Re: Security issues posed by PNG metadata

I'm sorry, how is copyright information a security issue?

I use copyright information all the time myself. It's useful for, well, 
copyright.

On 15/01/17 06:24 PM, John Bowler wrote:
> NOTE: this message has been formatted with a fixed-width font to allow 
> minimal formatting to work. I haven't added any other markup.
>
> Background
> ==========
>
> This comes out of the eXIf chunk discussion but it also applies at 
> least to the existing (Adobe documented) embedding of XMP and the 
> existing embedding of EXIF, IPTC and XMP data within 
> encoded/compressed zTXt chunks.
>
> The problem
> ===========
>
> Most people who use digital images, particularly JPEG but including 
> PNG and even GIF, are only peripherally aware that there is extra 
> information, "metadata", in there.  People who use professional 
> digital camera image manipulation software (not the stuff shipped with 
> cheap cameras) and people who write image handling libraries become 
> aware of it but don't always realize just how revealing such 
> information can be.
>
> On the contrary people who want to obtain private information about 
> other, ordinary, people know full well it is there.
>
> If you send a digital photograph of a family member to a friend you 
> tell the recipient where *you* were at the time you took the picture.  
> If you post it on a publicly readable site or list (like this one) 
> that information will be made public.  At least some social media 
> sites know about this:
>
> https://www.facebook.com/help/community/question/?id=10201464422674131
>
> In my opinion the issue is of such significance and the consequences 
> are so poorly understood that a modification to the ISO-PNG 
> specification is justified.
>
> Examples of the issues raised by metadata
> =========================================
>
> "Regular" PNG text chunks; "Copyright" and "Author" potentially reveal 
> who took the picture, "Creation Time" says when and "Source" helps 
> identify who took the picture. The image itself may say where it the 
> picture was taken. The "Software" chunk provides additional 
> information about image editing and image editing software frequently 
> adds additional text chunks with unregistered keywords that include 
> the date of an edit and in some cases the author. Even the version of 
> the software used can be revealing if someone knows that you have a 
> particular version of that software.
>
> "Opportunistic" PNG text chunks; zTXt chunks with "Raw profile type " 
> prefixed keywords are used to encode EXIF, XMP and IPTC information by 
> some image processing software. This happens automatically and the 
> result is obfuscated; the raw data is hex encoded then compressed.
>
> XMP: Adobe specify that XMP packets should be encoded in PNG with an 
> "iTXt" chunk.  XMP can contain pretty much all the data in EXIF plus 
> further revealing information about the image editing.  In fact so far 
> as I can determine the XMP packet can contain anything; ISO 16684 
> defines the basic format with no list of the information it contains, 
> ISO 12234 specifies a set of information for digital camera images but 
> there is no obvious way of eliminating unexpected or hidden 
> information short of checking every element for compliance with 12234.
>
> EXIF: as has been observed, EXIF contains GPS information and cameras 
> bought in Western countries typically include it automatically (many 
> countries do not permit use of GPS devices). Cameras include a "user 
> comment" field and professional cameras may support ways to set this 
> and author/copyright information (I don't know, but the fields are 
> there in the output of some cameras.)  Most modern cameras include 
> creation date information.  All cameras include a thumbnail which may 
> persist even if the image is edited to remove information.
>
> IPTC is intended to retain exactly the kind of information being 
> discussed.
>
> The presence of apparently innocent information, such as "Creation 
> Time" in PNG, has significant consequences.  If it is preserved across 
> modifications of the image it can be used to reduce the search space 
> for the original of a modified image. The reduction is enormous; there 
> are about 30 million seconds in a year.  Regardless of whether the 
> creation date is even correct if I know that the original image 
> recorded it I can find the image by visual examination of the possible 
> images in a database of images containing 1 billion images per year of 
> collection.  I just have to look at 33 of them; a haystack sorted by 
> straw dimension.
>
> Solutions that do not work
> ==========================
>
> Simply eliminating all this information when an image is published is 
> clearly not the answer and, because of copyright issues, is 
> potentially both immoral and illegal.
>
> Likewise leaving it without informed consent certainly raised privacy 
> issues.
>
> The FaceBook discussion referenced above reveals that the problem is 
> treated with a religious fervor which does not permit admission of 
> multiple conflicting requirements.  Any automated solution is out of 
> the question.
>
> The various publishers of images have conflicting requirements with 
> respect to metadata.  While it might be possible to group different 
> publishers into a small set of groups each with a consistent 
> requirement this does not solve the problem either.  We do not know 
> which group any given publisher falls into; the publisher must tell us!
>
> The solution
> ============
>
> The only viable solution is for the publisher of an image to make an 
> informed choice about what image metadata to retain or remove.  This 
> solution has three elements:
>
> 1) The publisher has to make the decision.  It is not optional because 
> there is no default; removing information may be illegal, leaving it 
> in may breach the publisher's privacy.
> 2) Any software the publisher uses has to enable this; a lot, maybe 
> most, software does not.
> 3) The publisher has to understand the information being included.
>
> The last item is clearly the most difficult; even the author of the 
> software may not understand what is in there and, anyway, the amount 
> of information can be massive and the software author may not want or 
> be able to communicate all of it.
>
> Consequence for PNG
> ===================
>
> This issue is a consequence of the file format however the solution is 
> clearly outside the scope of the file format.  A human (entity) 
> decision is required.
>
> The responsibility of the file format maintainers is to ensure that 
> item (3) above can happen rather than attempting to ensure that it 
> does.  For PNG this means making sure authors of PNG software know 
> that the issue is there by documenting it. This just means 
> documentation in general terms; we cannot analyze all the security 
> issues because metadata is added using formats outside our control.
>
> For this reason I suggest adding a section to the ISO-PNG 
> specification that gives examples of the security issues raised by 
> metadata; more concise enumeration of issues I listed above together 
> with any others we may come up with.
>
> -- 
> John Bowler <[email protected] 
> <mailto:[email protected]>>
> +1 (541) 450-9885
> PO BOX 3151
> KERBY OR 97531-3151
> USA
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today. http://sdm.link/xeonphi
>
>
> _______________________________________________
> png-mng-misc mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/png-mng-misc

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi

_______________________________________________
png-mng-misc mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/png-mng-misc