Interesting info about .jpg files!! - Page 1
Forum section: electronics / general

author: GlennSprigg
author_rank: Super Contributor
timestamp: November 27, 2020, 01:29:47 pm
content: I've played around in the past, with something called 'Steganography', and associated software. It's used to 'hide' informationwithin Image files. (Been around for years!). The password protected & encrypted info/files is actually hiddenquite cleverly, bymodifying the actualpixelcolors by small unnoticeable amounts, to secretly package the hidden data.But this is different!!...I found out recently that JPEG images have always had the ability, at least in Windows), to have.zip&.rarfiles stored within them!!However, I do not know how the data is interlaced, or appended. (I have an example below for you...). Here's how it is done...Place a.jpgimage in a directory. Then place an 'archived' file in that same directory. Technically, it works with .ZIP & .RAR files,but .RAR was proven to be less problematic, so it is what I have used in my example, further below.First, open a DOS style 'Command' Prompt. (cmd.exe). To make things easier, type 'CD\' to go back to the Root Directory, andthen type 'CD foldernamepath' to go to where you stored the Image & Compressed file you want to use. Now the fun part...typecopy /b myphotoname.jpg + myarchivefile.rar modphotoname.jpgand hit Enter.(The '/b' option specifies that it is or could be a Binary file).Anew 'image'file is created, which contains thehidden embedded .rarfile! Below, is one I've created...Download/Copy this image to your computer. Now either Right-Click on it within Windows File Explorer, and select 'Open-With',and select the temp option as being 'WinRar.exe', or 1st run WinRar, and then 'Open', but change to 'All Files', and select thisphoto, and you will see that there is a 'hidden file' within, called 'Jokes.txt'. Which you can extract, like usual!!I thought I would also mention about photographic 'EXIF' information within most image files !!!...Virtually all digital cameras store MUCH more info than most people realize, within their images! (Exchangeable Image File format).This is also specially embedded within most images, and is helpful, but often says more than you may want to make public!!Virtually all decent Software can access and show this information. Even'Windows' itself, can, by Right-Clicking on such a .JPGand selecting 'Properties', and then the 'Details' Tab, and scrolling down. You would be surprised what some 'Camera' systemscan show/reveal about such photos! To edit/delete such info, usually requires special, and usually 'free' software.Many other specialized Graphics Software packages, like 'Photo-Reactor' etc, also utilize this Image Data Embedding ability, tostore all their Data/Flows within, so that the information is usable/reclaimable to apply to OTHER photos etc...The point being, that an 'Image' may NOT be what it seems!! Have fun!

author: GlennSprigg
author_rank: Super Contributor
timestamp: November 27, 2020, 01:40:19 pm
content: Hmmm!!!...I just tried downloading the above pic myself, and it didn't work!!!This forum or 'imgur' must have changed the file...Create one yourself though, and you will see !!

author: SilverSolder
author_rank: Super Contributor
timestamp: November 27, 2020, 04:32:56 pm
content: This is a good topic @GlennSprigg.Many people are unaware of the amount of possibly sensitive data in the JPEG tags that they are leaking out when, for example, they upload pictures to Facebook or send via email etc. - many cameras include the GPS coordinates where the picture was taken, for example!

author: madires
author_rank: Super Contributor
timestamp: November 27, 2020, 04:55:09 pm
content: There's much more data you can extract from publicly available files, like office docs or PDFs. One tool for doing that is FOCA (https://github.com/ElevenPaths/FOCA).

author: Mechatrommer
author_rank: Super Contributor
timestamp: November 27, 2020, 05:56:50 pm
content: there is one scene Rat communicated with Josh this way in The Core, i cant find it in youtube. could be the real Al-Qaeda way of sending messages... but not with RAR i guess, that could be a bad hack..https://intelligence-security.rs/assets/img/Steganografija.pdf

author: golden_labels
author_rank: Super Contributor
timestamp: November 27, 2020, 06:15:30 pm
content: This applies not only to JPEG (or, more specifically, JFIF and EXIF), but to many binary formats. Usually binary data contains a header that indicates in some way the range of actual data. Most of software is buggy and ignores everything else instead of at least producing a warning or rejecting the file altogether. Therefore not only JPEG images may contain additional data: you may try appending it to many other formats.Why WinRAR accepts that file is a greater puzzle. My suspicion is that it’s due to its self-extracting archive feature.(1)WinRAR would not run the executable, but instead detect presence of the archive bundled in it. Appending unrelated data after a proper PE file was common back in the day. It’s possible that this is how the archive is detected.Be aware of few things, though:Not being advertised is not the same as being hidden. Steganogaphy hides data in a way that leaves no obvious traces. Detecting it requires pre-existing suspicion to run the right tests. And even them may be inconclusive, in which case it bears the feature of plausible deniability.This is against format specifications. While it may work with many tools, it may produce warnings or errors in other.Files like that may be blocked by anti-spam/anti-virus filters if e.g. sent through email or hosted on the web. And that’s a reasonable procedure.____(1)Yes, a long time someone had that “bright” idea and people were actually using that.

author: Simon
author_rank: Unknown
timestamp: November 27, 2020, 07:12:50 pm
content: Quote from: SilverSolder on November 27, 2020, 04:32:56 pmI believe facebook may strip that out.

author: Mechatrommer
author_rank: Super Contributor
timestamp: November 27, 2020, 07:19:58 pm
content: conversion jpg -> bmp -> jpg will destroy everything other than color informations. well what can you do? people like to selfie than get educated, they get what they not paid for..

author: andersm
author_rank: Super Contributor
timestamp: November 27, 2020, 07:34:57 pm
content: You used to see this sometimes on image boards back in the day. When you saw small images posted that still were several megabytes in size, you knew there was a RAR appended.And as long as the topic is RAR and file format weirdness, I can't resist to bring up that RAR files used to be able to containbytecode for a virtual machine.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 27, 2020, 07:57:29 pm
content: Quote from: Simon on November 27, 2020, 07:12:50 pm...after storing it for their own purposes!

author: golden_labels
author_rank: Super Contributor
timestamp: November 27, 2020, 08:22:13 pm
content: Quote from: Mechatrommer on November 27, 2020, 07:19:58 pmJPEG → BMP → JPEG conversion will destroy much more than the “hidden” data. The second step includes dropping some of the image information. That ranges from losses from sharing CbCr channels between pixels to removing some frequencies, possibly made worse by poor implementation that does lossy conversion between the spatial and the frequency domains. That’s not something that must happen, but very often will.Xkcd 1683makes fun of. In this case one would destroy even proper steganographic data.Non-standard data will be lost in an even simpler scenario. Many tools, that work on such files, will simply not copy it to the modified version.

author: dave j
author_rank: Regular Contributor
timestamp: November 27, 2020, 08:37:26 pm
content: You can do something similar with any file type usingextended attributesandalternate data streams.

author: Gyro
author_rank: Super Contributor
timestamp: November 27, 2020, 08:40:54 pm
content: Grainy pictures? Your payload is too high!

author: Mechatrommer
author_rank: Super Contributor
timestamp: November 27, 2020, 08:43:20 pm
content: Quote from: golden_labels on November 27, 2020, 08:22:13 pmthat must not happen when you want to print building size or 64 bits deep art. jpg may not even be the appropriate format in the first place. but what do you care about countless and worthless 20Mpixels selfies in fartbook? if its up to me i will recompress them to 10% quality jpg for space saving or just delete them entirely from memory.

author: golden_labels
author_rank: Super Contributor
timestamp: November 27, 2020, 10:58:11 pm
content: Quote from: Mechatrommer on November 27, 2020, 08:43:20 pmWithout a doubt you are right. In the general case. That was a reply to a message about losing steganographic data; posted in a thread about hiding data.

author: gorge441
author_rank: Contributor
timestamp: November 28, 2020, 12:21:43 pm
content: Interesting!!!

author: SilverSolder
author_rank: Super Contributor
timestamp: November 28, 2020, 01:31:20 pm
content: This whole thread reminds me of an episode a while back, where it was found that Windows WMF images could contain arbitrary code... and security researchers at the time felt it could only have been intentional!https://www.grc.com/wmf/wmf.htm

author: golden_labels
author_rank: Super Contributor
timestamp: November 28, 2020, 09:11:03 pm
content: If anyone is interested in the topic in a wider context, google for “polyglot files”, “polyglot” in computing and the related terms. That should also shine some light on the security implications of the approach.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: November 28, 2020, 09:47:01 pm
content: Quote from: SilverSolder on November 28, 2020, 01:31:20 pmIn tech support, we closed out the ability for our computers to run any WMF (aka WTF) files, at the registry level. We reasoned some 80% of network sourced malware infections in the 2K's were down to this 'by-design' exploit. Internet radio stations were notorious for streaming WMF files with 'executable' payloads.As for Jpeg, remarkable to think that the Jpeg algorithm is a fourier transform function that compresses and decompresses on most computers in near real time. And let us not forget motion jpeg M-JPEG. Not to be confussed with MPEG.

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 30, 2020, 12:28:25 am
content: Rather than remove the EXIF data, what about replace it with fake but plausible data so whoever tries to collect information from it gets junk?

author: golden_labels
author_rank: Super Contributor
timestamp: November 30, 2020, 12:59:35 pm
content: Why would you do that to anyone? If you don’t want to publish some data, simply don’t publish it. What’s the point of spreading invalid information?

author: SilverSolder
author_rank: Super Contributor
timestamp: November 30, 2020, 01:11:29 pm
content: Quote from: golden_labels on November 30, 2020, 12:59:35 pmIf people choose to spy on you for fun and profit, why make life easier for them than it has to be?

author: Berni
author_rank: Super Contributor
timestamp: November 30, 2020, 01:49:29 pm
content: This will work with most other file formats too.The reason for that is twofold. Most file types out there can be appended past the end of the file with random junk and not care. Its the easiest for a computer to read a file from beginning to end, so most formats read in that order. So its common for file formats to have a small header area that describes what the file is and provides detailed information about what exact format variation is used. For example BMP files contain some fixed fields to identify it as a bitmap followed by the resolution, color depth, compression scheme... So the application just reads the header and then reads enough information to describe the image. If there is too little information then the file is probably incomplete (some apps might refuse to open it, while others might open just part of the image that is there) while they typically just stop reading once it has enough, so who cares if there is extra data there. There are also files that inherently read from start to end like mp3 or mp4, so even if the last half of a mp4 video is corrupt the first half plays back just fine. There are things that make use of it such as ID3 tags in MP3 files that pack extra information and even album art pictures onto the end of a mp3 file.The other half of the reason why this works is that most file compression software is designed to start reading a file at the start and continue reading until it notices something that looks like a zip,rar,tar, 7z etc.. format. So appending an compressed archive to any type of file works (As long as the original file contents don't confuse it, such as appending an archive file to another archive file). The reason for this is yes self extracting archives. So why don't they just put a marker into a self extracting file to tell it where in the file the archive is? Well one reason is that WinRAR wants to be able to open WinZIP self extracting archives and vice versa, but the other reason is that the self exacting archive needs to look like a EXE to Windows. These self extracting archives use the same trick as sticking a ZIP into a JPEG. Its just simply stuck to the end of an EXE file, so when windows reads it it gets a valid EXE header and continues reading the file to load the program into memory, but ignoring the rest since it doesn't know what to do with it. So as far as WinRAR is concerned your weird ZIP inside JPEG is just a weird self extracting archive, maybe its a Apple OSx self extracting archive? Maybe a Linux one? Maybe its an executable for an new OS from the year 2057? Who cares, there is a ZIP file inside and i know how to read those buggers.As far as hiding your files this way, it is not very effective. Any filesystem forensic software will pick these right up and flag them as suspicious file content. If you really wanted to hide data then you would write a piece of software that encodes data into video noise of a huge video file. Video files are the largest lossy compressed piles of data commonly in use by the public. So it is not a suspicious file while giving you plenty of space to encode information by slightly altering the lossy compressed data. Since the video encoder already slightly alters the data to make it more compressible (this is why it is lossy compression) means that it is near impossible to tell if there is data hidden inside.

author: golden_labels
author_rank: Super Contributor
timestamp: November 30, 2020, 07:13:51 pm
content: Quote from: SilverSolder on November 30, 2020, 01:11:29 pmWhy are you assuming that a person reading EXIF metadata is spying on you? In the context of this thread such motivation may be assumed. But if one is following NiHaoMike’s advice, that assumption will be invalid: everyone will be the recipient of such photos, not just the selected subset of people spying on you.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 30, 2020, 07:35:53 pm
content: Quote from: golden_labels on November 30, 2020, 07:13:51 pmThere's no reason to send disinformation to people that you don't mind sharing information with, obviously?

author: golden_labels
author_rank: Super Contributor
timestamp: November 30, 2020, 08:07:16 pm
content: And how do you determine, who at the moment reads the file? And how do you modify the file they have to present garbage to some and non-garbage to others? We do not have self-modifying files that automatically connect to brains and check what are person’s motives. If you put invalid information into the metadata, it is there for everyone, presented to any person indiscriminately.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 30, 2020, 08:36:28 pm
content: Quote from: golden_labels on November 30, 2020, 08:07:16 pmYou don't. So either you trust the entity you send the file to... or you don't.Quote from: golden_labels on November 30, 2020, 08:07:16 pmYou don't. If you don't trust the entity and send garbage, there is no way to undo it - and vice versa.I am not sure I am understanding the point you are making... If I send something to you, and I trust you, why would I put garbage information in the jpeg tags? - conversely, if I distrust you (possibly as a result of knowing what you are up to), why would I voluntarily send you information that is useful to you but harms me?

author: golden_labels
author_rank: Super Contributor
timestamp: November 30, 2020, 08:59:36 pm
content: Why would you send photos specifically to someone you do not trust? My perspective is that we’re talking about EXIF metadata being scraped by third parties from published or transmitted photos, as this is the usual situation.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 30, 2020, 10:59:12 pm
content: Quote from: golden_labels on November 30, 2020, 08:59:36 pmThe world isn't black and white.Let's say you upload a photo to Facebook to share with your family. You trust your family... but you don't trust Facebook. But, since everyone uses FB, you are kind of stuck with it.

author: Berni
author_rank: Super Contributor
timestamp: December 01, 2020, 06:32:01 am
content: Once you post something on any website the file is out there for anyone in the world to access, so you don't have control over who you "give it to" anymore.So if you don't want everyone to internet to know the exact GPS coordinates of your house then you simply remove that information from the JPEG tags. Your friends already know where you live so they don't need it (Nor likely have the technical knowledge to know the data is even there or how to see it). While uploading such a photo to google maps it is useful to have the GPS information in there because the photo just magically pops up in the right place. Keeping GPS data in vacation photos might also be nice so that you can plot your vacation trip on a map and give the photo album more worth for when you flip trough it 30 years later and forget where that photo was taken.Tho most other informationin JPEGs is much more innocent since its stuff like camera shutter speed, iso, whitebalance, datetime (in case the files date time gets lost trough copying and moving around). About the most personal piece of info in there is that it typically contains the phone/cameras model number. Admittedly this stuff is rarely ever useful, but it doesn't really hurt to leave it in.

author: golden_labels
author_rank: Super Contributor
timestamp: December 01, 2020, 03:56:49 pm
content: Quote from: SilverSolder on November 30, 2020, 10:59:12 pmIndeed. Yet my impression is that you draw it as black only and then trying to make exceptions for when you are in white environment.Quote from: SilverSolder on November 30, 2020, 10:59:12 pmExactly. So you have shared the very same files with both groups: your family and Facebook. If you introduce malicious EXIF metadata, you are also doing that to your family.

author: SilverSolder
author_rank: Super Contributor
timestamp: December 01, 2020, 05:36:07 pm
content: Quote from: golden_labels on December 01, 2020, 03:56:49 pmYou are assuming my family cares about the metadata as much as Facebook... I don't think they do!

author: SarahSimm
author_rank: Newbie
timestamp: December 04, 2020, 05:47:56 am
content: wow, that's something new for methanks!