--Apple-Mail-17--893966045 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Advisory: JPEG EXIF information disclosure The Laboratory for dependable Distributed Systems at RWTH Aachen University likes to raise awareness of common Information Disclosure via JPEG EXIF thumbnail images in common image processing software. Details ======= Product: Image processing software Affected Version: various Immune Version: unknown OS affected: any Security-Risk: Medium Remote-Exploit: No Advisory-URL: http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005 -008 Advisory-Status: public CVE: CAN-2005-0406 Introduction ============ Images created by digital cameras and later cropped or otherwise modified by applications like Adobe Photoshop often contain an unmodified Version of the Image in the embedded thumbnail image. This can result in information disclosure. More Details ============ Digital cameras but also other device embed mini versions ("thumbnails") of the original image in a JPEG image file. Among others one reason is that while flipping through images on the cameras small display the camera does not need to decode and scale the full megapixel picture. The standard to save this thumbnail and other information within a JPEG file is called EXIF. The EXIF standard states that image processing software should leave EXIF headers it doesn't understand alone. This means that if an image from a digital camera is edited, e.g. by making a face unrecognizable, and than the modified version is published, chances are that the thumbnail still contains the unmodified version with the unobstructed face. There might be situations where also disclosure of other information in the EXIF header, like the date and time the picture was taken or the model of the camera used, is problematic. We found that of the JPEG images on the Internet 20 % have a embedded EXIF Thumbnail and about 2% have a thumbnail which our screening software considered significantly different from the original image. After human screening 0.1% can be considered to have thumbnails which are more than just boring cropping differences. If you have more Information on this issue we are eager to hear from you - contact dornseif@informatik.rwth-aachen.de. Proof of Concept ================ See http://blogs.23.nu/disLEXia/stories/5751/ for some example images. See http://md.hudora.de/presentations/#hiddendata-21c3 for code to find "interesting" images automatically. Workaround ========== There is specialized software available for removing EXIF information. Use it. Fix === Image processing software should either update or remove the EXIF thumbnail. Security Risk ============= Our research indicates that around 0.001% of all images contain seriously harmful information in the EXIF thumbnail. History ======= 2003-07-xx tech.tv moderator incident - private parts in the thumbnail 2004-07-xx Maximillian Dornseif gets aware of this incident, discuss it at Defcon 12 2004-10-xx Steven J. Murdoch creates exif_thumb to automatically screen image. We learn that the problem is quite widespread and not an random software glitch. 2004-12-28 Dornseif & Murdoch present the results form a large scale survey of images on the internet at the 21. Chaos Communication Congress 2004-02-12 CVE number requested 2004-02-14 posted to the public as CAN-2005-0406 RedTeam ======= RedTeam is a penetration testing group working at the Laboratory for Dependable Distributed Systems at RWTH-Aachen University. You can find more Information on the RedTeam Project at http://tsyklon.informatik.rwth-aachen.de/redteam/ -- Laboratory for Dependable Distributed Systems, RWTH Aachen University Get news of the lab at http://mail-i4.informatik.rwth-aachen.de/mailman/listinfo/lufgtalk --Apple-Mail-17--893966045 Content-Transfer-Encoding: base64 Content-Type: application/pkcs7-signature; name=smime.p7s Content-Disposition: attachment; filename=smime.p7s MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGWzCCAxQw ggJ9oAMCAQICAwzibTANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt YWlsIElzc3VpbmcgQ0EwHhcNMDQwODE4MTI1MTUxWhcNMDUwODE4MTI1MTUxWjBUMR8wHQYDVQQD ExZUaGF3dGUgRnJlZW1haWwgTWVtYmVyMTEwLwYJKoZIhvcNAQkBFiJkb3Juc2VpZkBpbmZvcm1h dGlrLnJ3dGgtYWFjaGVuLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxAwMVffI m78UUzzFpUTBaD3jzSOQABB4r+iznf6HnZ8oJUYvwbjZ8Na/S8Ie4o7VXAA2Dp2ipgAtvypY3VPI d7LVdcQVJQNOLYQnICMJf7xTtXIoC7gDlOZFRfIl0zdrvNIOx+nhXgIgoQ7/IUcGQXF5Xgjg4sp1 YH4BFNOGNwl5VqwmazxtIGz5Bxzp3MJMV21T4MDBqX9DJcT9Oq+73fCCHzJh4tyNRrBI2ty9lvUB n4dMv86jYDPK1BJmI9dy0/NM0ryA2ShHPmnxxNPd5i0s6g41L5M72garF5/RYEViEmTryAaI2yre 0Ps4EVmGH03FLEzTFvLDJL3FeL5gGQIDAQABo2IwYDAOBgNVHQ8BAf8EBAMCA/gwEQYJYIZIAYb4 QgEBBAQDAgWgMC0GA1UdEQQmMCSBImRvcm5zZWlmQGluZm9ybWF0aWsucnd0aC1hYWNoZW4uZGUw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQQFAAOBgQCJCkQHOMXRjNdwnsWFWz8553dpExvcZ6Ff tPAoXMkArHRvenUCNY+1e9hAed7mcHs4EP9Y04V52b9tJ/NaTR6tQUS8PzO2P/Aw3hjKwh/3CdKO FwG15KEcZW3KG0jy4Tlp8re0wcxXBxKygq0k7TRqx338MwEVPCisWB+NHumcUDCCAz8wggKooAMC AQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENh cGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNV BAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJz b25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3Rl LmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYD VQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u YWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV +065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqq P3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEE QB5kGXJgt/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSG Mmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1Ud DwQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZI hvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNw PP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTl EBpbNU1341YheILcIRk13iSx0x1G/11fZU8xggLnMIIC4wIBATBpMGIxCzAJBgNVBAYTAlpBMSUw IwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVy c29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDOJtMAkGBSsOAwIaBQCgggFTMBgGCSqGSIb3DQEJ AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTA1MDIxNDE5MzUzNlowIwYJKoZIhvcNAQkE MRYEFFUkgSiEJ26XjC7tcHxsrIPp55A+MHgGCSsGAQQBgjcQBDFrMGkwYjELMAkGA1UEBhMCWkEx JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMM4m0wegYLKoZIhvcNAQkQAgsxa6BpMGIxCzAJ BgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQD EyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIDDOJtMA0GCSqGSIb3DQEBAQUA BIIBABJzJN2MvI6hBfDR/tbZx8lzr6XR3x/VXmtlnd2H33PIuFUcyP7F/QsUVq7GnFsQ6DRVBj07 UVqGoDIa2mADqp395GVeV3NcZXnuB7aGaUEDZAEnzIuIjdUxxItXBXxljmEoNEKGk2aY0AEs6tfw uiDIrSyJOshYLqo9ESyIUmulTRyhlnzMILaPWuO5wIiCgXmiQ0bsFwPepthSOstI7tLwisv4g6lt pmnoHTsfGQlaz2/y1ce/K0EfKPujPsGh1UZfWMcBPaLfC3LQ0TKGl1OgSim+wajzW1HO31iHPIHS d9Zw0oetGS09aKnEh7FOxa5IimlnJ1OVW5w/5yTCmSkAAAAAAAA= --Apple-Mail-17--893966045--