Hacker News Reader

Comment by tyingq | Hacker News Reader

This is also somewhat interesting...

"It survives all of twitters scaling, compression and thumbnailing. /how/ is left as an exercise to the reader :P"

Guessing Twitter doesn't scale/thumbnail/compress already tiny images... which is probably an oversight in this case because the file size is disproportionately large.

Yeah, I guess it's possible that it's only checking dimensions instead of actual filesize.

No, the rars are in the image metadata, not in the actual pixels at all.

They still contribute to filesize.

They don't address the metadata in compression, which is probably what the bug report [1] was about. This thumbnail is over 2MB. With the metadata removed, it's only about 2KB.

[1] https://twitter.com/David3141593/status/1057042727945322496

That's less exciting

the answer: ICC profiles (i think)

Yes, if you open the file as text you will find the magic number of icc profile (acsp) follwoed by a bunch of random bytes and that of zip (PK/x03/x04). It is quite easy to append arbitrary data to JPEG files [0] and however there is no guarantee that it will survive image processing, so it was necessary to hide it within an ICC　profile. As for zip, unzip will happily decode any data stream as long as it makes sense and ignore the parts that don't.

I can't quite figure out what additional tricks the author has used to disperse the image data inside the body to evade entropy analysis as shown by the binwalker analysis posted in this thread; however image processing software seems to have no trouble parsing the file and extract only the image data without the embedded zip.[1]

[0]:https://natmchugh.blogspot.com/2014/10/how-i-created-two-ima...

[1]:http://www.imagemagick.org/script/command-line-options.php#p...

Is there an equivalent way of embedding data in PNG files?

I've done this before by appending data to the end of the file but if I could make it more resistant to reprocessing that would be useful.

https://w3.org/TR/PNG/#11textinfo

Thanks, that's perfect for my use case!

Because a JPG stream can end mid-file, and the remainder of the data is ignored.

Reply on news.ycombinator.com