Security issues posed by PNG metadata

NOTE: this message has been formatted with a fixed-width font to allow
minimal formatting to work. I haven't added any other markup.

Background
==========

This comes out of the eXIf chunk discussion but it also applies at least to
the existing (Adobe documented) embedding of XMP and the existing embedding
of EXIF, IPTC and XMP data within encoded/compressed zTXt chunks.

The problem
===========

Most people who use digital images, particularly JPEG but including PNG and
even GIF, are only peripherally aware that there is extra information,
"metadata", in there.  People who use professional digital camera image
manipulation software (not the stuff shipped with cheap cameras) and people
who write image handling libraries become aware of it but don't always
realize just how revealing such information can be.

On the contrary people who want to obtain private information about other,
ordinary, people know full well it is there.

If you send a digital photograph of a family member to a friend you tell
the recipient where *you* were at the time you took the picture.  If you
post it on a publicly readable site or list (like this one) that
information will be made public.  At least some social media sites know
about this:

https://www.facebook.com/help/community/question/?id=10201464422674131

In my opinion the issue is of such significance and the consequences are so
poorly understood that a modification to the ISO-PNG specification is
justified.

Examples of the issues raised by metadata
=========================================

"Regular" PNG text chunks; "Copyright" and "Author" potentially reveal who
took the picture, "Creation Time" says when and "Source" helps identify who
took the picture.  The image itself may say where it the picture was
taken.  The "Software" chunk provides additional information about image
editing and image editing software frequently adds additional text chunks
with unregistered keywords that include the date of an edit and in some
cases the author.  Even the version of the software used can be revealing
if someone knows that you have a particular version of that software.

"Opportunistic" PNG text chunks; zTXt chunks with "Raw profile type "
prefixed keywords are used to encode EXIF, XMP and IPTC information by some
image processing software.  This happens automatically and the result is
obfuscated; the raw data is hex encoded then compressed.

XMP: Adobe specify that XMP packets should be encoded in PNG with an "iTXt"
chunk.  XMP can contain pretty much all the data in EXIF plus further
revealing information about the image editing.  In fact so far as I can
determine the XMP packet can contain anything; ISO 16684 defines the basic
format with no list of the information it contains, ISO 12234 specifies a
set of information for digital camera images but there is no obvious way of
eliminating unexpected or hidden information short of checking every
element for compliance with 12234.

EXIF: as has been observed, EXIF contains GPS information and cameras
bought in Western countries typically include it automatically (many
countries do not permit use of GPS devices).   Cameras include a "user
comment" field and professional cameras may support ways to set this and
author/copyright information (I don't know, but the fields are there in the
output of some cameras.)  Most modern cameras include creation date
information.  All cameras include a thumbnail which may persist even if the
image is edited to remove information.

IPTC is intended to retain exactly the kind of information being discussed.

The presence of apparently innocent information, such as "Creation Time" in
PNG, has significant consequences.  If it is preserved across modifications
of the image it can be used to reduce the search space for the original of
a modified image.  The reduction is enormous; there are about 30 million
seconds in a year.  Regardless of whether the creation date is even correct
if I know that the original image recorded it I can find the image by
visual examination of the possible images in a database of images
containing 1 billion images per year of collection.  I just have to look at
33 of them; a haystack sorted by straw dimension.

Solutions that do not work
==========================

Simply eliminating all this information when an image is published is
clearly not the answer and, because of copyright issues, is potentially
both immoral and illegal.

Likewise leaving it without informed consent certainly raised privacy
issues.

The FaceBook discussion referenced above reveals that the problem is
treated with a religious fervor which does not permit admission of multiple
conflicting requirements.  Any automated solution is out of the question.

The various publishers of images have conflicting requirements with respect
to metadata.  While it might be possible to group different publishers into
a small set of groups each with a consistent requirement this does not
solve the problem either.  We do not know which group any given publisher
falls into; the publisher must tell us!

The solution
============

The only viable solution is for the publisher of an image to make an
informed choice about what image metadata to retain or remove.  This
solution has three elements:

1) The publisher has to make the decision.  It is not optional because
there is no default; removing information may be illegal, leaving it in may
breach the publisher's privacy.
2) Any software the publisher uses has to enable this; a lot, maybe most,
software does not.
3) The publisher has to understand the information being included.

The last item is clearly the most difficult; even the author of the
software may not understand what is in there and, anyway, the amount of
information can be massive and the software author may not want or be able
to communicate all of it.

Consequence for PNG
===================

This issue is a consequence of the file format however the solution is
clearly outside the scope of the file format.  A human (entity) decision is
required.

The responsibility of the file format maintainers is to ensure that item
(3) above can happen rather than attempting to ensure that it does.  For
PNG this means making sure authors of PNG software know that the issue is
there by documenting it.  This just means documentation in general terms;
we cannot analyze all the security issues because metadata is added using
formats outside our control.

For this reason I suggest adding a section to the ISO-PNG specification
that gives examples of the security issues raised by metadata; more concise
enumeration of issues I listed above together with any others we may come
up with.

-- 
John Bowler <[email protected]>
+1 (541) 450-9885
PO BOX 3151
KERBY OR 97531-3151
USA

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi

_______________________________________________
png-mng-misc mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/png-mng-misc