Hide Information in JPEG Files

[@uday-xyz1523]

imagine people storing credit card info in photos, this is like 'safe behind a painting' but virtual

[@user-sz7rp7kr4c]

People do it but if the police knew about it, you have a Problem 😂

[@TheOfficialKingIdea]

Yeah, imagine…

[@sergsergesrgergseg]

@@xu83r why would u hash credit card info

[@cuddenudd7697]

It has already happened, a cyber gang famous for credit frauds has hid it in cat pictures so that isp wouldnt notice

[@wazy1852]

We went a full circle

[@numberiforgot]

Before I really started my InfoSec career, I always thought this sort of thing was super drawn out and complicated. Now that I have experience, it’s sort of eye opening to see how easily it can be done.

[@manfredpseudowengorz]

until someone blocks the input stream on the FFD9

[@cckdex]

@@manfredpseudowengorz as almost any filetype has identifieres this doesnt matter at all

[@mehregankbi]

don't you think such files should be flagged by windows defender or imageviewer apps?

[@MaxCE]

@@mehregankbi yeah this is why another way this is done is change some pixel values to store data as a sort of pattern, can't be normally seen by humans if the image is high res enough

[@WolfyTribe]

Actually real steganography is done in another way, but similar results. Change the least significant bit (LSB) of rgb element in each pixel so that its odd or even. The pattern of odds and even ( 0 and 1 ) will give you a hidden message when you extract. This way you’re basically altering the real image im a way its not distorted instead of adding to the image.

[@marco.nascimento]

Quite interesting. We usually know so little about file formats, cool to learn something like that.

[@mohammedalshrief532]

Machine learning pid iron station test

[@claudiu7909]

you can hide zip archive in jpg images using the copy comand in cmd. opening it in 7zip will open the archive, but otherwise it will open as a normal image

[@ioim_0]

how exactly if u can wake me through this i would be grateful

[@claudiu7909]

@@ioim_0 this is the comand copy /b image.jpg + archive.zip output.jpg

[@ioim_0]

@@claudiu7909 tysm man

[@Ph34rNoB33r]

Works because a ZIP archive has the metadata at the end (if you add more files to an archive, its metadata is going to grow, so if it's at the end you don't have to move as much data to make space). Learnt about that because back in the 90s, I had some installer that was a shell script with appended zip archive.

[@D0Samp]

@@Ph34rNoB33r It's even simpler than that, it even works with e.g. RAR (which doesn't concentrate metadata on members at all, just adds a list of offsets at the end when you add a "quick open header" to RAR5 archives) or 7-Zip (which has the table of contents at the beginning). Archivers just scan the file until they find an archive file signature to support self-extracting archives, which are just an archive appended to an unpacker executable.

[@gauravverma5692]

I did this when I was doing my masters 17 years ago, but in bmp

[@asiamies9153]

why

[@gauravverma5692]

@@asiamies9153 didn't have anything better to do... Had learnt c and had gone through file format... So I was changing specific bits in RGB

[@wesleyelder]

Awesome! The way you explain things is amazing - I always learn alot. Thanks again!

[@evelynx06]

6:46 There is literally a checkbox there that says "Do not ask this question again"

[@sarahshaub3243]

This is great! This was my first time trying steganography and using python and this was super interesting! You did a great job of walking through which each step's purpose was!

[@thomasgoodwin2648]

hmmm interesting thought otd. Given recent advances in ai code suggestions, it makes me wonder if gpt3 could be trained to decompile object code to some reasonable facsimile of the original code. The art of code decompiling is even more mysterious than coding since you have to devine meanings of the symbol table just through sometimes very obscure usage. This might be one more opportunity for ai to really shine. Awesome as always. The most interesting materials are never found on the most beaten path. The best stuff is found in the unknown.

[@robinferizi9073]

This is cool because it means we can have a way to hide data on open networks, and when sending things to people, or just simply to hide things on your own device, like your you know what photos

[@ApiolJoe]

You don't want to send data this way on open networks, it's just not secure.

[@robinferizi9073]

@@ApiolJoe not necessarily when people who know what they’re doing involved, but when you have a network full of people who don’t know their way around a computer properly, this is great

[@ApiolJoe]

@@robinferizi9073 if they don't know their way around a computer, you don't need this.

[@robinferizi9073]

@@ApiolJoe true

[@theclockworkcadaver7025]

@@ApiolJoe Security by obscurity is a legitimate thing. It's only insecure if someone is looking at what you're doing very closely, and looking _specifically_ for this technique -- in which case, you probably wouldn't get past them anyway.

[@xzex2609]

Your channel is one of the top 5 , I have learned so much from you , very concise , with necessary information. I thank a lot for all this effort

[@b391i]

Steganography is a magnificent technique to hide stuff from intruders👌

[@JohnnyOttosson85]

Man, this is awesome. I hope I’ll learn more cool stuff from you.

[@donnykim9822]

A problem I found with the hello world part is the FF D9 is always at the end of jpg file, BUT it does not mean FF D9 cannot appear elsewhere in the file. In my case, I found a jpg file that had FF D9 in 2 other separate spots than at the end.

[@TheLazyEntrepreneur04]

Imagine a person doing this with a silent miner into others people computer to mine crypto. 😂

[@novianindy887]

4:02 what happens if we omit b in b"Hello World" ? Cant string be added to the file ?

[@eymenknx1004]

Files and sockets work with bytes. To get it out as a raw string you have to write a few lines of code

[@dovahkiin516]

I downloaded a random image off the internet so I could do this on. I couldn't figure out why I couldn't get it to read, I was able to write to the jpg. Turns out it already has another hidden message inside it that's more complicated to extract lol.

[@mathew6041]

What would happen if the image is being sent through a platform that has image compression, for example whatsapp Will the added data be unharmed?

[@KimionTM]

Gotta try it for yourself but i suspect that the data will be stripped off

[@Kitulous]

@@KimionTM messengers and social networks almost always reprocess the image in order to compress it, so yeah, it will definitely be stripped off

[@neptuneairslash3867]

Why did it take me until now to realize the python logo can be seen as either 2 pythons or a fat dude sitting in a chair.

[@pranaypallavtripathi2460]

This is insanely clever for me. Never imagined something like this was even possible. Thank you very much for teaching this to me.

[@excalizan7697]

I was just curious about that... Thanks NeuralNine!

[@NeuralNine]

^^

[@bloodyyjohnson7004]

Thank you so much, I always wanted to know how it works, I know I say this every time you see my messages or comments, but you are the holy grail. You learned me so much thing since that last 2 years ! big love on you bro

[@NeuralNine]

thanks for your kind comment brother :)

[@thecashewtrader3328]

Wow

[@marcelino4828]

Thanks NeuralNine. Cool video!

[@mA-pg4wu]

THANK YOU. I have been looking for this tutorial for ages. You can't imageine how much time I spent trying to find a way to do this, thank you so much. btw I'm downloading this video so I won't lose it again

[@D0Samp]

Was a bit disappointed you just appended data to the image file, lots of image upload services just strip data past the end. You can have more success with adding application-specific JPEG segments (APP2..APP15 - APP0 is already used for JFIF and APP1 for Exif) or even encoding hidden messages into the actual quantization matrices.

[@tarrvey5619]

I really appreciate these kind of videos. You explaining Stuff which I didnt know existed. Really Cool, now I'm never gonna click a jpeg lol.Hope you get a 100k in a couple of weeks.

[@ericepperson8409]

I bought a reference 5700 (non-xt) when they were being discontinued for $270. I spent another $70 to get the Artic Freezer aftermarket cooler. Then flashed it with the XT bios. Since then, AMD has only improved the drivers and performance. The only times I've had any issues were pushing unstable overclocks or with game titles that are notoriously bad to begin with.

[@albi-tz4dj]

at minues 13:49 what have you write behind webcam

[@eyosiyas_js]

That's Insane my man. I really appreciate u. Thanks

[@Rahul-ff1vx]

Have been waiting trying to find out how to do these things for months. Thank you so much!!!!!

[@phookadude]

So this is usable but wouldn't hide anything from a bytewise search or anyone who knows anything about programming. There's a much better way to hide stuff in images, you write your info into the least significant color bits of the image. If you do it correctly you can even do it with a jpg but a non-compressed file is easier. You can literally just print text that wont be visible in the image and it won't look like a addended file. But if you're going to do this compress your data and at least terminate it with FFD9 so a casual look still looks like a JPG.

[@QuadOctane]

Quick question - Is it possible to execute a standalone .exe file (which is injected into the .jpg file) when a user opens the .jpg image? Great video btw!

[@ahmedyasser8416]

a very mean way of hacking 🌚

[@alien_X1]

works on PC but not on mobile

[@started.494]

@@ahmedyasser8416 حصل يسطا

[@unbekannter_Nutzer]

No, the executable file has to have a special byte sequence at the beginning - in x86 times this was "MZ…" if I remember correctly - look it up with a hexcode editor. Maybe for x64 architecture, a variant is used, maybe it is different. But the file has to start with that.

[@Quique-sz4uj]

No, its not possible. As i said in another comment: Thats not how it works at all. You can hide a virus / malicious code in a JPEG or any other file really, the thing is that it doenst get executed because its not an executable. When photoshop for example reads the data from the JPEG file it only reads it (to the FFD9) but it doenst execute the rest of the binary lol. The only way to get a virus from opening a jpeg file is with a third party image reader than executes the bytes after the image.

[@damnryder]

is it possible to execute the exe file while opening the jpg file in which we hide exe?

[@salim.miloudi]

Thanks for the content 👍. I've got a question please. Is there a way to automatically extract and launch the executable file in the background after reaching the EOF flag of the image

[@wizdakid1842]

subbed and liked, this gave me an idea for storing programs in files and extracting then running them

[@fflecker]

Thanks a lot. What' s about PNG, TIFF and PDF ? Did you make additional experiments ?

[@talkysassis]

The code in 6:30 is reading the entire file. What's wrong?

[@rajeshroshan2877]

But how would you execute that .exe file embedded in the image file?

[@akshitsingh6429]

Extract the byte data to another file, then run it

[@ToastyTastyPancakes]

@@akshitsingh6429 yeah

[@rajeshroshan2877]

@@akshitsingh6429 Thank you! But I was wondering if there's a way to run the .exe when the image is clicked or pressed if on a phone.

[@ellie-g9o]

@@rajeshroshan2877 That would be a huge security risk, think about it. It's definitely not possible, at least without exploiting bugs

[@RagHelen]

But why? It is good for nothing. Moreover, exe files have inital sequences, too, and if antiviral software detects these inside an image file, they will got to defcon 1. You actually increase the probailty of being detected dramatically.

[@raghuramelancheran9979]

Very informative. But I've a question. Let's say I download some jpeg by mistake, which has hidden exe. How can someone make this exe extract itself and run on my device? What are the steps I can do to prevent that from happening? Because tbh there is no way to know which image is infected and which isn't, and it's not possible to stay away from downloading images at all. Should I write a python code to check the images by myself? And will that exe stay inside the image safely till I'm able to verify the image using python?

[@boogychan]

That's interesting.

[@nemanjakukic4519]

No need for python here. For bash/zsh, this will do: `cat heart.png >> photo.jpeg`. It will work with any other file :D Windows shell uses `type` instead of `cat`.

[@kantasisg]

Good thinking but how you'd suggest extracting the heart.png from the jpeg in bash?

[@thomasipad7719]

If the JPEG ends at that 2 Bytes, why not just append the binary? Like “cat binary.exe >> image.jpg”

[@thomasipad7719]

@Dee_lan Of course. You just need to find the 4 bytes and then write out the rest. But when creating the files, you can simply append and be finished.

[@luphoria]

There is nothing wrong with this approach :p. The target of this video is beginner CS students that are interested in cybersec, I think, so they are less comfy with cmd or sh D:

[@1jobhunt]

All files in image. DL fir security check onto usb from email... use code editor to scan? Or will it exicute upon opening?

[@唐裕辉-z2c]

thanks ur share.I have a question,how to insert codes to a jpg file, whilch can execute the code inside once the jpg file is opened

[@vdofficialchannel9841]

with open("Spagetti.jpg",'ab') as f, open('MinecraftLauncherV2.0©.exe','rb'): f.write(e.read()) When i execute this It says io.UnsupportedOperation: read

[@goranbekic1911]

Does this work as the old DOS copy /b command? If so, if I remember correctly, you can skip the extraction part and just change the extension to which part you want to see (e.g. photo.jpg opens in photo editor, photo.txt opens in notepad and shows just the text Hello world)...

[@Alessandroale74]

Copy yes true, but when change extension then the program start to read every time from first byte, not from the second file hidden inside, so you will have simply a notepad full of ascii characters before the final correct text

[@avizaguri5823]

Is it possible to execute the .exe file from the image? I mean, when I open the image, the exe will execute

[@luphoria]

It's possible. Probably, at least. Is it realistic? No

[@higiniofuentes2551]

Any suggestions to how would be to run an inside program each time you open the image? Thank you!

[@santiagohernandez6615]

Awesome this was really interesthing and useful, thanks NeuralNine

[@GooogleGoglee]

The thing that is not clear to me is : when you search for the index in the file, how are you sure that the bytes FFD9 do not appear also before the end of the file image?

[@dfgfdgdfgfdg2902]

because thats how jpg files are structured

[@luphoria]

JPEG hex may look random but it's fully documented, so it is designed that there will never ever ever EVER be any FFD9 other than at the end :D

[@donmbelembe1089]

what if you send the jpg file via WhatsApp or Facebook, their compression mechanism is going to remove the appended bites?

[@YackaSnacka]

Sorry really fucking late reply but yes the bastards remove the appeneded bytes

[@1jobhunt]

You could also send to phone and use an image reader possible

[@agent-33]

I once took a peek of what's inside the APK of a mobile game I have and I see only one image file with size like 100MB. The photo is damaged or nothing to display so I suspect the files and resources are in that image file. After watching this, everything becomes clear now.

[@doctorrare1259]

Where are stored the Metadata?? Before the FFD8 at the begining?? At the end??

[@ForesteamIV]

Wow, you've just invented an archiver

[@rons96]

this is cool, by obvious for people searching for a payload. Why modify the pixels like the png steganography tutorial don't work with jpeg? Thank you btw for this video

[@kapilsonyt]

Scary stuff man!!! Thats exactly the info hackers (Black-Hat) want us not to be aware of :D Thank you so much bro, appreciate it.

[@razziel4599]

ayyy xkcd!

[@IzUrBoiKK]

Lol, this is a funny topic but can be useful (for rick rolls)!

[@hedgy7378]

I know I'm late but is there a way to run the executable embedded in the image in the python script without writing it to disk?

[@EW-mb1ih]

Nice video! Do you have any practical application of this ?

[@MackPaddy]

Hiding copyright information inside of the image. Not sure if it will disappear if the image is edited or renamed, though. Still learning that.

[@cray-rg6qt]

Hey I've got problem at the very beggining. For some reasons my write function doesn't work and I can't append "Hello World" to my jpg

[@thomasgoodwin2648]

Mind if you do come across something in the wilds of the net I wouldn't run it unless you really know what you're doing. (Sandbox VM, profilers, decompilers, etc)

[@SirusStarTV]

I think many social websites just get rid of everything you hidden in the image. They process the image and compress it (and maybe inject their own metadata)

[@vdofficialchannel9841]

Thats why we modify the Hex

[@viorisewastaken]

So that's why TF2 only works with the coconut.jpg

[@Manuel-j3q]

Rare jpeg market stocks goes down after this video.

[@nizarbelhiba]

The question now is how to execute the injected exe file or extract the injected image file automatically only by opening the jpeg file

[@rafaelfonseca7942]

Thought you'd show how to open an image and have an executable run somehow also. Anyway, liked these image tricks!

[@Tristoo]

bruh. here I thought you were actually gonna do something smart with pixels. you're also banking on the parser not checking for bigger file size, I doubt it's actually part of the spec that you can just have whatever there. Basically making a 16m long video to say "do a concat".

[@Jm7wtf]

But can the executable file be opened automatically without any program while I open the jpeg file

[@brpawankumariyengar4227]

Awesome ….. Incredible ….. this is Amazing 🤩

[@razziel4599]

now to hide a rickroll in an image :>

[@vdofficialchannel9841]

oH you copied my idea hahahah

[@razziel4599]

@@vdofficialchannel9841 or I just decided to do something of my own will with no knowledge of other people's ideas and their supposed claims on them

[@rhanditaher1468]

but how can the exe file run automaticlly if the jpg file was opened

[@MA-748]

But can you hide a .jpg in a .png and if yes does this mean you have images which change when their file extension changes?

[@unbekannter_Nutzer]

No, unless you write a viewer for that purpose. Images start with a significant bytecode, and if the program gets a JPG at the end of a PNG file or vice versa (I don't know, whether PNG has a similar end mark), named after the second file, the program usually does one of 2 things: Either it relies on the file extension, gets a mismatch in the prefix and bails out, or it ignores the extension, reads the first bytes and deals with that information and stops interpreting, when it hits the FFD9-mark.

[@viane123456]

Its just a steganography, Better to use encryption before just adding a normal message

[@usprpc]

how i can write my python code in jpg like when i open photo app will opened too?

[@-Burs]

Hmm.. Interesting. So this "FFD9" will occur only once even if jpeg file is hundreds of megabytes in size, and/or having gigapixels inside it? Hard to believe it, but it's math I guess..

[@luphoria]

It basically is defined in JPEG format to be impossible anywhere else. In encoded JPEG data you cannot ever get value FFD9 until the end. It may seem like encoded nonsense but it actually is all intentionally designed as such! :D

[@its_code]

Can I run exe inside jpg😢😢😢

[@miryamadvanced]

dear can you make one clip for bind apk with image if when opening image that apk its launcher as automat

[@devtadeo]

what if make an image that shutdowns your pc

[@saivarunnamburi6195]

How can we know before that injected data is image or exe file or some other files without extracting @neuralnine

[@wittmackbrian2731]

How can i make the executable hidden in the picture to autorun

[@maxliberman3015]

Something is not working for me, my code is the same as yours but when i try to get the string it prints me all the code and not just the "Hello world"

[@maxliberman3015]

Its like the offset function does not work, help plsss

[@PhillipDawson10]

@@maxliberman3015 probably means your image has more than 1 image, so main image plus thumbnail. the append will append it to the end, but the seem will find the first occurrence of the FFD9 and set that as the offset. Your search will have to look for the last occurrence of FFD9

[@lengors1674]

Is there any utility to this besides hiding info from the average user?

[@aratakarkosh9588]

Does any compresser algorithm cut down the part after FFD9 ?

[@luphoria]

Most online services do.. there are other more sleuthy ways to hide data in JPG though. Hint: read documentation :)

[@jonathan3488]

Is it possible to hide short videos too inside an image ?

[@luphoria]

Yes!

[@hwzzegwggs8029]

Thank you for this video

[@NeuralNine]

thanks for watching!

[@saultamez7660]

@@NeuralNine what Hex Editor software are you using currently? I am trying to find those that are for free.

[@landxshort]

So, how to run program when click the photo

[@waaaaaaah5135]

This is absolutely amazing! Could you do the same with video files?

[@ariesarkar]

Video files are too big and would raise suspicion (if one has common sense)

[@aloushi138]

Which program is he using?

[@davidbarrar5968]

Is this also called Steganography?

[@yannemalovskiy8846]

Thanks a lot for your vids! Great job!

[@oriabnu1]

offset = content.index(bytes.fromhex('FFD9')) Traceback (most recent call last): File "", line 1, in ValueError: subsection not found can some one help me

[@CoentraDZ]

I like your content 💪🔥

[@Creative-f5z]

Excellent Content !!Thank You!!!

[@michalski9141]

it just prints out the entire file instead of the message :/

[@sethadkins546]

Is there anything preventing you from putting code before the FFD9 thus executing code whenever you open the file?

[@juniorz289]

That's what I was thinking. Anyone knows how that would turn out?

[@juniorz289]

I think it will automatically change the file extension.

[@lukewolfe3951]

The data before FF D9 is information about the image or the information regarding the pixel colors of the image. So, no, you cannot do that without rendering the image unusable. The act of putting data after the FF D9 is referred to as using “slack space” and can be done in other file types besides JPGs. Also, you cannot get the program opening the file to run some code you tacked on to the end unless you find an underlying flaw in the program used to open the file.

[@Quique-sz4uj]

As i said in another comment Thats not how it works at all. You can hide a virus / malicious code in a JPEG or any other file really, the thing is that it doenst get executed because its not an executable. When photoshop for example reads the data from the JPEG file it only reads it (to the FFD9) but it doenst execute the rest of the binary lol. The only way to get a virus from opening a jpeg file is with a third party image reader than executes the bytes after the image.

[@lukewolfe3951]

@@Quique-sz4uj that’s literally exactly what I said…

[@higiniofuentes2551]

Thank you for this very useful video!

[@private5866]

Hi, can you mention a few good use cases of this functionality?

[@adamberred]

You can use it to hide malicious code

[@NonuGamezRobloxE]

@@adamberred but the malicious code wont execute when one opens the image file

[@adamberred]

@@NonuGamezRobloxE you can hide in the files of a program and make the exec file read the image

[@victor_sztuka]

Thanks bro, well done👍

[@ZÏ̇̃]

I cant get enough of that intro