What is a PolyGlot file? Also, what are those OT security risks?

summary

System integrators, service providers, and essentially the professionals responsible for protecting industrial automation and control systems (IACs) are flooded with an evolving, sophisticated cyber threat. Malicious actors are constantly exploring innovative and secret ways to compromise systems and networks by bypassing traditional security measures, and one lesser known exploitation tactic is the use of polyglot files.

These files are particularly insidious challenges for organizations managing critical operational infrastructure. If these files are seemingly exploited, they can open the door to a set of vulnerabilities that tend to create false impressions and assumptions about format identification and compromise.

With that in mind, it is essential to investigate the severity and risk mitigation measures of the polyglot file needed to prevent exploitation.

What is a polyglot file?

Polyglot files exist as a single file, but can be effectively interpreted as several different file formats. The term “polyglot” historically referred to multilingual speakers that adapt communication to a wide range of audiences. PolyGlot files exist differently depending on the application used to open them. For example, a single file might display images when opened in a photoviewing application, but it runs a malicious script when handled by another application.

Due to structural differences in specifications for each file type, there is a duality of polyglot files. Many formats allow for flexible placement of header identifiers within the file’s memory space, allowing other file headers to be fully embedded within the file.

Depending on the specification of the inserted secondary file type, most security systems simply inspect the file type. Polyglots are attached to the specifications of host files, so they are not always flagged as corrupt, compromised or unusual. Many systems are usually categorized based on the most obvious indicators, such as file extensions and byte values, but polyglots contain multiple valid entries and headers. This makes it easier for hidden and suspicious content to be overlooked.

Types of polyglots

PolyGlot files have different markup and sophistication depending on how embedded file types are integrated within the host file and compatibility with existing formats.

Stacked polyglot: If files are “stacked” or layered above each other. This type of polyglot is limited to formats that read from bottom to top, such as ZIP archives (as noted in the case of Phantompyramid). This means that an attacker can add malicious content to an otherwise harmless file. Parasite polygrat: If a secondary file is embedded in the structure markup of the host file. This technique rarely uses metadata fields (such as UTF-8 text comment segments). Zipper Polyglots: A more advanced type of parasite polyglot. Both file types embed each other’s data blocks within the existing comment section. Cavity polyglot: If malicious code is impersonated as an innocent file, it is embedded in raw memory space within the file’s structure. These take advantage of the file processing gap.

Impact on cybersecurity

In an IT environment, polyglot files pose a serious risk that traditional security measures are not always isolated. Those risks become even more complicated when the OT environment is exposed. Industrial control systems often rely on human machine interfaces (HMIs) or engineering workstations to handle these seemingly harmless files, which can cause malicious code to be executed by mistake.

If the OT network is not properly segmented, it can be susceptible to further infection and damage from one compromised workstation. The impact can be particularly severe if an attacker accesses a programmable logic controller (PLCS), distributed control system (DCS), or supervisory control and data collection (SCADA) system by moving the network laterally.

OT documents and system diagrams may depend on different types of image file formats. These formats are particularly vulnerable to external threat actors who can leverage metadata and Exif structures to embed malicious payloads and comment fields without affecting the legitimacy of files on the surface. Social engineering tactics are commonly deployed when distributing malicious polyglot files, with the general attack vectors being:

A phishing campaign targeting engineers with legitimate system updates or technical documentation. The document contains extract scripts that attack man-in-the-middle (MITM) attacks, whereas images look superficially legal.

The effectiveness and overall severity of polyglot cyberattacks is often driven by an inherent lack of awareness, training, and recognition ability when identifying split payload attacks.

OT Security Detection and Prevention Strategy

It is naive to ignore the possibility of polyglot files attacks. Therefore, organizations need to go beyond standard antivirus and endpoint detection systems to confront polyglot files. Although it may analyze files based on format and trigger alerts, if polyglot files exist as benign images or documents, such protection software may not intuitively examine or scan the built-in secondary format.

Organizations can implement several defensive measures to mitigate the risk of polyglot files.

Enhanced File Verification Process File Verification Process Zero Trust Philosophy, which examines files in multiple format indicators (e.g., file headers, metadata, distribution patterns analysis) is a zero trust philosophy that encourages malicious analysis and disinfection before entering environmental network segmentation, before entering environmental network segmentation, before entering environmental network segmentation, to isolate critical systems, to isolate critical systems, to isolate critical systems, to isolate critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine critical systems, to quarantine them. Audit and training to assess security etiquette, attitudes and response strategies for these and similar advanced security threats

As threat actors continue to develop new polyglot file compromise techniques, maintaining vigilance and adaptability in detection and response remains essential to maintaining environmental integrity.


This article was originally published on the ISAGCA blog. Subscribe to receive regular emails with links to thought leadership, research and other insights from the Sound Cybersecurity Community.