SoBig.F May Prove The Seriousness of JPEG Viruses

Last year, NAI McAfee made some news by reporting a new virus called "PERRUN" that infected JPEG image files. This virus could only infect a machine that had already been infected with another "primary" virus. The primary virus would intercept the JPEG before it was displayed, and extract and executing the secondary virus. The secondary virus could then go about it's business of attaching copies of itself to more JPEGs, emailing itself, etc. Because spread of the virus required a previous infection to begin with, lots of people considered it to be a low-grade threat.

Now it is being reported that SoBig.F may have originated as a JPEG posted to several Usenet groups. The reports I've seen about this so far do not clarify whether the technique used for this required a previous primary virus infection, or not. I think that's the most likely scenario, but given that at least one buffer overflow vulnerability in JPEG rendering code in Netscape has been reported, it might be possible for someone to have developed code to extract SoBig.F from an infected JPEG even without a pre-existing primary infection being present.

If this all turns out to be true, I think it's frankly the most important part of the SoBig.F story.