurts the industry as a whole," he said. "[It] runs the risk of breeding complacency with users" so they don't pay attention during actual, serious outbreaks, he said.