8 ms·

Why does Numbers hide a huge PNG file in exported Excel sheets?

118 points by rogual 12y ago

th3iedkid 12y ago
What is that image?Any answers from anyone in HN?
lukashed 12y ago
I'm not sure why it's including this in the export, but this is one of the default "Image Fills". http://f.cl.ly/items/1X0M2o0V0f3A463c0a2H/Untitled_numbers.png http://f.cl.ly/items/1X0M2o0V0f3A463c0a2H/Untitled_numbers.p...
- gchokov 12y ago
  I guess the other color image fills are just variation of the original blue image.
- donatj 12y ago
  If you ever dissect an uncompressed pages file there's a lot of junk in there you really don't need. My guess would be that this is a case of that, Apple including the default fill pattern when it need not be included. Uncompressed, an empty pages file includes about a megabyte of XML for a 3x3 sheet with tons of absolutely unnecessary default metadata about the sheet as well as each individual cell. Pages really isn't very good at knowing what it actually needs to include. I spent a few days dissecting the format a few years back at a previous job for a data processing tool. We decided it wasn't worth our time. As for the size, some things simply don't compress well in PNG.
  - deleted 12y ago
    [deleted]
jbrooksuk 12y ago
The first comment on the question itself makes the most sense to me. Edit: Sure, downvote me ;)
eXpl0it3r 12y ago
It doesn't happen to me. No strange image gets included when saving the spreadsheet.
- lallysingh 12y ago
  Maybe it's a default that the user's set (say as part of a user style)?
valevk 12y ago
It doesn't seem to be explicitly associated with Numbers, but with Excel: http://www.it-volpers.net/2011/03/21/disassemble-xlsx/ http://www.it-volpers.net/2011/03/21/disassemble-xlsx/
- UnoriginalGuy 12y ago
  That article doesn't support your conclusion. Did you draw that conclusion because the file is named "image1" in both the OP's article and that one?
  - louhike 12y ago
    According to one of the answer, it is an image to fill used by Excel. So its goal is the same, even if the picture is different.
    - wlesieutre 12y ago
      The image1.png file included by Excel is definitely an image that the author used in the spreadsheet, not a piece of cruft. Since he provides a copy of the xslx file, it's trivial to check: http://i.imgur.com/j1A5vvC.png http://i.imgur.com/j1A5vvC.png
- kyberias 12y ago
  The file in the OP's article was generated by Numbers, not Excel. The png file in your link is there for a reason, since an image (a logo) was added in an Excel spreadsheet. So you are mistaken.
gchokov 12y ago
Can't be just a placeholder. If it was, it would be a single color for a better compression. Hence the whitenoise - it helps to maintain compression ratio low.
jackgavigan 12y ago
Someone should run that image through a steganalysis tool.
- UnoriginalGuy 12y ago
  Or more simply, just MD5 them from two machines and see if the hashes (and sizes) match. It is actually quite hard to find hidden text in "random" images. Quite easy to tell if they're identical always however...
  - DanBC 12y ago
    Most steganography is trivially easy to detect. Good steganography needs a lot of cover data and better systems than manipulating the LSB.
    - nitrogen 12y ago
      If the distribution of bits in an encrypted stream is indistinguishable from normal image dithering, wouldn't encrypted steganography be hard to detect? It wouldn't survive any lossy image transformations, though.
    - MichaelGG 12y ago
      Steganography on normal pictures. If the picture is just random pixels then it would not be detectable.
      - DanBC 12y ago
        Randomness is something that cryptographers have spent a lot of time studying. Introducing non-random data into a random data stream is easy to find unless you're very careful about the amounts of data-to-be-hidden and cover-data.
        MichaelGG 12y ago
        If you encrypt the data first, then you're inserting "random" data as far as analysis goes.
alistair75 12y ago
Pages does it too. Export a document in DOCX format and you get the same PNG file. Export a document in Word 97-2003 format and you get three of these PNG files! http://mcmillan.cx/blog/2014/05/31/bloated-exports-from-pages-5.2/ http://mcmillan.cx/blog/2014/05/31/bloated-exports-from-page...
deleted 12y ago
[deleted]
brad0 12y ago
Here's something interesting. The image only has 47 unique RGB values in it. 47 is such an arbitrary amount though. It doesn't go into power of two cleanly.
- brad0 12y ago
  The colours go from 16708e and increase all RGB values by one. So the next ones are 17718f, 187290, 197391 etc.
brad0 12y ago
From the looks of the OOXML format, the image there is just used as a resource. http://web.mit.edu/~stevenj/www/ECMA-376-new-merged.pdf http://web.mit.edu/~stevenj/www/ECMA-376-new-merged.pdf xl/theme/_rels/theme1.xml.rels refers to image1.png. I'd say it's a default background of some description. Still, it would be cool if there was something in there. Maybe taking a look at the frequency of the bytes would help?

118 points by rogual 12y ago

What is that image?Any answers from anyone in HN?

I'm not sure why it's including this in the export, but this is one of the default "Image Fills". http://f.cl.ly/items/1X0M2o0V0f3A463c0a2H/Untitled_numbers.png http://f.cl.ly/items/1X0M2o0V0f3A463c0a2H/Untitled_numbers.p...

gchokov 12y ago
I guess the other color image fills are just variation of the original blue image.
donatj 12y ago
If you ever dissect an uncompressed pages file there's a lot of junk in there you really don't need. My guess would be that this is a case of that, Apple including the default fill pattern when it need not be included. Uncompressed, an empty pages file includes about a megabyte of XML for a 3x3 sheet with tons of absolutely unnecessary default metadata about the sheet as well as each individual cell. Pages really isn't very good at knowing what it actually needs to include. I spent a few days dissecting the format a few years back at a previous job for a data processing tool. We decided it wasn't worth our time. As for the size, some things simply don't compress well in PNG.
- deleted 12y ago
  [deleted]

jbrooksuk 12y ago

The first comment on the question itself makes the most sense to me. Edit: Sure, downvote me ;)

eXpl0it3r 12y ago

It doesn't happen to me. No strange image gets included when saving the spreadsheet.

lallysingh 12y ago
Maybe it's a default that the user's set (say as part of a user style)?

valevk 12y ago

It doesn't seem to be explicitly associated with Numbers, but with Excel: http://www.it-volpers.net/2011/03/21/disassemble-xlsx/ http://www.it-volpers.net/2011/03/21/disassemble-xlsx/

UnoriginalGuy 12y ago
That article doesn't support your conclusion. Did you draw that conclusion because the file is named "image1" in both the OP's article and that one?
- louhike 12y ago
  According to one of the answer, it is an image to fill used by Excel. So its goal is the same, even if the picture is different.
  - wlesieutre 12y ago
    The image1.png file included by Excel is definitely an image that the author used in the spreadsheet, not a piece of cruft. Since he provides a copy of the xslx file, it's trivial to check: http://i.imgur.com/j1A5vvC.png http://i.imgur.com/j1A5vvC.png
kyberias 12y ago
The file in the OP's article was generated by Numbers, not Excel. The png file in your link is there for a reason, since an image (a logo) was added in an Excel spreadsheet. So you are mistaken.

gchokov 12y ago

Can't be just a placeholder. If it was, it would be a single color for a better compression. Hence the whitenoise - it helps to maintain compression ratio low.

jackgavigan 12y ago

Someone should run that image through a steganalysis tool.

UnoriginalGuy 12y ago
Or more simply, just MD5 them from two machines and see if the hashes (and sizes) match. It is actually quite hard to find hidden text in "random" images. Quite easy to tell if they're identical always however...
- DanBC 12y ago
  Most steganography is trivially easy to detect. Good steganography needs a lot of cover data and better systems than manipulating the LSB.
  - nitrogen 12y ago
    If the distribution of bits in an encrypted stream is indistinguishable from normal image dithering, wouldn't encrypted steganography be hard to detect? It wouldn't survive any lossy image transformations, though.
  - MichaelGG 12y ago
    Steganography on normal pictures. If the picture is just random pixels then it would not be detectable.
    - DanBC 12y ago
      Randomness is something that cryptographers have spent a lot of time studying. Introducing non-random data into a random data stream is easy to find unless you're very careful about the amounts of data-to-be-hidden and cover-data.
      - MichaelGG 12y ago
        If you encrypt the data first, then you're inserting "random" data as far as analysis goes.

alistair75 12y ago

Pages does it too. Export a document in DOCX format and you get the same PNG file. Export a document in Word 97-2003 format and you get three of these PNG files! http://mcmillan.cx/blog/2014/05/31/bloated-exports-from-pages-5.2/ http://mcmillan.cx/blog/2014/05/31/bloated-exports-from-page...

deleted 12y ago

[deleted]

brad0 12y ago

Here's something interesting. The image only has 47 unique RGB values in it. 47 is such an arbitrary amount though. It doesn't go into power of two cleanly.

brad0 12y ago
The colours go from 16708e and increase all RGB values by one. So the next ones are 17718f, 187290, 197391 etc.

brad0 12y ago

From the looks of the OOXML format, the image there is just used as a resource. http://web.mit.edu/~stevenj/www/ECMA-376-new-merged.pdf http://web.mit.edu/~stevenj/www/ECMA-376-new-merged.pdf xl/theme/_rels/theme1.xml.rels refers to image1.png. I'd say it's a default background of some description. Still, it would be cool if there was something in there. Maybe taking a look at the frequency of the bytes would help?