信息隐藏 图像
If you've followed this blog, you know that I'm obsessed with figuring out every way to interact with, abuse, and convert different types of media. Whether it's images, video, or audio, if something can be changed or exploited, I want to figure out how to do it.
如果您关注此博客，那么您就会知道我很着迷于寻找与各种媒体进行交互，滥用和转换的各种方式。 无论是图像，视频还是音频，如果可以更改或利用某些东西，我都想弄清楚该怎么做。
I remember reading in the past about how images could be used to pass on "secret" information or even install viruses, all the while displaying as proper images in browsers; this process is called steganography. I wanted to figure out how you could exploit an image to, at the very least, contain information not visible to the user. Let's look at a few different methods!
我记得以前曾经读过有关如何使用图像来传递“秘密”信息甚至安装病毒的信息，这些信息一直都在浏览器中显示为正确的图像。 这个过程称为隐写术。 我想弄清楚如何利用图像至少包含用户不可见的信息。 让我们看看几种不同的方法！
添加EXIF数据 (Adding EXIF Data)
Unbeknownst to most users sharing photos, those images have data attached to them that the photographer realizes: latitude and longitude, device, and lots of other information. For this reason alone I wrote , a post every service that allows image uploads should read, simply to keep their users privacy.
对于大多数共享照片的用户而言，未知的是，这些图像上附有摄影师能够实现的数据：纬度和经度，设备以及许多其他信息。 仅出于这个原因，我写了 ，每条允许上传图片的服务都应阅读，以保护用户隐私。
You can set EXIF data in an image to pass on dubious information:
您可以在图像中设置EXIF数据以传递可疑信息：
# Put information in the EXIFexiftool -artist=MY_SEMI_SECRET_DATA walshcoin.gif# Retrieve the new info from the EXIFexiftool walshcoin.gif
The image displays just as it did before but passes information unseen to the user!
该图像的显示方式与以前一样，但是会将用户看不见的信息传递给用户！
合并ZIP文件和图像 (Concatenating ZIP Files and Images)
This method is the scarier of the two I'll illustrate. You can actually concatenate an animated GIF and a ZIP file and the image will display while you can also unzip the GIF!
这种方法在我要说明的两种方法中比较可怕。 实际上，您可以将动画的GIF和ZIP文件连接起来，然后显示图像，同时还可以解压缩GIF！
# Concatenate a legit GIF with a secret ZIP file!$ cat bitcoin.gif >> bitcoinsecret.gif$ cat secret.txt.zip >> bitcoinsecret.gif# When you unzip the file, the secret file is there!$ unzip bitcoinsecret.gif
It's wild that you can concatenate an image and a ZIP file and the result is both extractable and displays properly in a browser!
您可以连接图像和ZIP文件是很疯狂的，结果可以提取并且可以在浏览器中正确显示！
The methods I've illustrated in the post are incredibly tame -- there are likely many other dubious ways to exploit images so that the average user doesn't know that they're vulnerable. The ease with which you can add arbitrary information to an image should be unsettling -- the images, at face value, show no sign of modification, but the truth is that they can tell a different story to someone looking for that information!
我在博文中举例说明的方法令人难以置信的驯服-可能还有许多其他可疑方法来利用图像，以使普通用户不知道它们是易受攻击的。 您可以轻松地向图像添加任意信息的方法应该令人不安-图像从表面看没有任何修饰的迹象，但事实是它们可以将其他故事告诉正在寻找该信息的人！
翻译自:
信息隐藏 图像