Questions tagged [image]
For files or formats containing a digital representation of a graphical picture. Not to be confused with [disk-image] or forensic images.
0
votes
2answers
25 views
media uploads and social sites group privacy etc
On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.
...
2
votes
1answer
81 views
Image upload meta information
I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs)..
I remove the exif section of the image for security. However ...
1
vote
4answers
144 views
What information is embedded in a photo taken by camera or print screen?
I was told that it is possible to tell the coordinates where a photo was taken and the date and time it was taken. It is somehow embedded in the photo. I have three questions about this which are as ...
1
vote
3answers
102 views
Per-User Image DRM for Finding a Leaker? [duplicate]
I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
2
votes
0answers
115 views
PHP Upload-show images securely [closed]
I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image.
So i've created a small test project where ...
1
vote
0answers
29 views
What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?
According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/
ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
32
votes
8answers
24k views
If I know the CPU architecture of a target, can I send instructions embedded in an image?
Can I send instructions embedded in an image to a target, if I know his CPU architecture?
0
votes
2answers
187 views
What are the security concerns for base64 encoded JSON files? [closed]
In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module.
The request body are objects like:
{ file: '...
-1
votes
1answer
69 views
Recovering hidden contents from a jpg picture [duplicate]
Is there any way someone could recover hidden text from a jpg. For example in the picture
3
votes
4answers
179 views
Can valid PHP be written and executed in non-ascii character encodings?
I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii.
...
0
votes
1answer
433 views
How exploiting RCE in jpg file actually works?
I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct.
<?php
$test = array('image/jpeg', '...
2
votes
2answers
197 views
Are there XSS vulnerabilities while image preview before uploading it?
I wrote a JQuery tool to preview images before uploads.
User A clicks the explore button to select an image
selects it
a change-event displays the image
If user A selects a prepared SVG image as "...
4
votes
1answer
122 views
Does adding random noise and/or resizing images help neutralize graphics files with embedded exploits
I've sometimes heard/read that one of the ways to deal with embedded exploits (malware code built into the image encoding itself) is adding random noise to an image file, or resizing the image. Are ...
2
votes
1answer
90 views
How do I let users point to their own images, yet avoid Mixed Content warnings?
I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images.
If these URLs are HTTP then the browser does not show the padlock in the ...
1
vote
1answer
113 views
Is there a tool allowing me to store some encrypted data in an image file? [closed]
I've seen - http://stegosploit.info/ - it's adding certain data.
I'm not that sophisticated, I just want to have in an image file:
file header
encrypted data
the image does not have to be real (...
2
votes
1answer
264 views
Execute Shellcode embedded into a picture? [duplicate]
Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
0
votes
1answer
1k views
Cookie stealing with Redirection
I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like
http://...
13
votes
1answer
398 views
JPEG artifacts leaking information about redacted contents
It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
135
votes
8answers
18k views
Secure way of masking out sensitive information in screenshots? [duplicate]
As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below
I ...
2
votes
0answers
68 views
How can I identify invisible online tracking images?
This question refers to invisible 1 pixel images that are placed on web pages to track you via how your browser renders the image. Is there any potential way to discover these images despite them ...
2
votes
1answer
75 views
LSB replacement and its effect on grayscale histogram
I used this program to embed some text data in grayscale image, then I compared original and stego histograms in Matlab using imhist function. You can see both on them below:
Can somebody explain to ...
2
votes
2answers
157 views
How to “clean” graphics of embeded exploits?
I am not totally sure about the terminology but I hear quite a bit about images in websites that somehow take advantage of bugs in software that can be used to compromise a system.
Its not clear to me ...
0
votes
2answers
87 views
Should I change format and/or add data to image files in a file upload?
I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list.
Those security ...
0
votes
1answer
87 views
Software Icons safe?
I recently heard about these Adobe Icons that someone made for some of the best free and open-source applications on a Ubuntu based news site.
"http://www.omgubuntu.co.uk/2016/04/adobe-style-icons-...
0
votes
1answer
72 views
Which approach provides more authenticity of image ownership: cropping, or reduced resolution?
Even if this particular approach likely provides medium to low assurance, which approach is more trustworthy:
Suppose I take a set of photos that I own, and crop all of them after I magnified by 25%....
2
votes
0answers
61 views
How can I create a verifiable signature for a digital transaction?
I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
0
votes
1answer
77 views
Is opening image from the web in google chrome safe
I want to know is it safe to click on an image on facebook to be displayed in my browser, ( in case it's a real image and not a link to external URL).
I'm asking about facebook especially and all ...
4
votes
2answers
350 views
Is it possible to revert a steganographic process to reconstruct the original image?
Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method).
Is it possible to undo the steganographic process given the modified image to reconstruct the original ...
-1
votes
2answers
142 views
How to protect icon images that are sold online from being stolen? [duplicate]
I have been lately browsing material icons from this site.
I started to notice that they don't have any free plans as such so you will have to buy the icons if you want to download them. But however ...
2
votes
1answer
138 views
Dangers of jpeg with attachment
If anyone has any suggestions for tags, feel free to add them, seeing as i'm not yet familiar with the ones used on this site.
I was wondering what the dangers are of appending a file to an image.
...
0
votes
2answers
129 views
Exploit/DoS applications with a 0 width and 0 height image
I believe I've read multiple times that many applications can't properly handle 0x0 pixel images, but I can't get a hold of such an article right now.
From what I recall, the vulnerability was ...
1
vote
0answers
583 views
How to extract watermark from an image [closed]
I have a task to extract watermark itself from a highly complex image. Below there is an example. We have, say this image:
Then we have some watermark like this one which is either transparent or ...
0
votes
1answer
132 views
Is it possible to create a new image standard which supports privacy? [closed]
After watching a TED video on sexting, I heard about that 17 years old girl who committed suicide because her boyfriend shared her private pictures in their school.
I wondered if it is possible to ...
-1
votes
1answer
253 views
Is this an uncommon PNG ending or image steganography? [closed]
I'm reading about image steganography at the moment. I got a test file to experiment with. I noticed a strange code block at the end of the PNG file when I opened it with vim:
xref
0 14
0000000000 ...
0
votes
1answer
190 views
Is ist possible to emed a backdoor in a picture? [duplicate]
Is it possible to infect a picture with a backdoor? And what can I google for that?
0
votes
1answer
92 views
How to make an image shown only on a particular domain [closed]
Is there is a secure way that makes an image allowed to display within a particular domain, and preventing it to be shown on any other website?
0
votes
0answers
82 views
Skype for iPhone image/link preview
Today a Skype contact of mine sent me a link in the chat. This link I believe was sent without the person knowing it, and it contains a reference in the URL to my Skype ID, in the form ...tumblr...#...
0
votes
1answer
74 views
MCC records in JPEG2000
I was looking at some image vulnerabilities and came across the fairly new openjpeg vulnerability in JPEG2000 images. It says that: "out of bounds memory can be accessed due to an error in mcc records ...
0
votes
3answers
1k views
How Can Malware be Attached to an Image File? [duplicate]
How can malware be attached in image files such as a JPEG image?
4
votes
1answer
155 views
Site exposes user's GPS location through EXIF data
Recently while lurking around one of the social networking sites popular with local folks, I have found out that the site does not scrub out the GPS data from uploaded pictures. I've contacted them ...
0
votes
1answer
31 views
Mirroring images in a blog article
When visiting this website, I spotted something weird about the images used. The sources of all images are mirrored horizontally and are being mirrored back with css: transform: scaleX(-1);.
Why ...
2
votes
2answers
244 views
How much identifying information is in a photograph?
If I take a photograph with a smartphone camera, how much information is there that could be used to identify the owner? I know of Exif tags and that all cameras have slight manufacturing variations ...
2
votes
1answer
483 views
What client software is affected by JPEG 2000 / TALOS-2016-0193/CVE-2016-8332
A vulnerability in JPEG 2000 file formats has been discovered.
The articles seem to refer to OpenJPEG implementation when discussing this bug, however what's not clear is who is the vulnerable party....
201
votes
6answers
36k views
How secure is 'blacking out' sensitive information using MS Paint?
I'm wondering if it's safe to black out sensitive information from a picture just by using Microsoft Paint?
Let's take in this scenario that EXIF data are stripped and there is no thumbnail picture, ...
28
votes
5answers
15k views
Find Virus in an Image File
I just received a .jpg file that I'm almost positive contains a virus, so I have two questions about what I am able to do with the image.
My first question originates from the fact that I opened the ...
35
votes
3answers
30k views
Can you recover original data from a screenshot that has been 'blacked out'?
Is there a threat from screenshots with blacked out info? That is can someone take out that aftermarket addition so to speak?
For instance
I take a screenshot (using MS snipper)
Then I 'blur/...
