Questions tagged [image]

For files or formats containing a digital representation of a graphical picture. Not to be confused with [disk-image] or forensic images.

Filter by
Sorted by
Tagged with
0
votes
1answer
69 views

Screenshots and steganography, can malicious code in image be copied?

If you have an image that has malicious code written into it using steganography would a screenshot of that image have functional malicious code as well? Or does the recapture transform the image data ...
0
votes
0answers
54 views

Can using “Save Image As” on Google Images be dangerous? [duplicate]

The title says it all, I was wondering if some malicious code could be placed in the image file (the formats I am concerned with are JPEG, PNG and WEBP, basically the common formats available when you ...
0
votes
2answers
55 views

Can specific location be determined from an aerial image?

Let's say I share a screenshot of an area of interest (AOI) from Google Maps. Does that alone reveal the specific location of the AOI, even if it has no identifiers (roads, coordinates) on it? What if ...
0
votes
1answer
75 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
0
votes
1answer
115 views

What steganographic techniques can I use in images that survive lossy compression?

Learning a bit about IT security, a segment of the material was the basics of steganography - specifically, hiding information in the lowest significance bits of images, and converting images into ...
4
votes
2answers
278 views

How can I recover steganographically hidden data from a photographic copy of the image? [closed]

I need to photograph an image containing a steganographically hidden message, then decode the stego content from the photograph without recourse to the original image data. Are there any steganography ...
1
vote
2answers
186 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
0
votes
0answers
28 views

Find which image has CVE package fixes

I have a handful of google container images that are flagging musl vulns. Example: gcr.io/google_containers/k8s-dns-kube-dns-amd64:1.14.13 https://console.cloud.google.com/gcr/images/google-...
4
votes
2answers
410 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
-2
votes
1answer
148 views

Can I inject javascript into a page via image?

Like so. Can I inject javascript into image urls, like this? <img src="javascript:alert("haha! you are hacked!">
1
vote
3answers
229 views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
5
votes
2answers
3k views

Is there a way to execute XSS in an HTML img tag with SVG?

Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag? I know a way to execute without <script> tag, but I don't ...
3
votes
1answer
172 views

What are the security risks to displaying an image loaded over http in a page loaded over https?

I'm developing a PWA in which part of the app displays the content of emails to the user. However, many of the image URL's that are in the emails come from http domains, and therefore do not load in a ...
0
votes
1answer
82 views

What attacking vectors does “background-image” have

I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image. Would it be possible for a bad actor to fake an image and inject ...
0
votes
1answer
76 views

Is it possible to retrieve embedded information in a printed image with steganography?

If I print the following noise texture image in which I've embedded some information with steganography, can I retrieve the information back or can I detect the information loss occurred due to ...
0
votes
1answer
46 views

Books on digital image encryption [closed]

I'm an applied mathematician that recently developed an interest in digital image encryption. Might there be a book or set of references that develops the theory of digital image encryption and ...
2
votes
1answer
627 views

How can I open a malicious image in whatsapp safely?

I have got an image send by whatsapp on my android tabled, which I only can see when I press the download icon. How can I see the image, without getting a virus when the image is malicious? Are ...
0
votes
1answer
46 views

Is there a security risk in using the same profile picture on different sites?

Well, the title basically says it. I'd suppose that using the same profile picture on unrelated sites would allow anyone to do a quick Google image search and therefore associate the profiles with ...
1
vote
2answers
245 views

Can you stop a BeagleBone from being imaged?

I am working on a group project to have encrypted data on a BeagleBone Black without WiFi (however we will be connecting it to the internet) where you have to type in a password to access it and if ...
0
votes
2answers
38 views

media uploads and social sites group privacy etc

On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat. ...
2
votes
1answer
173 views

Image upload meta information

I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs).. I remove the exif section of the image for security. However ...
1
vote
4answers
639 views

What information is embedded in a photo taken by camera or print screen?

I was told that it is possible to tell the coordinates where a photo was taken and the date and time it was taken. It is somehow embedded in the photo. I have three questions about this which are as ...
1
vote
3answers
160 views

Per-User Image DRM for Finding a Leaker? [duplicate]

I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
2
votes
0answers
197 views

PHP Upload-show images securely [closed]

I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image. So i've created a small test project where ...
1
vote
0answers
42 views

What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?

According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/ ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
32
votes
7answers
24k views

If I know the CPU architecture of a target, can I send instructions embedded in an image?

Can I send instructions embedded in an image to a target, if I know his CPU architecture?
0
votes
2answers
2k views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
-1
votes
1answer
283 views

Recovering hidden contents from a jpg picture [duplicate]

Is there any way someone could recover hidden text from a jpg. For example in the picture
3
votes
4answers
367 views

Can valid PHP be written and executed in non-ascii character encodings?

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii. ...
0
votes
1answer
2k views

How exploiting RCE in jpg file actually works?

I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct. <?php $test = array('image/jpeg', '...
2
votes
2answers
406 views

Are there XSS vulnerabilities while image preview before uploading it?

I wrote a JQuery tool to preview images before uploads. User A clicks the explore button to select an image selects it a change-event displays the image If user A selects a prepared SVG image as "...
5
votes
1answer
184 views

Does adding random noise and/or resizing images help neutralize graphics files with embedded exploits

I've sometimes heard/read that one of the ways to deal with embedded exploits (malware code built into the image encoding itself) is adding random noise to an image file, or resizing the image. Are ...
2
votes
1answer
99 views

How do I let users point to their own images, yet avoid Mixed Content warnings?

I allow users of my webapp to provide a URL for their own images. They can also provide CSS which may contain URLs to images. If these URLs are HTTP then the browser does not show the padlock in the ...
1
vote
1answer
129 views

Is there a tool allowing me to store some encrypted data in an image file? [closed]

I've seen - http://stegosploit.info/ - it's adding certain data. I'm not that sophisticated, I just want to have in an image file: file header encrypted data the image does not have to be real (...
3
votes
1answer
735 views

Execute Shellcode embedded into a picture? [duplicate]

Somebody told me it is possible to insert shellcode into an image or pdf file and execute the shellcode if the image or pdf file was opened. I know that this could be possible if the application (for ...
0
votes
1answer
5k views

Cookie stealing with Redirection

I am trying to steal cookies for learning purpose and for that I have setup an attacker server where my malicious website is running stealing cookies of users and it works when I visit like http://...
13
votes
1answer
598 views

JPEG artifacts leaking information about redacted contents

It was mentioned that JPEG should not be used between image creation and redaction of sensitive contents, because compression artifacts around the redacted area may leak information. Given how this ...
140
votes
8answers
21k views

Secure way of masking out sensitive information in screenshots? [duplicate]

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below I ...
2
votes
0answers
77 views

How can I identify invisible online tracking images?

This question refers to invisible 1 pixel images that are placed on web pages to track you via how your browser renders the image. Is there any potential way to discover these images despite them ...
2
votes
1answer
166 views

LSB replacement and its effect on grayscale histogram

I used this program to embed some text data in grayscale image, then I compared original and stego histograms in Matlab using imhist function. You can see both on them below: Can somebody explain to ...
2
votes
2answers
166 views

How to “clean” graphics of embeded exploits?

I am not totally sure about the terminology but I hear quite a bit about images in websites that somehow take advantage of bugs in software that can be used to compromise a system. Its not clear to me ...
0
votes
2answers
93 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
0
votes
1answer
93 views

Software Icons safe?

I recently heard about these Adobe Icons that someone made for some of the best free and open-source applications on a Ubuntu based news site. "http://www.omgubuntu.co.uk/2016/04/adobe-style-icons-...
0
votes
1answer
84 views

Which approach provides more authenticity of image ownership: cropping, or reduced resolution?

Even if this particular approach likely provides medium to low assurance, which approach is more trustworthy: Suppose I take a set of photos that I own, and crop all of them after I magnified by 25%....
2
votes
0answers
69 views

How can I create a verifiable signature for a digital transaction?

I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
0
votes
1answer
91 views

Is opening image from the web in google chrome safe

I want to know is it safe to click on an image on facebook to be displayed in my browser, ( in case it's a real image and not a link to external URL). I'm asking about facebook especially and all ...
3
votes
2answers
688 views

Is it possible to revert a steganographic process to reconstruct the original image?

Using, say, outguess, it is possible to hide a secret message inside a JPEG image (LSB method). Is it possible to undo the steganographic process given the modified image to reconstruct the original ...
-1
votes
2answers
170 views

How to protect icon images that are sold online from being stolen? [duplicate]

I have been lately browsing material icons from this site. I started to notice that they don't have any free plans as such so you will have to buy the icons if you want to download them. But however ...
2
votes
1answer
214 views

Dangers of jpeg with attachment

If anyone has any suggestions for tags, feel free to add them, seeing as i'm not yet familiar with the ones used on this site. I was wondering what the dangers are of appending a file to an image. ...
1
vote
2answers
201 views

Exploit/DoS applications with a 0 width and 0 height image

I believe I've read multiple times that many applications can't properly handle 0x0 pixel images, but I can't get a hold of such an article right now. From what I recall, the vulnerability was ...