_:n8fa231e0536e41e08ee24391ccda2a34xb0
<http://schema.org/articleBody>
"<img src=\"https://i.blogs.es/717f03/ewo_o6zwuaawizr/840_560.jpg\"/><br/><div><br/> <p>Steganography consists of hiding messages or elements within others without being perceived. A technique that the researcher has managed to apply successfully <a href=\"https://twitter.com/David3141593\">David buchanan</a> to Twitter images: <strong>In what might seem a simple and harmless PNG, it can hide a ZIP file with up to 3 MB of information</strong>. An achievement and a potential danger.</p><br/><br/><p>This expert has published the source code of his PNG on GitHub <em>magical</em>, in view of its capabilities, and the file itself <a href=\"https://twitter.com/David3141593/status/1371974874856587268\">has tweeted it</a>. In the tweet he comments on his finding and attaches the image in question that reads: <strong>\"Save this image and change the extension to .zip!\"</strong>.</p><br/> <br/><br/><div class=\"article-asset-summary article-asset-normal\"><br/> <div class=\"asset-content\"><br/> <p>A simple Twitter image can hide a ZIP of up to 3 MB, even an MP3 song ... or a malicious file</p><br/> </div><br/></div><br/><p>If we do, effectively <strong>the image in question will be converted into a compressed file that, if we unzip them, will show us the same source code</strong> uploaded to GitHub.</p><br/><br/><h2>Tweetable Polyglot PNG, the discreet ZIP files that can be tweeted</h2><br/><br/><blockquote class=\"twitter-tweet\"><p lang=\"en\" dir=\"ltr\">I found a way to stuff up to ~ 3MB of data inside a PNG file on twitter. This is even better than my previous JPEG ICC technique, since the inserted data is contiguous.</p><p>The source code is available in the ZIP / PNG file attached: <a href=\"https://t.co/zEOl2zJYRC\">pic.twitter.com/zEOl2zJYRC</a></p>- D&#1072;v&#1110;d &#1042;uc&#1211;&#1072;n&#1072;n (@ David3141593) <a href=\"https://twitter.com/David3141593/status/1371974874856587268?ref_src=twsrc%5Etfw\">March 17, 2021</a></blockquote> <br/><p>Buchanan has explained to <em>Bleeping Computer</em> what <strong>although Twitter almost always compresses images, in some cases that is not the case</strong>. Nor does it always remove non-essential metadata, what happens is that these exceptions are very specific and are those that the researcher has discovered.</p><br/><br/><p>\"The new trick I have discovered is that <strong>you can add data to the end of the flow 'DEFLATE'</strong> (the part of the file that stores the compressed pixel data) and Twitter will not delete it \", he explained. And it will not do so even when it compresses an image by reducing the size: the code that creates the image remains there. <em>Magic</em> of the ZIP. Something that, in the wrong hands, can pose a potential danger.</p><br/><div class=\"article-asset article-asset-normal article-asset-center\"><br/> <div class=\"desvio-container\"><br/> <div class=\"desvio\"><br/> <div class=\"desvio-figure js-desvio-figure\"><br/> <br/> <img alt=\"Six pages to unzip zip files and rar files online\" src=\"https://i.blogs.es/3773ad/descomprimir-archivos-zip/375_142.jpg\"/></div><br/> <br/> </div><br/> </div><br/></div><br/><p>David Buchanan has not only tried to hide compressed files in images to tweet, but <strong>also MP3 files and their tests have paid off</strong>. <a href=\"https://twitter.com/David3141593/status/1371978592679309315?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1371978592679309315%7Ctwgr%5E%7Ctwcon%5Es1_&#38;ref_url=https%3A%2F%2Fwww.xataka.com%2Fservicios%2Fdescubren-que-simple-imagen-twitter-puede-servir-para-esconder-archivos-zip-maliciosos-mp3s\">In another tweet</a>, invites users to download a second image, rename it with the .mp3 extension, and open the resulting file with VLC to discover \"a surprise.\"</p><br/><br/><p>If we download the snapshot in its original size, 2.5 MB, <strong>we will be <em>rickrolled</em></strong>. Because yes, the song is the famous and mythical <em>Never Gonna Give You Up</em> by Rick Astley. Of course, despite the fact that the song by itself is what it is, nothing better than accompanying it with the video clip in 4K.</p><br/><br/><br/> </div>"
<https://www.bestgizindia.com/2021/03/a-seemingly-harmless-twitter-image-can.html>