What are Polyglot Files? Is it Legit or Security Threat?

Cybercriminals are always looking for new ways to exploit systems and evade security measures. One emerging technique that is raising concerns is the creation of “polyglot files” – files that are valid in multiple formats. In this post, we’ll look at what exactly polyglot files are, how they work, their legitimate and dangerous uses, and how to identify and block them.

What is a Polyglot File?

A polyglot file is one that is valid in two or more file formats. For example, a file could be both a valid PDF document and a zip archive containing malicious code.

The file is created by combining syntax from multiple formats, using constructs that are either common between them or have different meanings in each language. The result is a file that can be opened by different programs.

Some examples of polyglot files include:

Unfortunately, attackers have started exploiting the fact that the same file contents can be interpreted differently by different programs. This allows them to hide malicious code in an innocent-looking file.

How Do Polyglot Files Work?

Polyglot files manage to fool programs into interpreting them as valid files in multiple formats. This is achieved by carefully constructing the file’s contents to contain the right components for each target format. Let’s look at the techniques used to create effective polyglot files that can bypass security checks.

1. Satisfying Format Rules

All file formats have specific rules that files need to follow to be considered valid. For example, JPEG images must begin with the bytes FF D8 and end with FF D9. PDF documents start with %PDF.

Polyglot files are crafted to satisfy the format rules for each target type. The PDF-Zip polyglot has the %PDF header needed for PDFs, and also contains a valid Zip archive structure later in the file that PDF parsers will ignore.

2. Using Common Syntax

Many formats have common syntax that is interpreted the same way. For example, comments like // are ignored across many languages. Code that’s valid but inert in one format can be used as active code in another. This allows polyglots to contain overlapping content.

3. Conditional Logic

Polyglots may employ conditional logic, so certain sections only execute in one environment. For example, a Python 2-3 polyglot runs print statements in Python 2 and print() functions in Python 3. Each version ignores the syntax meant for the other.

4. Redefining Tokens

Tokens like special characters can be assigned different meanings in different languages. Polyglots can redefine tokens to perform one action in one parser, and a different action in another.

5. Crafting Consistent Metadata

Files contain metadata like timestamps, user permissions, headers and trailers. Polyglots ensure the metadata makes sense for each target format to avoid raising suspicion.

6. Exploiting Weak Validation

Some parsers perform simplistic validation. For example, accepting any file starting with %PDF as PDF. Polyglots take advantage of these weak checks to pass as valid files.

7. Maintaining Separate Components

Polyglots are carefully organized to keep components for each format separate. The PDF parser will only see PDF objects, while the ZIP parser will see an archive structure. This separation is key to cross-format portability.

Through these techniques, polyglots can achieve their deceitful goals. Understanding how they leverage file syntax is key to detecting and blocking them.

Where Can Polyglot Files Be Used?

While polyglot files are concerning from a security perspective, they aren’t entirely malicious. Some creative polyglot uses have legitimate purposes.

Legitimate Uses

One practical use is for cross-compatibility. For example, a Python 2/3 polyglot allows code to work seamlessly in both versions. This makes it easier to transition between versions.

Polyglots can also provide efficiency benefits. The DICOM medical imaging standard embeds images within TIFF files. This saves storage space while retaining full compatibility with DICOM imaging equipment.

For web developers, HTML-XML polyglots can be served as HTML or XHTML, depending on browser support. This provides flexibility.