Hiding Malware in SVGs: A New Threat to NFTs

With Non-Fungible Tokens (NFTs) such as digital art, collectibles and other digital assets, we're seeing not only innovative applications, but also emerging threats. One of the most concerning developments we've discovered is a previously unseen phenomenon: smuggling malware into SVG files (Scalable Vector Graphics), which allows malicious actors to hide harmful code, unnoticed, inside seemingly innocent images.

What Is Malware Smuggling in SVGs?

SVG-smuggling is een exploit techniek waarbij kwaadaardige code (malware) in de code wordt gestopt in bestandstypen die normaal gesproken als veilig worden beschouwd. SVG's zijn bijzonder aantrekkelijk voor cybercriminelen omdat ze zowel beeld- als code-elementen kunnen bevatten. Door bijvoorbeeld JavaScript te embedden, kunnen aanvallers schadelijke scripts verbergen die worden geactiveerd wanneer de SVG wordt geopend of weergegeven in een webbrowser. Hieronder een voorbeeld van een geïnfecteerde SVG:

SVG-Smuggler: We created this Python script, which encodes a file into a Base64 string and embeds it in an SVG file. When the SVG is opened in a web browser, the script automatically triggers a download of the original file.

Why NFTs Are an Ideal Way to Distribute Malware

SVG-smuggling is een redelijk onbekend fenomeen, helemaal de combinatie NFT's hebben wij nog niet eerder gezien. NFT's, die vaak op blockchain-platforms zoals Ethereum worden gehost, bieden een uniek voordeel voor cybercriminelen:1. Onuitwisbaarheid: Zodra een NFT is geüpload naar de blockchain, kan deze niet meer worden verwijderd. Dit betekent dat de ingebedde malware permanent beschikbaar blijft, zelfs als de oorspronkelijke maker de NFT probeert te verwijderen.2. Anonimiteit: Blockchain-transacties zijn pseudoniem, waardoor het moeilijk is om de identiteit van de aanvaller te traceren.3. Verspreiding: NFT's worden vaak gedeeld en verhandeld op verschillende marktplaatsen, wat de verspreiding van de geïnfecteerde SVG vergroot.

How Does Deploying an NFT with an SVG Malware Payload Work?

After creating an SVG file with a payload, this file can be uploaded to an NFT marketplace. When a user opens the NFT, the embedded malware is automatically downloaded and can be executed. We built the Solidity smart contract for deploying the NFT containing the malicious SVG, which can be found below.

pragma solidity ^0.8.26; import {ERC721} from "@openzeppelin/contracts/token/ERC721/ERC721.sol"; import {Base64} from "@openzeppelin/contracts/utils/Base64.sol"; contract PoCSVG is ERC721 { struct Poc { string name; string description; } uint256 private s_tokenCounter; string private s_pocSvgImageUri; mapping(uint256 => Poc) public s_tokenIdToPoc; constructor(string memory pocSvgImageUri) ERC721("PoCSVG", "SVG") { s_tokenCounter = 0; s_pocSvgImageUri = pocSvgImageUri; } function mint() public { _safeMint(msg.sender, s_tokenCounter); s_tokenCounter++; } function _baseURI() internal pure override returns (string memory) { return "data:application/json;base64,"; } function tokenURI(uint256 tokenID) public view override returns (string memory) { string memory imageURI = s_pocSvgImageUri; return string( abi.encodePacked( _baseURI(), Base64.encode( bytes( abi.encodePacked( '{"name":"', name(), '", "description":"NFT with a PoC SVG that downloads files when clicked", ', '"image":"', imageURI, '"}' ) ) ) ) ); } }

This script uploads the SVG file to the blockchain. The script below handles the creation of the NFT collection and the insertion of the SVG:

pragma solidity ^0.8.26; import {Script} from "forge-std/Script.sol"; import {PoCSVG} from "src/PocSvg.sol"; import "forge-std/console2.sol"; import {Base64} from "@openzeppelin/contracts/utils/Base64.sol"; contract DeployPocSVG is Script { function run() external returns (PoCSVG) { string memory PoC = vm.readFile("./img/poc.svg"); vm.startBroadcast(); PoCSVG pocSvg = new PoCSVG(svgToImageURI(PoC)); pocSvg.mint(); vm.stopBroadcast(); return pocSvg; } function svgToImageURI(string memory _svg) public pure returns (string memory) { string memory baseURL = "data:image/svg+xml;base64,"; string memory svgBase64Encoded = Base64.encode(bytes(string(abi.encodePacked(_svg)))); return string(abi.encodePacked(baseURL, svgBase64Encoded)); } }

Link to the full repository and explanation can be found here: Malicious-NFT

A LIVE Proof of Concept

For this proof of concept, we created a live proof of concept on OpenSea. As soon as a user opens the NFT, the embedded (fake) malware is automatically downloaded and could potentially be executed.

https://opensea.io/assets/base/0x5fa7f34b32be7d53396e9d07e2d2a7c59273946c/0

Consequences for the Blockchain and Community

Integrating malware into NFTs can have far-reaching consequences: 1. Security risks: Users can unwittingly download malware and carry out social engineering actions, which can lead to data theft, compromise of someone's wallet, system infiltration and other harmful activities. 2. Loss of trust: Increasing security incidents can undermine trust in NFT platforms, which can harm the market as a whole.

Conclusion and Proofs of Concept

Smuggling malware into SVGs is a new and still little-known threat within the NFT world. As the popularity of NFTs is likely to keep rising, both developers and users need to take proactive steps to safeguard security and protect the integrity of blockchain platforms. Through awareness, advanced security tools and continuous vigilance, we can address this threat and promote a safer digital future.

For more complete documentation and information:

1. SVG-Smuggler: This Python script encodes a file into a Base64 string and embeds it in an SVG file. When the SVG is opened in a web browser, the script automatically triggers a download of the original file.

2. Malicious-NFT: This repository shows how a malicious SVG can be uploaded to the blockchain as an NFT. When a user opens the NFT, the embedded malware is automatically downloaded and could potentially be executed.

3. Live Malware NFT Demo: The first SVG malware PoC on the blockchain

Stay Up to Date on Cyber Risks!

Every week, our hackers share their knowledge and expertise. By signing up for the Vulnerability Update, you'll receive a weekly tip from an ethical hacker about vulnerabilities in software and systems. By understanding how attackers view your organization, we hope to help you further in the world of cyber security. Want to read this kind of blog every week? Sign up below!

But if you want to know more about structurally exposing vulnerabilities in software and systems, read more about our Hacking as a Service solution. Besides regular pentesting, we also offer a security monitoring tool that scans your web applications and/or internal network daily for these numerous CVEs.

Or read more about Hacking as a Service >>