Steganography consists of hiding messages or elements within others without being perceived. A technique that the researcher has managed to apply successfully David buchanan to Twitter images: In what might seem a simple and harmless PNG, it can hide a ZIP file with up to 3 MB of information. An achievement and a potential danger.
This expert has published the source code of his PNG on GitHub magical, in view of its capabilities, and the file itself has tweeted it. In the tweet he comments on his finding and attaches the image in question that reads: "Save this image and change the extension to .zip!".
A simple Twitter image can hide a ZIP of up to 3 MB, even an MP3 song ... or a malicious file
If we do, effectively the image in question will be converted into a compressed file that, if we unzip them, will show us the same source code uploaded to GitHub.
Tweetable Polyglot PNG, the discreet ZIP files that can be tweeted
I found a way to stuff up to ~ 3MB of data inside a PNG file on twitter. This is even better than my previous JPEG ICC technique, since the inserted data is contiguous.
The source code is available in the ZIP / PNG file attached: pic.twitter.com/zEOl2zJYRC- Dаvіd Вucһаnаn (@ David3141593) March 17, 2021
Buchanan has explained to Bleeping Computer what although Twitter almost always compresses images, in some cases that is not the case. Nor does it always remove non-essential metadata, what happens is that these exceptions are very specific and are those that the researcher has discovered.
"The new trick I have discovered is that you can add data to the end of the flow 'DEFLATE' (the part of the file that stores the compressed pixel data) and Twitter will not delete it ", he explained. And it will not do so even when it compresses an image by reducing the size: the code that creates the image remains there. Magic of the ZIP. Something that, in the wrong hands, can pose a potential danger.
David Buchanan has not only tried to hide compressed files in images to tweet, but also MP3 files and their tests have paid off. In another tweet, invites users to download a second image, rename it with the .mp3 extension, and open the resulting file with VLC to discover "a surprise."
If we download the snapshot in its original size, 2.5 MB, we will be rickrolled. Because yes, the song is the famous and mythical Never Gonna Give You Up by Rick Astley. Of course, despite the fact that the song by itself is what it is, nothing better than accompanying it with the video clip in 4K.