1

This tutorial explains how you can "hide" an archive file like .zip inside an image file by using the command:

copy /b image.jpg + hide.zip output.jpg

Doing so allows you to right click output.jpg and just open it with winzip to read the archive. I know it's not an alternative for real encryption, but still this technique might be useful. What I want to know is what other file types does this technique work with? Any ideas?

  • Do you want the file to work after adding the archive file? Does your jpg work after doing the above? – schroeder Mar 6 '17 at 9:34
2

It depends on what you mean with hiding: if you just want to hide it for transport and later strip the image again then you can do it with any file type. If instead you want to create a polyglot, i.e. a file which is both a valid image and a valid different file type at the same time, then you are restricted to types which either allow junk data at the beginning or where a valid image is a valid beginning of the file too. For example both the ZIP and the PDF standard accept junk data at the beginning although not all actual implementations accept this. And this way they can be combined into a polyglot with another file format which accepts junk at the end, like several image formats but also gzip compressed data.

I don't know of a comprehensive list of all ways file formats can be combined this way. But a classic example of an attack using such polyglot is Gifar which combines GIF and JAR into a single file to bypass restrictions. And many examples of interesting polyglots can be found in the Funky File Formats talk from 31c3.

0

Any file type. This is basically primitive steganography. The file extension plays no role other than to confuse a viewer. It can be anything: .eeks, .dee, .help,.png.

  • Not primitive stenography, just files added one after another. – Overmind Mar 6 '17 at 9:26
  • @Overmind I think he means that you change the file extension to something else. – schroeder Mar 6 '17 at 9:33
  • With a random extension, in that case, image will fail to display by any normal OS/readers but archive reading would still work. – Overmind Mar 6 '17 at 9:35
  • @overmind - OP just wanted to know what other file extensions this was possible with. The answer is all of them. – thel3l Mar 6 '17 at 9:42
  • Of course you can train-copy any files, but how the result is interpreted is a matter of that files are there and what interprets them so that's not at all 'all'. – Overmind Mar 6 '17 at 9:45
0

Many file types can just be copied in continuation of a basic file. Nothing special here.

It's up to the file interpreter to detect the actual content.

In your case (JPEG + ZIP), most image readers (image interpreters) will correctly display the image file since the content is complete and ignore the rest (the ZIP at the end) as junk/metadata.

The ZIP extractors (archive interpreters) will search for the archive specific tag types. When they find it somewhere in the file, they will know an archive is there. The archive extractors this time will ignore what is not indexed by the archive system as metadata and read the indexed content, so that is why this trick actually works.

Basically, appending any file type to the JPEG will still display it when viewed, but for the rest of the content (what files you add after) it's a matter of what and how interprets them.

  • 2
    Actually ZIP extractors don't look for the beginning of the ZIP file but they got to the end of the file where the central directory is and from there they can compute where all the data start, and thus will ignore any junk at the beginning. See en.wikipedia.org/wiki/Zip_(file_format) – Steffen Ullrich Mar 6 '17 at 9:34
  • ZIP yes, others place their tag differently. They still look for that, no matter where it is. I have updated so it will be more clear. – Overmind Mar 6 '17 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.