226
votes
Accepted
How secure is 'blacking out' sensitive information using MS Paint?
As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the ...
- 2,491
192
votes
Accepted
Secure way of masking out sensitive information in screenshots?
Yes, it can be recovered.
As long as shutter does not use layer (it almost certainly does not) and as long as the black is really all black (it must not be transparent), it is enough.
The picture ...
- 7,708
138
votes
What aspects of image preparation workflows can lead to accidents like Boris Johnson's No. 10 tweet's 'hidden message'?
Summary:
The most likely explanation is that the old text was removed by using a fuzzy or smooth eraser tool.
Analysis:
In the image below I have only increased brightness and contrast to make the &...
- 761
113
votes
If I know the CPU architecture of a target, can I send instructions embedded in an image?
Other answers give a good technical explanation but let me try with an analogy:
Please send your credit card number to scam@example.com
Did you read it?
Did you do it?
It's more or less the same ...
- 1,037
80
votes
Secure way of masking out sensitive information in screenshots?
You don't even need to use an image editor in this case to recover the "redacted" text. Simply zooming in on the image is enough to read it.
So I would say that yes, it most certainly is possible to ...
- 757
71
votes
Secure way of masking out sensitive information in screenshots?
In this case the image can be recovered very well
As others already pointed out the dark patch is not completely black. It has a transparent effect and only darkens the original image. The original ...
64
votes
How secure is 'blacking out' sensitive information using MS Paint?
Ditto Ben N, but let me add a couple of points that are too long to fit as comments.
I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a ...
- 859
64
votes
Accepted
If I know the CPU architecture of a target, can I send instructions embedded in an image?
CPU instructions are given in what are called opcodes, and you're right that those live in memory just like your image. They live in conceptually different "areas" of memory, though.
For instance, ...
- 646
58
votes
If I know the CPU architecture of a target, can I send instructions embedded in an image?
Can you send them? Yes, of course. Just assemble them and stick them somewhere in the image file.
Will the target execute them? No, not unless you already have control over the target (and can thus ...
47
votes
Accepted
Can you recover original data from a screenshot that has been 'blacked out'?
Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost.
However, the PNG format supports storage of an unlimited amount of ...
- 48.8k
43
votes
Accepted
What aspects of image preparation workflows can lead to accidents like Boris Johnson's No. 10 tweet's 'hidden message'?
At first I thought this was simply a hoax as no digital image process I'm aware of could do this by accident, but I was intrigued.
Taking the orignal image and performing an equalize on it did indeed ...
- 7,472
39
votes
Accepted
Find Virus in an Image File
Based on the description at Virustotal you've linked to this is in reality not an image, but a real PE32 executable (normal windows executable). So only the file name extension was changed to hide the ...
- 183k
33
votes
If I know the CPU architecture of a target, can I send instructions embedded in an image?
You could if your target used a version of Internet Explorer from before August 2005 to view a JPG. Or if they were going to open a PNG in Windows Media Player on Windows 98 with no security updates ...
- 501
29
votes
Secure way of masking out sensitive information in screenshots?
Yes, the text can be unmasked, either by simply zooming in or using any of the techniques - but not restricted to - pointed by pabouk and Peter answers.
I have clearly asked for the correct/most ...
- 524
22
votes
How secure is 'blacking out' sensitive information using MS Paint?
When blacking out sensitive information in Paint the original pixels are destroyed. But using Inkscape to black out part of a vector image does not destroy the pixels, but instead covers them. If ...
- 477
17
votes
How secure is 'blacking out' sensitive information using MS Paint?
As a raster image program that does not use layers nor contain an undo history after saving, overwriting sensitive pixels in Paint irrevocably changes them in the saved image.
More reasoning:
...
- 310
13
votes
How secure is 'blacking out' sensitive information using MS Paint?
Already a few good answers here, saying Paint is safe. (I have no reason to believe otherwise.)
Just want to add that while blacking out a rectangle that fully covers the area and any surrounding ...
- 231
13
votes
Can you recover original data from a screenshot that has been 'blacked out'?
When you paint over a jpg or png file, you are not putting a sticker over the image, you are more ripping a hole on the image and filling the hole with ink.
Even on Photoshop, if you export the ...
- 50.5k
12
votes
Accepted
Is there a way to execute XSS in an HTML img tag with SVG?
No, it's not. Although SVG files can contain JS (see this), these will only get executed if:
the user directly visits the .svg file in their browser
the image is embedded within <embed> ...
- 2,065
11
votes
Find Virus in an Image File
Re. question 1:
This does not look like a JPG at all.
It has the magic "MZ" characters at the beginning of the file that signifies "Windows Portable Executable File". Also your ...
- 17.7k
11
votes
Secure way of masking out sensitive information in screenshots?
Examples
As shown above, your example was breakable,the blacks of the redaction had variation showing the text.
Real life example
New York Times Suffers Redaction Failure, Exposes Name Of NSA Agent ...
- 3,169
11
votes
If I know the CPU architecture of a target, can I send instructions embedded in an image?
No. Image files such as JPEG files don't execute code, they are simply rendered and displayed.
If you want to hide some information in a file that's called Steganography, but that only hides ...
- 5,110
9
votes
How to prevent XSS in SVG file upload?
Take a look at this fantastic blog post that was recently published by security researcher Robin (@digininja) about this exact topic:
Direct view with content-disposition: attachment - not vulnerable ...
- 191
9
votes
What aspects of image preparation workflows can lead to accidents like Boris Johnson's No. 10 tweet's 'hidden message'?
I expect the explanation is fairly mundane. An image was probably prepared with 3 layers:
Background colour and maybe the footer text
Trump text
Biden text
You could then produce both messages with ...
- 206
8
votes
Secure way of masking out sensitive information in screenshots?
I think you may be misusing what's meant to be a highlight tool (I'm not at any of my Ubuntu machines ATM and don't have shutter installed anyway to test). I can't quite believe that a tool meant for ...
- 4,185
8
votes
Secure way of masking out sensitive information in screenshots?
Don't provide screnshots. Provide descriptions OR sample screenshots taken at times when sensitive data is not on the screen, with description that "X appeared here".
"It's no evidence!" you may say. ...
- 1,921
7
votes
How secure is 'blacking out' sensitive information using MS Paint?
Some comments on previous answers (all good - Stack Exchange is like watching really good crossword puzzle players.) An interesting topic which occasionally might be life-and-death important. (My ...
- 71
7
votes
Can you recover original data from a screenshot that has been 'blacked out'?
No, the security is no better. The typical formats used for screenshots (JPEG or PNG) are not image formats that support layers like say, a PSD does. When you add the green scribble, you're not ...
- 35.5k
6
votes
If I know the CPU architecture of a target, can I send instructions embedded in an image?
You can, IF you also know what software stack will touch the image on the receiving side, AND IF there are unresolved security vulnerabilities in that software stack.
Simply putting the instructions ...
- 975
6
votes
Accepted
Is a cryptographically signing camera possible?
Both Nikon and Canon have cameras that can digitally sign photos so you might look for technical details on how they do this. At the same time, you want a better system than they implemented as a ...
- 2,115
Only top scored, non community-wiki answers of a minimum length are eligible