The first effective JPEG trojan has been posted to USENET. Read about it on slashdot here.
A team at easynews.com has picked the trojan apart, and have even created a PERL script to detect the image:
>@stat = stat($file);
$size = $stat[7];
open HANDLE, $file;
sysread(HANDLE, $input, $size);
close HANDLE;
if ($input !~ /^\xff\xd8/) {
print "not a jpeg\n";
exit;
}
if ($input =~ /\xff\xfe\x00[\x00\x01]/s) {
@debug = `djpeg -debug $file 2>&1 > /dev/null`;
if (grep (/Comment, length \-*[01]:/i, @debug)) {
print "jpeg has trojan\n";