Questions tagged [image]

For files or formats containing a digital representation of a graphical picture. Not to be confused with [disk-image] or forensic images.

Filter by
Sorted by
Tagged with
1 vote
4 answers
224 views

GPS metadata in uploaded pictures: vulnerability or not?

If a web application (like an internet forum, social media, etc.) does not remove GPS metadata (EXIF) from uploaded pictures, is it considered a security vulnerability or not? Why? And would it be ...
reed's user avatar
  • 15.7k
0 votes
1 answer
57 views

Is it safe to allow linking to images by URL in user-made posts?

I'm working on an imageboard website that uses the TinyIB bulletin board software. When editing the settings, I found this line: define('TINYIB_UPLOADVIAURL', false); // Allow files to be uploaded via ...
AcinonX's user avatar
4 votes
0 answers
229 views

Detecting messages embedded in a jpg image with OutGuess

To begin, please someone correct me if I am wrong, but I believe OutGuess was definitively broken in the paper "Attacking the OutGuess" in 2002 and this attack was never patched. It seems ...
Chessnerd321's user avatar
-1 votes
1 answer
48 views

Would a base64ed code work inside an images metadata? [closed]

my target has a server that uses aspx possibly version 4.3 and i just found out that it has an image upload part. They have an image analyzer so it has to be an image file so i wonder if i could embed ...
Krysslk's user avatar
1 vote
0 answers
1k views

How to tell if an image has a virus? [duplicate]

I received (and opened) an image from Whatsapp. How can I know if this image contains a virus (spyware)? Is it possible to send photos containing virus using Whatsapp Mod (unofficial versions of ...
Elle.1221's user avatar
0 votes
1 answer
386 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
AskedSuperior's user avatar
1 vote
1 answer
1k views

What are the security concerns of embedding Base64-encoded images into an HTML document?

We are developing an MVC web-application in Django and having concerns about image uploading. First of all, here are our business requirements: Our users can upload images (like profile pictures, etc)...
salazar324's user avatar
5 votes
1 answer
140 views

Possible to avoid device fingerprinting with imagemagick?

If I took a picture with my mobile phone and wanted to publish that photo without any artefacts connect to me, the first thing I would do is strip all of the image metadata with 'exiftool': exiftool -...
user227963's user avatar
0 votes
1 answer
252 views

Virus from Embedded Image in Mac Mail?

I'm using macOS High Sierra, and mac Mail version 11.3. I have a script that uses the Twitter API to continually fetch tweets in real-time and send the contents of each of these tweets, including any ...
galpo's user avatar
  • 3
2 votes
1 answer
174 views

Is it possible to move image files from a text thread on a phone to a virtual box without downloading them?

I'm looking into a spam bot that's been sending me messages on my phone (Samsung s10). It's sent a couple images that I want to try and scrape for metadata and do a reverse image search on. Since the ...
Wyatt Wright's user avatar
0 votes
1 answer
309 views

What happens when app have access to your photos?

These days I see many apps request access to photos on iPhone. I understand app request access to photos to iOS which then request access to me, that sounds ok. In that context I can allow access to ...
KcFnMi's user avatar
  • 141
0 votes
0 answers
138 views

Is converting from PNG to WebP format still effective to prevent facial recognition?

Fawkes was used to cloak the PNG images and the images were then converted from PNG to WebP format using Google's official cwebp.exe. Is the cloaking still effective to prevent facial recognition on ...
Munchkin's user avatar
  • 244
1 vote
2 answers
631 views

Create memory image of infected machine without risk

I am pretty new in the security world and I am writing a procedure on how to create a memory image of an infected machine for forensics. The problem is that the machine does not have the tools for ...
Rémy Legrand's user avatar
1 vote
2 answers
905 views

Clonezilla for forensic disk image

I was wondering if it's reasonable and forensically correct to use Clonezilla for the image of an attacked machine. Since some of the commercial products are very expensive I'm turning to open source ...
Jack's user avatar
  • 11
0 votes
1 answer
198 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
trieulieuf9's user avatar
0 votes
3 answers
702 views

Is is safe to skip virus scanning for image files?

Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous. Are there any good reasons not ...
davidgo's user avatar
  • 593
0 votes
0 answers
43 views

Is it possible for someone to "peel back" an image layer? [duplicate]

I am on a Windows 10 machine using Chrome (latest updates). I took a screenshot of Instagram, because I was having problems logging in, and then using Paint 3D applied a black rectangle to hide my ...
tchakravarty's user avatar
1 vote
0 answers
175 views

.htaccess to stop scripts with image extensions

I use a .htaccess file in my images directory to block scripts from running. I exclude .php .cgi and so on. But some malware is disguised by naming them with an image extension. I did not previously ...
paulkruger's user avatar
0 votes
1 answer
167 views

Does limiting size of images prevents buffer overflow?

I am writing an app that serves images to clients. The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there. Am I vulnerable to buffer overflow ...
Dr J's user avatar
  • 1
1 vote
1 answer
298 views

Virus scanning uploaded images to database

I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, ...
DaddyMike's user avatar
1 vote
1 answer
914 views

CSP allowing Base64 encoded images without unsafe-eval

If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data ...
user1709076's user avatar
0 votes
0 answers
174 views

Are any social media sites sanitizing images?

I'm new to steganography. I have some questions about images on social media sites. I saw that Facebook recently patched a vulnerability on Instagram, but I was wondering whether any of the major ...
Lyndey's user avatar
  • 1
1 vote
2 answers
910 views

Are PPM or BMP images safer than JPEGs or PNGs?

I was reading this question ( How to check if an image file is clean? ) and forest's answer suggested converting the image to a "trivial pixelmap format, such as PPM". Such a format was ...
reed's user avatar
  • 15.7k
0 votes
0 answers
99 views

Recovery files fails Raspberry Pi 3b

i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS I would like to start with forensics file management, and ...
onec0de's user avatar
  • 121
100 votes
4 answers
12k views

What aspects of image preparation workflows can lead to accidents like Boris Johnson's No. 10 tweet's 'hidden message'?

The BBC reports that the image Boris Johson posted on Twitter to congratulate Joe Biden contains traces of the text "Trump" in the background. The BBC article links to a Guido Fawkes' ...
uhoh's user avatar
  • 1,415
0 votes
0 answers
37 views

What can a jpg with a small width and height hide? [duplicate]

I'm new to cybersecurity. I am participating in the cybersec challenge. I have an image to analyze. This image is small but super heavy. I thought that there was a message hidden behind but all my ...
Revolucion for Monica's user avatar
2 votes
1 answer
563 views

Are preview thumbnails for links a risk?

I received a message from a friend with a link. I never clicked it, but the thumbnail image shown pretended to be an image preview for a YouTube video. Some of her other friends clicked it and it took ...
Coderxyz's user avatar
  • 560
0 votes
1 answer
2k views

How to detect malware in images

Do commercial AV suites examine image files (pictures) for potential malware that might be imbedded via steganography? Is this a concern for most? I deal with a lot of imagery data and am wondering ...
wazzu62's user avatar
1 vote
2 answers
625 views

Encrypt Text Message as Image

Is this a good idea to make the following text message encryption: accept text from the user 1 store the text into a document in the form of some handwritten font convert the document into an image ...
display_info's user avatar
0 votes
1 answer
2k views

SSRF Through Image Url

I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have ...
Emanuel Beni's user avatar
6 votes
2 answers
11k views

If malware can be attached to an image file, then why aren't images a common attack vector?

For example, if someone uploads a malicious image on website like Instagram or Facebook, and then hundreds of people viewed this image, wouldn't that be an easy way to infect the devices of hundreds ...
user241941's user avatar
3 votes
1 answer
4k views

How can wkhtmltopdf be used without introducing a security vulnerability?

Background Per the project website, wkhtmltopdf is a "command line tool to render HTML into PDF using the Qt WebKit rendering engine. It runs entirely "headless" and does not require a ...
Aaron Cicali's user avatar
1 vote
0 answers
738 views

File Upload Vulnerability SVG [closed]

I am currently doing a bug bounty program and was testing the company's file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded ...
Emanuel Beni's user avatar
0 votes
3 answers
621 views

Checking potentially infected photos for stegonography

A friend of mine has an old family PC with a bunch of important photos on it. Unfortunately, from what he told me, it seems like they have fallen victim to a tech support scam some five years ago, ...
Macklin's user avatar
0 votes
1 answer
2k views

Screenshots and steganography, can malicious code in image be copied?

If you have an image that has malicious code written into it using steganography would a screenshot of that image have functional malicious code as well? Or does the recapture transform the image data ...
Li Brary's user avatar
0 votes
0 answers
4k views

Can using "Save Image As" on Google Images be dangerous? [duplicate]

The title says it all, I was wondering if some malicious code could be placed in the image file (the formats I am concerned with are JPEG, PNG and WEBP, basically the common formats available when you ...
DaddyMike's user avatar
0 votes
2 answers
124 views

Can specific location be determined from an aerial image?

Let's say I share a screenshot of an area of interest (AOI) from Google Maps. Does that alone reveal the specific location of the AOI, even if it has no identifiers (roads, coordinates) on it? What if ...
cr0's user avatar
  • 373
0 votes
1 answer
605 views

Triggering an XSS through a shortened URL?

I have this piece of HTML: <img src="image src" alt="{injectable}" title="{injectable}" border="0"> where {injectable} values correspond to the same input value that has to be 32 characters ...
Leon's user avatar
  • 43
3 votes
1 answer
631 views

What steganographic techniques can I use in images that survive lossy compression?

Learning a bit about IT security, a segment of the material was the basics of steganography - specifically, hiding information in the lowest significance bits of images, and converting images into ...
sisisisi's user avatar
  • 193
4 votes
2 answers
2k views

How can I recover steganographically hidden data from a photographic copy of the image? [closed]

I need to photograph an image containing a steganographically hidden message, then decode the stego content from the photograph without recourse to the original image data. Are there any steganography ...
uma's user avatar
  • 183
1 vote
2 answers
676 views

How do we secure image parsing libraries against buffer overflow?

New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
boomselector's user avatar
4 votes
2 answers
2k views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
pax's user avatar
  • 43
-2 votes
1 answer
939 views

Can I inject javascript into a page via image?

Like so. Can I inject javascript into image urls, like this? <img src="javascript:alert("haha! you are hacked!">
Christopher C's user avatar
6 votes
3 answers
2k views

Is a cryptographically signing camera possible?

What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
Simon Woodside's user avatar
11 votes
2 answers
10k views

Is there a way to execute XSS in an HTML img tag with SVG?

Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag? I know a way to execute without <script> tag, but I don't ...
Mega's user avatar
  • 113
3 votes
1 answer
777 views

What are the security risks to displaying an image loaded over http in a page loaded over https?

I'm developing a PWA in which part of the app displays the content of emails to the user. However, many of the image URL's that are in the emails come from http domains, and therefore do not load in a ...
Skeets's user avatar
  • 133
0 votes
1 answer
1k views

What attacking vectors does "background-image" have

I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image. Would it be possible for a bad actor to fake an image and inject ...
dannymo's user avatar
0 votes
1 answer
447 views

Is it possible to retrieve embedded information in a printed image with steganography?

If I print the following noise texture image in which I've embedded some information with steganography, can I retrieve the information back or can I detect the information loss occurred due to ...
Rahul Savsani's user avatar
0 votes
1 answer
94 views

Books on digital image encryption [closed]

I'm an applied mathematician that recently developed an interest in digital image encryption. Might there be a book or set of references that develops the theory of digital image encryption and ...
Aidan Rocke's user avatar
2 votes
1 answer
3k views

How can I open a malicious image in whatsapp safely?

I have got an image send by whatsapp on my android tabled, which I only can see when I press the download icon. How can I see the image, without getting a virus when the image is malicious? Are ...
MarvHock's user avatar
  • 123