Are .png files safe?

[Dracius]

Can any malicious software be piggy-backed on a .png file?

Someone sent me a picture named 'photo.jpg.png' recently, which didn't cause me any immediate alarm because I only saw the .png at first and assumed it was safe.

After I noticed the .jpg on front it made it seem like someone was trying to hide the fact that it was a .png file or it could just be my friend is a complete noob and doesn't know how to convert png files to jpg.

I've scanned it with AVG but nothing is coming up. Computer hasn't been acting weird or anything, but it's the trojans/viruses you don't see that worry me the most.

 

[TechieSooner]

They're both image formats...
And malware can reside in practically anything.

Also, AVG sucks. Get Microsoft Security Essentials or Anti-Vir.

 

[Dracius]

I'm aware they're both image formats, hence why I accepted the file.

The part that makes me curious is the fact that it's a .png saved to look like a .jpg if both carry the same risk factor.

Thank you for the AV advice though, I'll give those (and the ones in the sticky) a whirl when I get home.

 

[TechieSooner]

The latter extension is the only extension that really matters... It's a PNG file.
It could've been converted from JPG to PNG, instead of changing the extension it just appended it.

 

[keenan]

This often happens if someone types .jpg in the file box but leaves PNG selected as the file type; at least MS paint behaves this way, which is annoying - most applications look at the extension you type and select the filetype to match. Also some image viewers will rename the files if they detect the extension is incorrect.

There was a vulnerability in libpng a few years ago IIRC that could cause some kind of problem, might have been remote code execution, but I don't recall exactly. There's no facility for executable code in a PNG or JPG though, so I would say the risk is pretty low, along the same lines as any other non-executable complex filetype. Though PNG is considerably more complex than JPG, so the risk *is* probably higher.

 

[Dracius]

The latter extension is the only extension that really matters... It's a PNG file.

I already knew that, which is why that wasn't part of my question.

I appreciate the info you've provided me and I'm thankful, but it would be nice if you stopped making so many assumptions about my knowledge level and answering questions I didn't ask.

Again, I'm thankful for the quick answer, but that's twice you've provided "answers" for basic knowledge questions that I didn't ask.

 

[Dracius]

This often happens if someone types .jpg in the file box but leaves PNG selected as the file type; at least MS paint behaves this way, which is annoying - most applications look at the extension you type and select the filetype to match. Also some image viewers will rename the files if they detect the extension is incorrect.

There was a vulnerability in libpng a few years ago IIRC that could cause some kind of problem, might have been remote code execution, but I don't recall exactly. There's no facility for executable code in a PNG or JPG though, so I would say the risk is pretty low, along the same lines as any other non-executable complex filetype. Though PNG is considerably more complex than JPG, so the risk *is* probably higher.

Thank you for the detailed response.

This is exactly why I visit these forums.

 

[TechieSooner]

I already knew that, which is why that wasn't part of my question.

I appreciate the info you've provided me and I'm thankful, but it would be nice if you stopped making so many assumptions about my knowledge level and answering questions I didn't ask.

Alright, I'll play along. Let's find the question in your OP:

Can any malicious software be piggy-backed on a .png file?

Answered in my first response:

And malware can reside in practically anything.

Not my issue if you can't read.

 

[drgnfang]

Is your friend new to Win7/Vista? I know several people who didn't realize that by default when you rename a file now it doesn't highlight the extension.