Questions tagged [image]
For files or formats containing a digital representation of a graphical picture. Not to be confused with [disk-image] or forensic images.
87
questions
0
votes
1answer
51 views
Can display a GIF in <img> tag causing Client-side DOS
SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF?
Thanks everyone.
0
votes
3answers
93 views
Is is safe to skip virus scanning for image files?
Among other things, I use clamscan on my web servers website directories to help find compromised websites. Unfortunately the time to do this scan is becoming onerous.
Are there any good reasons not ...
0
votes
0answers
37 views
Is it possible for someone to “peel back” an image layer? [duplicate]
I am on a Windows 10 machine using Chrome (latest updates). I took a screenshot of Instagram, because I was having problems logging in, and then using Paint 3D applied a black rectangle to hide my ...
1
vote
0answers
55 views
.htaccess to stop scripts with image extensions
I use a .htaccess file in my images directory to block scripts from running. I exclude .php .cgi and so on. But some malware is disguised by naming them with an image extension. I did not previously ...
0
votes
1answer
41 views
Does limiting size of images prevents buffer overflow?
I am writing an app that serves images to clients.
The app is written mostly in python. I store the images in AWS s3 and serve the clients them directly from there.
Am I vulnerable to buffer overflow ...
1
vote
1answer
78 views
Virus scanning uploaded images to database
I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, ...
0
votes
1answer
109 views
CSP allowing Base64 encoded images without unsafe-eval
If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data ...
0
votes
0answers
58 views
Are any social media sites sanitizing images?
I'm new to steganography. I have some questions about images on social media sites.
I saw that Facebook recently patched a vulnerability on Instagram, but I was wondering whether any of the major ...
1
vote
2answers
107 views
Are PPM or BMP images safer than JPEGs or PNGs?
I was reading this question ( How to check if an image file is clean? ) and forest's answer suggested converting the image to a "trivial pixelmap format, such as PPM". Such a format was ...
0
votes
0answers
39 views
Recovery files fails Raspberry Pi 3b
i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS
I would like to start with forensics file management, and ...
96
votes
4answers
12k views
What aspects of image preparation workflows can lead to accidents like Boris Johnson's No. 10 tweet's 'hidden message'?
The BBC reports that the image Boris Johson posted on Twitter to congratulate Joe Biden contains traces of the text "Trump" in the background. The BBC article links to a Guido Fawkes' ...
0
votes
0answers
31 views
What can a jpg with a small width and height hide? [duplicate]
I'm new to cybersecurity. I am participating in the cybersec challenge.
I have an image to analyze. This image is small but super heavy. I thought that there was a message hidden behind but all my ...
2
votes
1answer
183 views
Are preview thumbnails for links a risk?
I received a message from a friend with a link. I never clicked it, but the thumbnail image shown pretended to be an image preview for a YouTube video. Some of her other friends clicked it and it took ...
0
votes
1answer
251 views
How to detect malware in images
Do commercial AV suites examine image files (pictures) for potential malware that might be imbedded via steganography? Is this a concern for most?
I deal with a lot of imagery data and am wondering ...
1
vote
2answers
208 views
Encrypt Text Message as Image
Is this a good idea to make the following text message encryption:
accept text from the user 1
store the text into a document in the form of some handwritten font
convert the document into an image
...
0
votes
1answer
433 views
SSRF Through Image Url
I am currently studying regarding SSRF. I noticed that an injection vector where SSRF might be present is always parameters that is related to url (Importing image using URL, others). I have ...
2
votes
2answers
720 views
If malware can be attached to an image file, then why aren't images a common attack vector?
For example, if someone uploads a malicious image on website like Instagram or Facebook, and then hundreds of people viewed this image, wouldn't that be an easy way to infect the devices of hundreds ...
1
vote
0answers
625 views
How can wkhtmltopdf be used without introducing a security vulnerability?
Background
Per the project website, wkhtmltopdf is a "command line tool to render HTML into PDF using the Qt WebKit rendering engine. It runs entirely "headless" and does not require a ...
1
vote
0answers
266 views
File Upload Vulnerability SVG [closed]
I am currently doing a bug bounty program and was testing the company's file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded ...
0
votes
3answers
145 views
Checking potentially infected photos for stegonography
A friend of mine has an old family PC with a bunch of important photos on it. Unfortunately, from what he told me, it seems like they have fallen victim to a tech support scam some five years ago, ...
0
votes
0answers
32 views
Security Risks of CID Image Embed?
I am putting together an email and have been asked to embed the images and to reference their ContentID in the HTML so that the email is self contained (no requests out to download the images from our ...
0
votes
1answer
284 views
Screenshots and steganography, can malicious code in image be copied?
If you have an image that has malicious code written into it using steganography would a screenshot of that image have functional malicious code as well? Or does the recapture transform the image data ...
0
votes
0answers
891 views
Can using “Save Image As” on Google Images be dangerous? [duplicate]
The title says it all, I was wondering if some malicious code could be placed in the image file (the formats I am concerned with are JPEG, PNG and WEBP, basically the common formats available when you ...
0
votes
2answers
74 views
Can specific location be determined from an aerial image?
Let's say I share a screenshot of an area of interest (AOI) from Google Maps. Does that alone reveal the specific location of the AOI, even if it has no identifiers (roads, coordinates) on it? What if ...
0
votes
1answer
153 views
Triggering an XSS through a shortened URL?
I have this piece of HTML:
<img src="image src" alt="{injectable}" title="{injectable}" border="0">
where {injectable} values correspond to the same input value that has to be 32 characters ...
1
vote
1answer
207 views
What steganographic techniques can I use in images that survive lossy compression?
Learning a bit about IT security, a segment of the material was the basics of steganography - specifically, hiding information in the lowest significance bits of images, and converting images into ...
4
votes
2answers
842 views
How can I recover steganographically hidden data from a photographic copy of the image? [closed]
I need to photograph an image containing a steganographically hidden message, then decode the stego content from the photograph without recourse to the original image data. Are there any steganography ...
1
vote
2answers
288 views
How do we secure image parsing libraries against buffer overflow?
New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
4
votes
2answers
657 views
How can nginx run a file with jpg extension as a php file?
I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run
www.something.com/blan.php/one/two/3
and one/...
-2
votes
1answer
287 views
Can I inject javascript into a page via image?
Like so.
Can I inject javascript into image urls, like this?
<img src="javascript:alert("haha! you are hacked!">
2
votes
3answers
479 views
Is a cryptographically signing camera possible?
What kind of digital / cryptographic signing would make it possible to create a camera that cryptographically signs the photos it takes so that the images can be verified to have been taken with that ...
6
votes
2answers
5k views
Is there a way to execute XSS in an HTML img tag with SVG?
Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=""> tag?
I know a way to execute without <script> tag, but I don't ...
3
votes
1answer
281 views
What are the security risks to displaying an image loaded over http in a page loaded over https?
I'm developing a PWA in which part of the app displays the content of emails to the user. However, many of the image URL's that are in the emails come from http domains, and therefore do not load in a ...
0
votes
1answer
135 views
What attacking vectors does “background-image” have
I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image.
Would it be possible for a bad actor to fake an image and inject ...
0
votes
1answer
133 views
Is it possible to retrieve embedded information in a printed image with steganography?
If I print the following noise texture image in which I've embedded some information with steganography, can I retrieve the information back or can I detect the information loss occurred due to ...
0
votes
1answer
47 views
Books on digital image encryption [closed]
I'm an applied mathematician that recently developed an interest in digital image encryption. Might there be a book or set of references that develops the theory of digital image encryption and ...
2
votes
1answer
2k views
How can I open a malicious image in whatsapp safely?
I have got an image send by whatsapp on my android tabled, which I only can see when I press the download icon.
How can I see the image, without getting a virus when the image is malicious?
Are ...
0
votes
1answer
88 views
Is there a security risk in using the same profile picture on different sites?
Well, the title basically says it.
I'd suppose that using the same profile picture on unrelated sites would allow anyone to do a quick Google image search and therefore associate the profiles with ...
1
vote
2answers
288 views
Can you stop a BeagleBone from being imaged?
I am working on a group project to have encrypted data on a BeagleBone Black without WiFi (however we will be connecting it to the internet) where you have to type in a password to access it and if ...
0
votes
2answers
38 views
media uploads and social sites group privacy etc
On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.
...
2
votes
1answer
178 views
Image upload meta information
I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs)..
I remove the exif section of the image for security. However ...
1
vote
4answers
1k views
What information is embedded in a photo taken by camera or print screen?
I was told that it is possible to tell the coordinates where a photo was taken and the date and time it was taken. It is somehow embedded in the photo. I have three questions about this which are as ...
1
vote
3answers
219 views
Per-User Image DRM for Finding a Leaker? [duplicate]
I'm managing a client that distributes their users images and files through one source. My background is heavily in development as opposed to security, and I'm of course familiar with some tricks that ...
2
votes
0answers
317 views
PHP Upload-show images securely [closed]
I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image.
So i've created a small test project where ...
1
vote
0answers
47 views
What source formats are affected by ImageMagick's vulnaribility caused by Ghostscript?
According to https://www.theregister.co.uk/2018/08/23/imagemagick_ghostscript/
ImageMagick's convertion to PDF of arbitrary (user-submitted) documents should not be used because of Ghostscript's ...
32
votes
7answers
24k views
If I know the CPU architecture of a target, can I send instructions embedded in an image?
Can I send instructions embedded in an image to a target, if I know his CPU architecture?
0
votes
2answers
3k views
What are the security concerns for base64 encoded JSON files? [closed]
In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module.
The request body are objects like:
{ file: '...
-1
votes
1answer
467 views
Recovering hidden contents from a jpg picture [duplicate]
Is there any way someone could recover hidden text from a jpg. For example in the picture
3
votes
4answers
477 views
Can valid PHP be written and executed in non-ascii character encodings?
I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii.
...
0
votes
1answer
3k views
How exploiting RCE in jpg file actually works?
I am trying to learn how JPG and PNG files can be used to get RCE. Below is my code for uploading files. It will check if the file content type is correct.
<?php
$test = array('image/jpeg', '...
