Exif Smuggling (2025)
github.com
Exif Smuggling (2025)
1–10 of 32 posts
Re: Exif Smuggling (2025)
#2Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)
Re: Exif Smuggling (2025)
#3Mildly annoying how almost everything strips out EXIF data nowadays, in part due to security concerns like this, and then I can't find out what camera, lens, and settings were used to take photos.
Re: Exif Smuggling (2025)
#4Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)
I'm not sure if this is exactly what you're referring to, but apparently years ago there were exploits bundling JAR files into GIFs to sneakily have them executed by the Java browser plugin: https://en.wikipedia.org/wiki/Polyglot_(computing)#GIFAR_att...
Re: Exif Smuggling (2025)
#5Weren't similar techniques already used years ago by malvertizers to hide malicious code into images published for ads so it wouldn't be detected? (although it might have been more like steganography)
if anything i would use EXIF data to enhance stego.
generally its the JPEG standard that allows the payload, manipulation by abusing EXIF is how you operate the exploit.
there is a 64k file segment specified for JPEG, and you can abuse it to hold any "data" you want, as well as extending to other segments, for more storage.
the raw steganography in most primative form is a comparison of two photos, one of which is pixelshifted to encode the data.
in advanced form, the pixels hold the encrypted data, but the application segments of the JPEG hold keys and or matrix values, and you need a reference image. you can move fairly large volumes of ASCII representation like this before its noticed
you basicly write a webpage that local caches the payload and keys, then abuses EXIF to build and execute an exploit on the target.
Re: Exif Smuggling (2025)
#6Mildly annoying how almost everything strips out EXIF data nowadays, in part due to security concerns like this, and then I can't find out what camera, lens, and settings were used to take photos.
My static site generator strips out exif data from images and I would expect all sensible sites would do the same. There is a lot of personal information jammed in there - if you post a picture of your dog making a funny face to social media you don’t want the exact GPS coordinates of your house plastered over the internet.
You have to be selective though, some of the EXIF data specifies things like color spaces and orientation that is used by browsers for displaying the image properly.
Re: Exif Smuggling (2025)
#7I hid my toy vibe coded site's code inside the alpha channel of its logo. https://dogself.com
I probably should have minified it too...
Re: Exif Smuggling (2025)
#8Oh, that's clever. It's not just hiding the payload in the Exif, it's hiding the fact that the payload came from the network at all, by reading it from the browser cache (presumably after embedding the image into a page the user visited).
So you have a package that doesn't include (directly) malicious code or make network calls, yet it can still run malicious code from the network. This is much better than simple obfuscation because you can vary the payload, like a command-and-control server.
Re: Exif Smuggling (2025)
#9Why is this a link to a random fork that has no commits, rather than the original?
Re: Exif Smuggling (2025)
#10Mildly annoying how almost everything strips out EXIF data nowadays, in part due to security concerns like this, and then I can't find out what camera, lens, and settings were used to take photos.
My static site generator strips out exif data from images and I would expect all sensible sites would do the same. There is a lot of personal information jammed in there - if you post a picture of your dog making a funny face to social media you don’t want the exact GPS coordinates of your house plastered over the internet. You have to be selective though, some of the EXIF data specifies things like color spaces and…
For my personal website I have a lot of photography-oriented blog posts [1], but I have special code to strip out GPS info from the location if it's close to my home [2].
EDIT: my vibe-coding slop agent put my home GPS lat long in the example config in the README lol. Please don't rob my house; I'll go run git-filter-repo later.
[1] https://daniel.lawrence.lu/blog/2023-12-20-trip-to-europe/