{"id":52518,"date":"2016-09-09T14:05:20","date_gmt":"2016-09-09T21:05:20","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=52518"},"modified":"2025-08-31T22:12:01","modified_gmt":"2025-09-01T05:12:01","slug":"android-photo-hack","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/mobile-security\/android-photo-hack\/","title":{"rendered":"The Android Photo Hack: A Picture Says a Thousand Commands"},"content":{"rendered":"

Most people have heard the story of the Trojan horse. We\u2019ve learned the moral of that story: don\u2019t trust gifts from strangers. Today, nobody would use a giant horse statue \u2013 except maybe pranksters with a bad sense of humor \u2013 although similar tricks exist in digital form. People are wary of unknown .exe files and sudden downloads from corny pop-up ads. They trust more familiar file types such as .jpg. But in the latest incarnation of the Trojan horse, malicious code can be hidden in images, allowing cybercriminals to take over Android devices<\/a>.<\/p>\n

Google moves quick and has already issued an Android update. Once those software changes occur on a device, this loophole will be resolved. Another positive, this tactic hasn\u2019t been found in common use \u2013 it was a discovery by cybersecurity researcher Tim Strazzere. So ultimately, the photo hack is not<\/em> a widespread threat. But people should be aware and educated nonetheless. Understanding how cybercriminals act is the first step to knowing how to stay safe online.<\/p>\n

Truth be told, hiding malicious code in other forms isn\u2019t a new tactic. Crooks have concocted all manner of disguises. Infected Microsoft Word documents<\/a> have even been found. When users launch these infected files on their PC, malware is installed to steal sensitive information. The photo method is only the latest in this context.<\/p>\n

What\u2019s unique in this case is the caveat that villains can get their way without images being clicked on. Let\u2019s jump into brief technical details to explain how. When photos are sent to your Android device, some of that data is processed before users open the file<\/a>. This is known as parsing <\/em>in computer terms: the unpacking and separating of information. See, smartphones need to know what data to process when users open a file. But first, they must look at other data to understand the nature of the file type. That\u2019s where cybercriminals could package secret instructions to be triggered from the get-go.<\/p>\n

What happens then? Well, the malware can \u201cbrick\u201d users\u2019 devices, meaning they are rendered unusable. Cybercriminals then gain remote access to the smartphone. With all the sensitive information our devices now store, crooks could snatch quite a bit! Think of all those financial details, passwords for online accounts, and emails. Additionally, perpetrators could even use the phone\u2019s applications to their gain, and the user\u2019s expense.<\/p>\n

Now remember, Google already issued an Android update to combat this \u2013 so there\u2019s no need to panic. The threat, however, should open some people\u2019s eyes. A range of sneaky threats exist out there, and education is key. This won\u2019t be the last reincarnation of the Trojan horse. But with the right security knowledge, people can help to keep themselves safe in our digital age.<\/p>\n

Three Cybersecurity Tips to Keep in Mind<\/h2>\n

With that in mind, here are three cybersecurity tips to act on:<\/p>\n