reader comments 5
Share this story

Last May, Ars reported that a critical vulnerability in a widely used image-processing application left a huge number of websites open to attacks that allowed hackers to execute malicious code on the underlying servers. More than five months later, Facebook paid a $40,000 bounty after discovering it was among those at risk.
On Tuesday, researcher Andrey Leonov, said he was able to exploit the vulnerability in the ImageMagick application by using a tunneling technique based on the domain name system that bypassed Facebook firewalls.

The firewalls had successfully protected against his earlier exploit attempts. Large numbers of websites use ImageMagick to quickly resize images uploaded by users.
“I am glad to be the one of those who broke the Facebook,” Leonov wrote in a blog post that gave a blow-by-blow account of how he exploited the ImageMagick vulnerability.

Two days after the researcher privately shared the exploit with Facebook security personnel, they patched their systems.

Ten days after that, they paid Leonov $40,000, one of the biggest bounties Facebook has ever paid.

The vulnerability, which was dubbed ImageTragick by the researchers who first disclosed it, involves the way ImageMagick parses video files with the MVG extension.

Attackers can disguise them as JPG files that contain malformed file paths that allow remote attackers to break out of the image manipulation flow and execute their own shell commands. Within days of the critical vulnerability becoming known, attackers started uploading booby-trapped images to real-world websites in an attempt to exploit the vulnerability, which is indexed as CVE-2016-3714.
It’s surprising that a Web property as careful and security-conscious as Facebook would have remained vulnerable to ImageTragick five months after the critical vulnerability came to light.
It’s possible engineers believed their firewall protections adequately protected against exploits and overlooked the DNS tunneling trick.
It’s not clear if Facebook had installed a patch made available by ImageMagick or followed these suggested guidelines.
In any event, the episode underscores the value of bounty programs, which harness the power of huge numbers of outside researchers.
Several researchers—among them Michael Zalewski in this blog post published in May—have cautioned that ImageMagick, even after the ImageTragick fixes, remains vulnerable to malicious user inputs and should be avoided whenever possible. Other critics include Charlie Miller, the well-known security researcher and white-hat hacker who worked at Twitter for a few years starting in 2012.
In a tweet published Tuesday, he wrote:
“One of my big achievements was getting ImageMagick out of Twitter’s flow.”
Listing image by 401(K) 2012

Leave a Reply