3 ms·
If this article doesn't make you sufficiently paranoid may I refer you to my all time favorite Underhanded C Contest, the leaky image redactor from 2008. The w
by femto113 4y ago
If this article doesn't make you sufficiently paranoid may I refer you to my all time favorite Underhanded C Contest, the leaky image redactor from 2008. The winning entry is just brilliant: it's simple, it works perfectly, does nothing tricky, but still allows near perfect recovery of redacted text.
http://www.underhanded-c.org/_page_id_17.html http://www.underhanded-c.org/_page_id_17.html
- encryptluks2 4y ago[dead]
- icelancer 4y agoWow. Meacham's method is brilliant.
- knodi123 4y agoI don't get it. How is his code treating pixels differently according to intensity?
- manchmalscott 4y agoBecause the code iterates per character, not per pixel. If a pixel's value is '7' and in the redacted zone, the program will iterate over the single character and output '0'. If the pixel's value is actually '174', the program will iterate over all three characters, outputting '000'. Any normal PPM image viewer will display these identically, but high contrast areas like text will be recoverable.
- leereeves 4y agoWhat image format stores pixel values in text?
- manchmalscott 4y agoThe Netpbm family of image formats, including PPM, have both binary and ascii standards. https://en.wikipedia.org/wiki/Netpbm#PPM_example https://en.wikipedia.org/wiki/Netpbm#PPM_example
- femto113 4y agoNotably these formats are designed to be lossless and very simple to work with programmatically so they were used as the intermediate format in a lot of image processing workflows, even where the inputs and outputs are a more common format like JPG (which is extremely hard to manipulate directly).
- oh_sigh 4y agoFunny, the guy who made the chipophone (Linus akesson) and other cool audio projects won 3rd place that year. His site was just on hn a week or two ago but I forget exactly what for
- qiqitori 4y agoReminds me, lots of people take pictures of their driver's license or credit card or whatever using their smartphone and then use their smartphone's builtin image editing tool to make the credit card number (or whatever) invisible before uploading the image to whatever service they need it for. Sounds innocent right? Well, depending on the paintbrush tool used (this affects both Apple and Android) the number will be fully or partially recoverable, because the paintbrush is slightly translucent. The user will repeatedly cover up the number using the same paintbrush tool until they can't see the number anymore, but if you load the result in any (real) image editor and turn up the contrast in that area, you'll see the numbers.
- nukeman 4y agoThis reminds me of a similar story from Dr. Alex Wellerstein (historian of NUKEMAP fame). A Redditor he knew found some redacted nuclear weapons documents, and did the same trick, as the redactions were done with pieces of paper over the slides on a copier. Link: https://blog.nuclearsecrecy.com/2021/05/17/how-not-to-redact-a-warhead/ https://blog.nuclearsecrecy.com/2021/05/17/how-not-to-redact...
- actionablefiber 4y agoI can absolutely see this happening and it's absolutely, absolutely disgraceful that there is no dedicated, clearly marked redaction tool on iOS's image markup tool. I have only ever needed to use that markup for three things: to draw a circle around something, to draw an arrow pointing to something, or to redact something. Users need a tool on the markup editor that they can select and unambiguously know that if they draw a big black rectangle over something, it is going to be replaced by solid #000000 pixels and anything underneath will be impossible to retrieve.
- _8j50 4y agoWhy did the competition stop in 2015?