New Service Converts Torrents Into PNG Images

jamie points out that a new web service, hid.im, will encode a torrent into a PNG image file, allowing it to be shared easily through forums or image hosting sites. Quoting TorrentFreak: "We have to admit that the usefulness of the service escaped us when we first discovered the project. So, we contacted Michael Nutt, one of the people running the project to find out what it's all about. 'It is an attempt to make torrents more resilient,' Michael told [us]. 'The difference is that you no longer need an indexing site to host your torrent file. Many forums will allow uploading images but not other types of files.' Hiding a torrent file inside an image is easy enough. Just select a torrent file stored on your local hard drive and Hid.im will take care the rest. The only limit to the service is that the size of the torrent file cannot exceed 250KB. ... People on the receiving end can decode the images and get the original .torrent file through a Firefox extension or bookmarklet. The code is entirely open source and Michael Nutt told us that they are hoping for people to contribute to it by creating additional decoders supported by other browsers."

Comments

The race is on...

[grub]

The.Black.Hole.1979.dvdrip.xvid.torrent -> goatse.png
... you know you want to.

.

Re:The race is on...

[bishiraver]

Wouldn't really work. This isn't true steganography; it just generates an image based on the torrent file. tag should be "!steganography" not "steganography"

Re:The race is on...

[duguk]

Wouldn't really work. This isn't true steganography; it just generates an image based on the torrent file. tag should be "!steganography" not "steganography"

It's more steganography than it is "renaming a .torrent file to a .png", that some people seem to think it is. Sure it's just some nice, but fairly simple encoding of a file into an image, but it's quite a neat idea. Give the guy some credit.

If I were a congressman, what would I do?

[cellurl]

I still think the solution is to change TPB to a TpayB. Allow us to pay $1 for a movie and allow studios to save face and jump in. More hiding like this will just put the Congressmen in action to filter. If this path is chosen, we will all be living in wifi-caves before long.

Re:If I were a congressman, what would I do?

[je ne sais quoi]

TPB was purchased by a gaming company and has gone legitimate.

Re:If I were a congressman, what would I do?

[cellurl]

I know, but I still don't see what I want.

Re:If I were a congressman, what would I do?

[PitaBred]

Seems like there may have been some skulduggery going on in the deal, and it's not a foregone conclusion.

Re:If I were a congressman, what would I do?

[jeffmeden]

TPB was purchased by a gaming company and has gone legitimate.

The first part is correct, the second part not so much.

What?

[geminidomino]

No "steganography" tag yet?

Slashdot, I'm disappointed in you. :P

Re:What?

[grub]

It's hidden in their header png.

Re:What?

[slim]

It's not steganography. It's an explicit PNG encoding of a torrent file. It's not a PNG of a kitten with a torrent hidden within so a casual viewer wouldn't realise.

Re:What?

[rawr_one]

I don't get why they can't just use the old trick of hiding a zip file in an image file.

Seems simpler, technology-wise, to me than encoding a torrent file as a PNG image, and all you would have to do to get the torrent file is change the extension on the file. Also seems safer. Unless this trick wouldn't be possible with .torrent files, that is?

Re:What?

[slim]

Because that technique is for hiding a payload.

This technique is not a hiding technique. It's just a technique for getting past content-type based filters.

Re:What?

[rawr_one]

So... it's not a hiding technique, it's a disguising technique? I mean, I know what you're saying, but it feels to me like it would smell as sweet. In practice, both methods would be used as a means to the same end, and the difference would simply be that one is less immediately noticeable than the other and easier for the end-user.

Re:What?

[flux]

A program that will clear out meta data of the file (not difficult to expect on a image hosting site, even if only to remove unused thumbnail data) will also eliminate such content. Also, it is easy to automatically detect images that have (significant amount of) content other than image data. Detecting these hid.im-files would require a specific algorithm written for it - although, not a very difficult one. (But prone to fail should the format be changed.)

Re:What?

[CompMD]

Steganography? This article has nothing to do with the prehistoric writings of a stegosaurus.

Re:What?

[rawr_one]

Ah, okay, thanks for clearing that up! I dunno if most forum software and the like would have those kinds of scanners, though imageboards might.

Re:What?

[SEWilco]

Steganography? This article has nothing to do with the prehistoric writings of a stegosaurus.

But the stegasaurus Twitter comments about this are very insightful!

Re:What?

[swilver]

PNG is extensible. If they donot convert the image from PNG to something else, then you can just add another block of data. Every compliant decoder will skip the unknown data automatically.

If they DO convert it, then this technique seems pointless, unless these hidden torrents survive automatic conversion to for example JPEG. Somehow I doubt that though as it is simply not possible to hide that much random data (hash values) in a file that's lossy compressed to something that's likely smaller than the original torrent file :)

Re:What?

[Anonymous Coward]

It wouldn't work with torrent files. The reason it works with JPEGs and RARs is that the first ignores data after a certain point and the other before a certain point.
That said I don't see the point of that service.

Re:What?

[rawr_one]

I know this is long after discussion has ended, but it seems to me that an acceptable solution then would be to put a torrent file in a RAR archive and combine it with a JPEG.

Of course, at that point it is probably way too much work for the average user.

Still limited

[rnelsonee]

Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading. Without context, warehoused information is useless. And these PNG files are just different representations of the same quasi-legal information (that is, they're still colored bits.

Re:Still limited

[Anonymous Coward]

Make the file an image of text that describes what the contents are. Or just use forum software that lets you upload arbitrary files.

Re:Still limited

[lxs]

Obviously you have never visited 4chan.

Re:Still limited

[morgan_greywolf]

Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading. Without context, warehoused information is useless. And these PNG files are just different representations of the same quasi-legal information (that is, they're still colored bits [sooke.bc.ca].

Hence the suggestion in the summary:

'The difference is that you no longer need an indexing site to host your torrent file. Many forums will allow uploading images but not other types of files.'

(empasis mine)

Re:Still limited

[tooyoung]

Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading. Without context, warehoused information is useless.

Yes, someone should invent a method for posting images on the internet and associating text with them.

Re:Still limited

[Hatta]

You don't need an indexing site to host your torrent. You need an indexing site to help peers find your torrent.

And if you just want to post torrents to a forum that doesn't allow arbitrary uploads, encode the thing to ASCII with yEnc.

Re:Still limited

[morgan_greywolf]

Forums are very good at performing keyword searches... Need I explain more?

Re:Still limited

[RiotingPacifist]

if only there was user contributed website that contained listings of most media content!

Re:Still limited

[Hatta]

Doesn't that make the forum an indexing site? Hell, I know of a few trackers (mvgroup.org for instance) that simply use forums for indexing and distributing .torrents.

Re:Still limited

[Ephemeriis]

Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading. Without context, warehoused information is useless. And these PNG files are just different representations of the same quasi-legal information (that is, they're still colored bits.

That was my initial reaction as well.

Instead of a .torrent file you've got a PNG, but I'm not sure how much that helps anyone.

I don't think the complaint was ever that the information contained in the .torrent file was somehow infringing copyright or breaking laws... I believe the argument has been made that there's nothing actually copyrighted/illegal in the .torrent file itself, and judging from the results of recent court cases that argument doesn't seem to be working terribly well. The PNG still contains the same information as the torrent... Still enables you to download the same files... Would, therefor, still be vulnerable to the same lawsuits and takedown notices - wouldn't it?

It isn't a text file, so it might be harder to locate the incriminating evidence with a simple text search... But you'll need to indicate what's contained in the file somewhere, or nobody is going to know what they're downloading. You'll still need a searchable index, or a header on the forum post, or at least a line or two of text saying what the picture gets you.

So... How is this actually better than a .torrent?

Re:Still limited

[slim]

I think the purpose of this is that you can put up a torrent, go to your favourite forum, and say "Hey, here's the .torrent for (some content)".

Forums generally provide a means to embed pictures, but not other filetypes, such as torrents.

Re:Still limited

[Hadlock]

Some torrent sites already filter out HBO shows and American origin IP addresses. If TPB goes 100% legit then this becomes an easy way to distribute .torrents if you already have a twitter account and access to twitpic, just without the ability to browse by number of seeders/leechers. EZTV and a few others already post all their torrents to twitter for when the site goes down (their site is down currently).

Re:Still limited

[rnelsonee]

Yes, someone should invent a method for posting images on the internet and associating text with them.

You let me know when someone invents something that pirates can search easily, but the RIAA can't.

What I got out of this is that they're obfuscating information to hide it. If they're just turning .torrents into images to post to forums, then, well I don't get its usefulness. I don't know of many forums that allow you to upload images but don't allow you to post a link to a URL, which could just point to the torrent.

Re:Still limited

[rubycodez]

to make that work someone would also have to invent a Text and Associated Image Peruser client and also a standard Peruser protocol.

Re:Still limited

[pete_norm]

If TPB goes 100% legit then this becomes an easy way to distribute .torrents if you already have a twitter account and access to twitpic, just without the ability to browse by number of seeders/leechers.

When i read something like and i realize i have no idea what's being said, i just feel old...

Re:Still limited

[flux]

Well, of course RIAA can also look for certain titles of interest on the web, but it's more difficult than simply searching for generic pirated content.

But, you mention posting links to torrents instead of uploading them as images. Where do you put the actual data in that case?

Re:Still limited

[elashish14]

Most people prefer to keep things that way.

Re:Still limited

[Hadlock]

Bit Torrent predates XP by more than 6 months! That's almost NINE YEARS this thing has been around. Honestly I'm surprised Win7 doesn't come prepackaged with a built in Bit Torrent client already. It comes with everything else. What are you doing? Admining a bunch of Win98/WinME computers at an elementary school in rural North Dakota? As a data service that chews through probably 50% of the global data capacity at any given moment, it's pretty hard to ignore bit torrent as a geek.

Re:Still limited

[flux]

Sites are more likely to accept the same amount of data in a picture than in text.

Re:Still limited

[shentino]

darknet?

Re:Still limited

[Ephemeriis]

Some torrent sites already filter out HBO shows and American origin IP addresses. If TPB goes 100% legit then this becomes an easy way to distribute .torrents if you already have a twitter account and access to twitpic, just without the ability to browse by number of seeders/leechers. EZTV and a few others already post all their torrents to twitter for when the site goes down (their site is down currently).

Fair enough. But if this becomes the preferred way to distribute torrents, what's to stop twitter/twitpic from filtering these images out?

I don't see how this is actually addressing the issue of the torrents being filtered... It's just moving that problem.

Re:Still limited

[gknoy]

That was a very interesting article you linked to -- thanks!

Re:Still limited

[Anonymous Coward]

Windows 7 doesn't come with a mail client, a photo gallery, any chat clients, or a video editor...

It doesn't come with almost anything anymore.

Re:Still limited

[Hurricane78]

<img src="image.png" alt="associated text"/>

Re:Still limited

[Chabo]

Here's an idea:

On a forum, make a new thread, and post nothing but an image, showing cover art from a movie or album. That image has a hidden torrent file inside it.

If you do this, then the users of the forum can easily figure out if they want to download it, but it's very hard to automate, so anyone doing a purely textual search can't find it.

Re:Still limited

[Hadlock]

The business/RC/RTM edition or the home edition?

Re:Still limited

[socrplayr813]

The thing is that people potentially post these pictures ANYWHERE. While the RIAA (or whoever) can target and attempt to shut down sites that host .torrent files, they can't easily do that for sites that are hosting pictures. As far as links, many forums delete posts with links to torrents, while images might slip through fine, at least until people start checking images before they're posted. Even then, there's nothing to stop someone from claiming ignorance in that case.

Sure, the RIAA can try to target everyone who does that, but they'd have to shut down most (if not all) of the internet to pull it off. Images can't simply be turned off on the internet. With that loss of control, either the RIAA will lose its ability to bully people or the public will have to start paying more attention to the RIAA's practices.

I'm not pro-piracy and I don't see this as a silver bullet solution, but there is potential for some change with this kind of thing.

Re:Still limited

[Anonymous Coward]

The point is that you can send the images through skype, imageshack, or even a forum. I don't know how this got a +5...

Re:Still limited

[merreborn]

Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading.

Yes, but the host serving the images doesn't have to have the text.

This has already happened with rapidshare and other similar services. Files with obvious names ("New Metallica Album.rar") don't usually last long. Users have since taken to posting content using increasingly obscure filenames. They simply post links to these files on other sites, with summaries of what they contain.

Similarly, you could host a bunch of data-laden images on flickr with completely unhelpful filenames and descriptions, and provide a directory on another site.

The point is to get a 3rd party service to publicly serve your data for you.

Re:Still limited

[Firehed]

TwitPic is run by one guy (maybe two now, there was a blog post on the site a while ago looking for another coder) with a couple servers. Even if he gave enough of a damn to try to filter out torrent-containing images (which I doubt is the case), I'm sure he has much better stuff to spend his time on.

Re:Still limited

[Ephemeriis]

TwitPic is run by one guy (maybe two now, there was a blog post on the site a while ago looking for another coder) with a couple servers. Even if he gave enough of a damn to try to filter out torrent-containing images (which I doubt is the case), I'm sure he has much better stuff to spend his time on.

I guess my question isn't really about whether some individual might, out of the kindness of their heart, decide to filter the encoded torrent/PNG files off of a site... But more about people being forced/coerced into doing it.

Look at the Pirate Bay trial. The Pirate Bay only hosts the torrents, none of the incriminating files. There is absolutely nothing copyrighted on the Pirate Bay. But they were still taken to court over it. They were found guilty, maybe, depending on appeals/whatever... But simply being taken to court might be enough to shut down a website that couldn't afford the legal fees.

These PNGs are just encoded torrents - really little different than hosting the torrent itself. Yes, they can be hosted at different places because they're harmless pictures instead of torrents... But the data contained is the same. And if you can take a web site operator to court because of the non-copyrighted data contained in a torrent, you can do the same for the non-copyrighted data contained in a PNG that decodes into a torrent.

So, again, I just don't see the advantage of storing them as PNGs as opposed to torrents. Sure, for the moment it is great because you can host them all over the place. All these free image hosting sites just became free torrent hosting sites. But if this actually catches on you'll see any site with any amount of traffic either implementing some kind of filtering or being taken to court.

Re:Still limited

[Anonymous Coward]

For me it's too late, but not for you. Run, little one. RUN !

Re:Still limited

[Nicolay77]

May be he's speaking about twitter and twitpic.

wait wait wait...

[Rooked_One]

you mean the pirates are going to continue to beat out "the man" and get away with it?

I'm just utterly shocked.

Re:wait wait wait...

[jellomizer]

All "The Man" needs to do is modify the image. Which is rather common practice anyways.

1. Insuring images are scaled properly.
2. Reconverted so the images will fit in the Database.
3. Insure you just have the image not a hack.
4. lossy compression to save storage space.

Re:wait wait wait...

[value_added]

you mean the pirates are going to continue to beat out "the man" and get away with it?

I believe Mr. Universe expressed those very sentiments.

Re:wait wait wait...

[smallfries]

Here we go with another technological arms race. How many image hosting sites will run the converter on all uploaded images and automatically reject those that contain an embedded file? Or just remove the steg and retain the basic image...

So the next step will be some sort of keyed steg, with the keys distributed on some sort of centralised webserver.... oh no, actually that might break. But luckily keys are quite small and can be widely distributed as long as the image sites don't get a hold of them. It's going to be an interesting few years...

Re:wait wait wait...

[rastilin]

Presumably the people sharing will be posting these images on sites that don't do all of these things.

Re:wait wait wait...

[poetmatt]

Don't forget a big whoops when a legitimate image file matches one of their filters and gets deleted, or when this becomes full blown steganography (which I'm sure it has by the time of this writing)

Re:wait wait wait...

[just_another_sean]

you mean the pirates are going to continue to beat out "the man" and get away with it?

I'm just utterly shocked.

Oh just wait, PNG's won't be around much longer.
Remember folks, when PNG's are outlawed only outlaws will have PNG's.

Re:wait wait wait...

[Anonymous Coward]

Well the software is open source. So it shouldn't take too long for forums to be able to filter out files made in this fashion fairly simply. They just need a filter on their upload that uses the decoding function and checks to see if it returns readable text and then block the upload.

Re:wait wait wait...

[AndrewNeo]

How do you know it contains a hidden file? I've written a file<->PNG converter, it's rather simple and you can do a large number of things to obfuscate it (reorder the bits, etc.) but overall, you can't really tell it's a 'file' unless you actually look at it. I think you're thinking of stenography, which this is not. This is changing the bits of the file into RGB values. PNG's lack of compression allows even conversion on the other side.

Re:wait wait wait...

[slim]

Probably the forum owners are not motivated to filter these.

Maybe their hosting company would. But probably only at the behest of some law enforcement power.

So what this is really doing is setting up a situation where if the governments tries to legislate, there's a response that goes, "wait a minute, you want us to scan and block *pictures*?

Re:wait wait wait...

[Hadlock]

Are your images PNGcrush-able? What happens if you PNGcrush the image?

Re:wait wait wait...

[ciderVisor]

I think you're thinking of stenography.

I don't think he is.

Re:wait wait wait...

[AndrewNeo]

I don't know what PNGcrush does but I'm 99% willing to bet it would break my procedure. There's probably tons of things I could do to optimize it, too. One thing I don't know if this service does, though, is use the alpha channel to make the dimensions of the picture smaller.

Re:wait wait wait...

[AndrewNeo]

Er, I should say I don't know PNGcrush works, as I do know what it does.

Re:wait wait wait...

[maxume]

It isn't that big a whoops, especially for free image hosting services.

If they consistently filter legit images, to the point where people feel hassled, it would be an issue, but 1 in 1000 isn't going to hurt them any.

Still, people running free content hosting, of any type, have plenty of other headaches to deal with. Like hiding encoded data in Wikipedia's edit history:

http://pauldotcommunity.blogspot.com/2008/03/hiding-inside-wikipedia.html

Re:wait wait wait...

[Hadlock]

I would imagine it losslessly compresses the image. The result being that if the data is stored in the binary code of the file, PNGcrush probably destroys the data payload. If the data is stored in the image itself (like a barcode or datamatrix) then you're probably safe. I think that's how it works.

Re:wait wait wait...

[elashish14]

Probably none if it doesn't become too widespread....

And I imagine that there will be many different methods for achieving this sort of encryption, so hopefully they won't be able to catch all of them. This is why a passphrase would be far more viable.

Re:wait wait wait...

[Anonymous Coward]

May I suggest using GIFs instead, just in case it does backfires? It would teach Unisys a lesson.

Re:wait wait wait...

[smallfries]

Good point. I took the summary at face value rather than clicking through to the blog. This would require a person to look at the image and decide whether or not it contained non-image data. I assumed that they were hiding the file in low-order colour bits with a program that detected a signature and then extracted the data. Maybe that will be next month's story...

Re:wait wait wait...

[Hal_Porter]

It seems like you could easily get rid of data hidden in images - just extract the image content and dump any metadata, resize it to one pixel less in each dimension and reencode with a PNG optimizer.

Re:wait wait wait...

[tuffy]

PNGCrush doesn't destroy non-image data chunks; it simply doesn't attempt to compress them.

Re:wait wait wait...

[silent_artichoke]

Just put the keys in another picture! A picture of the Florida Keys, just as a hint. Or Key Lime Pie. Or best of all, in this picture.

Re:wait wait wait...

[Anonymous Coward]

It's not encoded in the picture, it's encoded in the header of the png. Resizing the picture has no effect. Of course, one could just dump the header in ones image uploading software...

Re:wait wait wait...

[swilver]

It would defeat this scheme yes. However, it would not defeat a scheme where the data hidden is also partially redundant to facility automatic error correction. You could do the equivalent of storing PAR2 style blocks in the image, try to decode the image, and assuming the data had sufficient redundancy, the error correction algorithm would be able to recover the original file.

A well chosen way of hiding the data with enough redundancy could even survive being recompressed as JPEG, assuming your not using a ridiculously high compression level.

Re:wait wait wait...

[Hal_Porter]

You could do the equivalent of storing PAR2 style blocks in the image, try to decode the image, and assuming the data had sufficient redundancy, the error correction algorithm would be able to recover the original file.

I'm not talking about cropping. Resizing is more damage than that. Consider an image N pixels wide. Resize to N-1 pixels - each of which is produced by a bicubic interpolation of the original data. That's enough to change each value. You could also mess with the colour palette a bit, e.g. reorder it to further reduce image size or exchange a few entries. Since png is compressed even a one bit change at the start of the image should result in the rest of the file being totally changed. My scheme should produce a stream of bits that was completely different, even though the image would look identical.

A well chosen way of hiding the data with enough redundancy could even survive being recompressed as JPEG, assuming your not using a ridiculously high compression level.

You can certainly put data into an image that can survive JPEG compression or my scheme. Doing that while keeping the data invisible seems harder.

Re:wait wait wait...

[Hal_Porter]

You can certainly put data into an image that can survive JPEG compression or my scheme. Doing that while keeping the data invisible seems harder.

Actually there's another limit. Let's suppose you could shade a barcode onto an image. I can accept this could be invisible if you don't look to carefully. However to make it invisible to humans and JPEG proof you need to compromise seriously on the amount of data you store. JPEG would miss a shaded barcode if the bars were bigger than the 8x8 DCT macroblocks for example. And humans might miss the shading if it is subtle. But a barcode with bars eight pixels wide can't hold much data.

So you can have pick any two of decent data storage capacity, invisibility to humans and JPEG immunity in a steganographic scheme.

Re:wait wait wait...

[slim]

It's not encoded in the picture,

Yes it is.

it's encoded in the header of the png.

No it isn't.

http://hid.im/about/format

Just make sure your image hosting site...

[lobiusmoop]

doesn't re-scale or tag your uploaded images first!

Re:Just make sure your image hosting site...

[JSBiff]

. . . or automatically convert the image to a .jpg.

Re:Just make sure your image hosting site...

[slim]

I don't think the content will be affected by tag modifications.

These are pretty small images (one of the samples is 380x32) so rescaling isn't going to happen unless it's a deliberate attack on this technique. But there are far easier attacks if you're explicitly trying to block this exact technique.

Why not rob a bank instead?

[Anonymous Coward]

And find ways to get aways with it.

huh?
huh?

Re:Why not rob a bank instead?

[noundi]

If people constantly found ways to rob banks without implications there wouldn't be many banks left, would there? Instead there would be another solution that fits reality better. I don't know if you're trying to be funny or really using this as an argument, but if you're serious then you have to understand that if a method doesn't work, you need to rethink it and adapt it so that it does. The same goes with robbing banks. The very reason that we have banks left is because they've been adapted to reality. Bigger and more secure safes, security staff, panic buttons etc. The fact that avoiding getting caught filesharing is so easy means that something is wrong. Either we keep up this charade and try to limit internet without any results, or we adapt ourselves and our businesses to it and create new rules that can coexist with internet.

Re:Why not rob a bank instead?

[MightyYar]

We have compassion for you, the anonymous internet troll. We pirate so that you can troll us with something other than the GNAA.

Re:Why not rob a bank instead?

[DaveV1.0]

The very reason that we have banks left is because they've been adapted to reality. Bigger and more secure safes, security staff, panic buttons etc.

It is funny you say this, because corporate copyright holders have done just that and a huge number of people went "WAIT! That is not fair!11!!1!". Copyright legislation, law suits, DRM, etc are all adaptations to the reality created by people who have no morals or ethics and casually violate copyright law.

Re:Why not rob a bank instead?

[Jafafa Hots]

I'd say copyright legislation is less like adapting your business model to reality than it is trying to force reality to adapt to your business model.

Re:Why not rob a bank instead?

[noundi]

No not really, not at all actually. Corporate copyright holders have held a gun at the heads of a few threatening that anybody that does the same will be made an example of. This is not even remotely close to my bank example. They can't stop the methods because it would take an insane amount of restriction and surveillance, so they try the scare tactics. If the method was adapted to reality we wouldn't have had this discussion to begin with.

Also you know very damn well that people object to the fact that they are forced to be monitored just so that nobody shares files. This is a pretty big sacrifice we make for the entertainment industry and you seem to think that people brought it on themselves. Perhaps they did, but perhaps the entertainment industry did as well. Whatever methods are used today are completely useless, and to defend them isn't doing the entertainment industry nor their consumers any good. Nobody thinks music artists should be poor, at least nobody that enjoys music, since nobody would produce music if reality was as such. But the current structure is not the only possible one, and I'm damn sure that even the entertainment industry will abandon this fools errand sooner or later. Right now you're one of the responsible for keeping this natural transition at halt.

Re:Why not rob a bank instead?

[Anonymous Coward]

DRM is a perfectly reasonable way to protect IP - totally suited to reality.

Re:Why not rob a bank instead?

[noundi]

Sadly your lack of arguments leads to flamebaiting. However try lawsuits for ridiculous sums of money that do not reflect real loss of income. Its one thing to pay for your damages, but if you actually consider this fair then I can only hope someone shoots your kneecap off with a shotgun the next time you make an illegal turn or drive too fast. It's called excessive sentencing, hope you'll like it.

Re:Why not rob a bank instead?

[Hatta]

It would be a welcome change from the banks robbing us.

Re:Why not rob a bank instead?

[Hal_Porter]

Yeah like the banks! Instead of adapting their business model they hired men with guns and put up bars on the windows. Get with the 20th Century, dudes. The advent of the tommy gun and the Model T ford mean that a business model based on hogging money was clearly obsolete as obsolete as the buggy whip manufacturers'. They should have given their money to entrepreneurs like Mr Capone and instead made money out selling services like tommy gun hire and washing the blood stains off spats.

Re:Why not rob a bank instead?

[Jafafa Hots]

You clearly know nothing about the history and original intent of copyright law.

Re:Why not rob a bank instead?

[DaveV1.0]

So, when the EFF sues a company for using GPL code, it should not receive a dime, yes? And, when a person is discriminated against in a restaurant, they should not get a dime because they have had any actual damages.

Re:Why not rob a bank instead?

[noundi]

What? Where did I make such a claim? I said that $1.9 million is a ridiculous sentence for her crime. How can you possibly misunderstand this? If a software provider gets caught stealing code, e.g. GPL code, they should be fined for the exact sum of copies of this software sold multiplied by the price charged per copy. This is completely fair and logical. The restaurant scenario I can't help you with. It's not in my interest nor profession. And the fact that I'm not an oracle doesn't disprove anything I say.

Re:Why not rob a bank instead?

[DaveV1.0]

There are no damages in those cases. The whoever holds the copyright to the GPLed code loses no money and suffers no real harm from having their code used. No damage at all. So, any damage claims are by default ridiculous.

Why is her sentence ridiculous? Let's look at what she was found to have done: she knowingly and willfully violated the copyrights of others. She could have settled. She could have paid the original fine. But, no, she didn't. She just dug her hole deeper. It does not matter that you think she did nothing wrong, because you obviously a hypocrite and have no ethics. What does matter is that she was found guilty and her fine, according to the law, could have been TWICE that.

Re:Why not rob a bank instead?

[noundi]

There are no damages in those cases. The whoever holds the copyright to the GPLed code loses no money and suffers no real harm from having their code used. No damage at all. So, any damage claims are by default ridiculous.

I don't understand. If you're looking for some general rule that defines damage payment I can't provide you with one. And you're not making any sense with your examples. In this case the only damage done was loss of income. There was no mental nor physical damage, only economical, so in my opinion it's quite easy to define a reasonable sum as we use money in our time to repay any damage done. Don't assume that this is some golden general rule that can be applied on any case. I never claimed such and you're simply making false assumptions.

Why is her sentence ridiculous? Let's look at what she was found to have done: she knowingly and willfully violated the copyrights of others. She could have settled. She could have paid the original fine. But, no, she didn't. She just dug her hole deeper. It does not matter that you think she did nothing wrong, because you obviously a hypocrite and have no ethics. What does matter is that she was found guilty and her fine, according to the law, could have been TWICE that.

You are truly fucking blind if you consider that a fair sentence. I'm not blaming the courts, so your bullshit argument that she could have been fined twice the amount doesn't change anything. The law is flawed, and was initially even pushed by corporate lobbyists. Also I never said she didn't do anything wrong, these are your bullshit words. During this dialogue you've made up a lot of nonsense claiming that these are my words. I'm ending this since you're not arguing anymore, you're simply lying and it's getting fucking tiresome.

The other way around works too *evil grin*

[davidwr]

"Hey folks, go to http://imagehostingsite.com/animals/cutebear.png to get The.Black.Hole.1979.dvdrip.xvid.torrent"

goatse.png->The.Black.Hole.1979.dvdrip.xvid.torrent

You know what to do...

Re:The other way around works too *evil grin*

[discord5]

The.Black.Hole.1979.dvdrip.xvid.torrent -> goatse.png

goatse.png->The.Black.Hole.1979.dvdrip.xvid.torrent

Well, that explains why in the UK piracy is down.

Re:The other way around works too *evil grin*

[initialE]

No way am i going to link to a site called arse technica! What kind of idiot do you take me for?

Might Not Be a Problem

[MarkPNeyer]

If the conversion process is resilient enough, it might not depend upon the image having an identical binary format.

Re:Might Not Be a Problem

[corsec67]

Hmm, a binary picture like this one?

(Just a picture of a wrecked building run through a threshold filter)

Re:Might Not Be a Problem

[larry bagina]

The article doesn't go into detail, but since it's PNG, that suggest they're using ancillary chunks (iTXt/tEXt/zTXt) to store the torrent data. If that's the case, pngcrush or converting to another image format would kill the torrent.

Re:Might Not Be a Problem

[sys.stdout.write]

The article doesn't go into detail, but since it's PNG, that suggest they're using ancillary chunks (iTXt/tEXt/zTXt) to store the torrent data. If that's the case, pngcrush or converting to another image format would kill the torrent.

Given the sample images shown on the article, I'd say it's more likely that they are using pixel data to encode the information. If this is the case then lossless conversion to another format wouldn't ruin it, but conversion to JPG would almost certainly scramble the bits.

I could try downloading a torrent of album covers and end up with an anal bum cover!

Re:Might Not Be a Problem

[YouWantFriesWithThat]

wow, i really like that site.

Does that mean...

[EricX2]

I can download all of my pirated torrents and view pr0n in one convenient step? If so, this is one brilliant Nutt!

Why browser plugins?

[JSBiff]

"The code is entirely open source and Michael Nutt told us that they are hoping for people to contribute to it by creating additional decoders supported by other browsers."

Ok, ok, I do understand that a browser plugin adds some convenience, but how about a stand-alone version (native executable, or maybe something like a Java, Python, Perl, or Lisp program [which would be cross-platform]), which I can just run either as a GUI, or even a command line. . .

png2torrent in.png out.torrent

(heck, the original torrent filename might be stored in the png, so you might only need to specify the input file, and optionally an output path/filename if you want to change the name or extract to a different directory).

Maybe a drag-and-drop icon on the desktop - drag the png to the icon, and it automatically creates the torrent on the desktop.

Re:Why browser plugins?

[Ormy]

What does the code do except from change the filetype extension from .torrent to .png and back and what is stopping me from doing that manually? Renaming manually 'example.torrent' to 'example.png' isn't exactly a hassle.

Re:Why browser plugins?

[duguk]

What does the code do except from change the filetype extension from .torrent to .png and back and what is stopping me from doing that manually? Renaming manually 'example.torrent' to 'example.png' isn't exactly a hassle.

That's not what this does, otherwise forum software would reject it for not being an image. This software actually makes an IMAGE which is composed of the contents of the torrent, and can be converted back to a torrent file. It's nost just a rename of the file extension.

It's not lying - it IS actually an image, it just so happens to contain other data, if you look at it the right way. Try reading up on Steganography (no, it's not really steganography, because its obvious it contains other day) - but hopefully you'll understand.

Re:Why browser plugins?

[Anonymous Coward]

HAHAHAHA

get out

Re:Why browser plugins?

[Anonymous Coward]

Your renamed file clearly wouldn't be an actual valid png. You'll need the PNG 8 byte PNG signature... and the header... er, and the rest. PNG is non lossy, you can easily convert 8 bit ASCII into 8 bit pixels, store the pixels in a non lossy image (PNG) and then reverse the process at the other end.
http://en.wikipedia.org/wiki/Portable_Network_Graphics#Technical_details

Re:Why browser plugins?

[slim]

What does the code do except from change the filetype extension from .torrent to .png and back and what is stopping me from doing that manually?

It turns it into a valid PNG: something a PNG viewer can load.

The result looks like a horizontal strip of random pixels, size nx32 pixels (where n varies), with a block on the left that looks like "hid.im" in white on black.

http://www.hid.im/system/pngs/6/original/torrent.png?1246950724

Re:Why browser plugins?

[Fross]

It's open source, go for it. :)

Re:Why browser plugins?

[maxume]

The 'primary' version is a bookmarklet (they built a Firefox plugin because the Firefox file save dialog won't accept a nice filename for the torrent). The core functionality is 250 lines (sort of, much of it is whitespace or other noise):

http://github.com/mnutt/hid.im/blob/ce9750f16c2e12f8f93e97ea7f73edb0e302b22e/public/javascripts/read_png.js

So I would think that the availability of tools will be pretty good if the concept catches on much.

Re:Why browser plugins?

[PitaBred]

Renaming it does not make a torrent into a valid PNG file. Many/most image hosting sites will check for the file being a valid image file. Can you change a .jpg into a .bmp by just changing the extension? Same thing here.

When in the hell did Slashdot sink this low? I thought there were even moderately technically people that posted here, not people that understand computers less than my mom does.

Re:Why browser plugins?

[Anonymous Coward]

Stupidity: The assumption that everyone is exactly as clever as oneself.

No, seriously. I'm not calling you a stupid moron because you didn't read the article. I'm calling you a mindless retard because you assumed the dumbest (not simplest, big difference) solution thinkable.

Re:Why browser plugins?

[Anonymous Coward]

Make it yourself, fucko

Re:Why browser plugins?

[Jesus_666]

If this gains traction I expect BT clients to support these images directly.

Re:Why browser plugins?

[maxume]

Here's a sketch of a command line version in python:

http://pastebin.com/f36d1639b

No error checking, not well tested, I forgot to use the filename given in the torrent as the output file instead of the shorter name I was using to simply comparisons, etc.

Re:Why browser plugins?

[Anonymous Coward]

Already has been done but never released about 3 years ago. I was alpha testing a bittorrent client for a friend that loaded torrents that looked like pictures. He also had a separate tool just like you described to do the same thing. I told him that it was great that even people that can't read will be able to use his client but he never finished the client. I guess he recognized that there is no need for hiding bittorrent files inside of pictures.

Re:Why browser plugins?

[finiteSet]

When in the hell did Slashdot sink this low? I thought there were even moderately technically people that posted here, not people that understand computers less than my mom does.

Take a deep breath. The guy had a misconception about file types; quite unfortunately, it's one that a lot of people raised on Windows do have or have had at one point. And yes, there are going to be more and more people fitting that description showing up in forums like this one as time goes on. Unless he's trolling, there's no reason for him to willfully publicly embarrass himself. As much as his mistake offends you, berating newcomers for what they don't know yet is only going to turn people off to the field and is ultimately counter-productive. It's possible to educate without insulting, as some of your sibling posts have done. There's no reason that professional adults can't make their points both forcefully and respectfully. If educating others without demeaning them is a hassle for you, fair enough, you're not their parent and you don't owe them computer lessons. But if you don't sweat it, and let others step in and comment constructively, the field will ultimately be better off for it.

Won't work well

[maxwell demon]

All sites hosting images will just be required to filter for those images which have torrents inside (it shouldn't be hard, just try to decode the torrent, and if you succeed, reject the image). Or alternatively, to implement software which destroys the included torrent before putting the image online.

Re:Won't work well

[slim]

All sites hosting images will just be required to filter for those images which have torrents inside (it shouldn't be hard, just try to decode the torrent, and if you succeed, reject the image).

Which just makes for an arms race, and one where the pirates can be more reactive than the authorities. Create new encoding methods, encode into different formats (MP3, JPEG, HTML, whatever).

Re:Won't work well

[Smidge204]

You can't destroy the torrent before putting the image online, because it's not steganography. You're not embedding the torrent data in an existing image, you're converting the torrent data into a visual representation.

The images just look like random colored patterns when viewed normally.
=Smidge=

Re:Won't work well

[zwei2stein]

Which is totally inconvenient for user that has to keep up with it... *AA wins with every step of arms race because users need to adapt.

Andre regardless of images, there is more trouble: But they still need channel to share those files with public ... and to organize them and allow searching ... or you end up with closed communities of people who share them between themselves and network with other similar communities, which hinders casual torrent downloading.

Which basically means *AA gets what they wanted. Hordes are cut off or have harder time downloading.

Idea is not to force people out of sharing, but make it inconvenient enough to stop being more useful than going out and cashing money for originals.

Re:Won't work well

[Jason Levine]

I run a small Internet forum supported solely from member donations. We allow image attachments. The forum software we use is old, but the community is used to it and frankly it works fine for our purposes. If we were required to filter images for possible torrents hidden inside it would likely require that we: 1) Change forum software - a big time sink and something that would possibly cost us money or 2) Require us to invest in some sort of torrent filtering software (again time to set up and money to purchase). If we didn't buy this, we would risk being sued over people posting torrent-loaded images to our forum. If we did buy it, we would risk having to shut down due to overwhelming expense. (Of course, this is ignoring Safe Harbor laws which Big Content Owners would like to see vanish.)

Re:Won't work well

[Dhalka226]

All sites hosting images will just be required to filter for those images which have torrents inside

I'd certainly need to be required--by law--to do that if I were the owner of any sort of image hosting website. "Try to decode the torrent" means time and computing power on my side, and for absolutely no benefit to me or my business. In fact rejecting images is actually bad for my business; it's actively pushing users away, all for the benefit of some mega-corp that isn't me and that frankly I don't care about.

I wouldn't be particularly worried about a lawsuit. If people are essentially using steganography to hide torrents in images hosted with me, the RIAA would be extremely hard-pressed to show that I'm somehow involved in whatever piracy goes on merely by not going out of my way to scan the images on their behalf.

Maybe they'd be able to buy themselves such a law, but that's what it would take. My business' job is not to support the RIAA. (Hypothetically, of course.)

Re:Won't work well

[Anonymous Coward]

What I see instead is simple traffic sniffing wont work at the ISP level with files like this. Is your ISP going to throttle pictures (or any other file extension) just in case? It would cause an uproar.

Expanding on this idea means that simple extension monitoring or file header checking wont be enough to determine the contents of a file. That means they either have to stifle all traffic as they inspect it for hidden files, or let it pass to provide *gasp* service. Could go either way at this point.

Re:Won't work well

[RiotingPacifist]

1) Produce new tool to hide data
2) Produce new tool to decrypt single items of data easily, but don't include a batch mode
3) Wait for RIAA to understand whats going on (this step may take years as the still don't get DHT)
4) ????
5) No profit for RIAA

If they produce a plugin for firefox and the tool was shipped with most bt clients, anybody with a bt client installed could be notified that there is a torrent available whenever they see an image containing one, the RIAA then have to develop a tool to scan not just a few sites that allow .torrent files, but any site that allows images. In addition torrent sites can (could always be may not have realised) upload capatchas with the .torrent file embedded and require users to use a capatcha to get the .torrent data, this would require the RIAA to invest a lot of time to get the files

Re:Won't work well

[icebraining]

You don't need to scan image files, because the image themselfs are useless without "metadata", some text saying "this is a torrent image for call_of_duty.iso" or so. So it'll be easy to moderate. If you are somewhat active in your moderation people will give up and move on.

Re:Won't work well

[nbates]

Not really, if you use a firefox/ie/chrome plugin you just have to update the plugin frequently.

Re:Won't work well

[JAlexoi]

MP3

It's like, encoding a torrent into the content the torrent points to! Genus! It would be the ultimate recursion...

Re:Won't work well

[shermo]

The Idea is not to force people out of sharing, but make it inconvenient enough to stop being more useful than going out and cashing money for originals.

Why they don't try to make the originals better and more convenient instead?

Oops, common sense alert!

What's the point?

[Hatta]

If you're trying to post torrents into a web board that won't let you, wouldn't it be easier to encode the torrent to ASCII somehow? Say, MIME or yEnc? I mean, you want people to find the .torrent, so there's no point in hiding it with steganography.

Re:What's the point?

[value_added]

Say, MIME ...?

I think you mean base64.

As for hiding it, I think that's sort of the point behind this scheme.

Re:What's the point?

[Hatta]

As for hiding it, I think that's sort of the point behind this scheme.

What's the point of hiding something you're trying to share with the public?

Re:What's the point?

[omnichad]

Like this?
 
MIME-Version: 1.0

Content-Type: application/x-bittorrent

d8:announce30:http://tracker.prq.to/announce13:announce-listll30:http://tracker.prq.to/announceel44:http://vip.tracker.thepiratebay.org/announceel40:http://tracker.thepiratebay.org/announceel45:http://open.tracker.thepiratebay.org/announceee7:comment30:--- www.Yestorrent.com ---13:comment.utf-830:--- www.Yestorrent.com ---10:created by13:BitComet/0.9613:creation datei1237154572e8:encoding5:UTF-84:infod5:filesld6:lengthi5478058e4:pathl6:Sample25:devise-meteop2.sample.avieed6:lengthi731465728e4:pathl18:devise-meteop2.avieed6:lengthi11395e4:pathl18:devise-meteop2.nfoeee4:name47:Meteor.Path.To.Destruction.Part2.R5.XviD-DEViSE12:piece lengthi1048576e6:pieces14060:=âoeÂ)Âzy1ÃËoeÃsâï$Æ'â"Ãâ¦ËsÂ¥âËâzhÂââÃÃ"ÂæÃ%!+ÃüÂ}?&BÃ9#âÂc?_A!Ã¥ÃÃSOtâÃËzÂâOBÃ¥â¥6@Ã¥zBË}R)'vEVâKatÃâoeÂâÃÃoeâéÃü+âoâ--S-[Â
0Ã$lTÃ'ÃÃÂ2TÂÅÃ(TM)NÂâoeÂÃ(TM)â\Ã"GÃÅ"Ã"
ÃâLÃÃ'ÂÃ"`â"^ÅâËâ6oâÃ'6Ã#Ãâ¦ÃLÃLsZnÃÂlLéNÃÃâ

Re:What's the point?

[thrillseeker]

As for hiding it, I think that's sort of the point behind this scheme.

What's the point of hiding something you're trying to share with the public?

Because there's a middleman trying to censor your message (for the children...)

Re:What's the point?

[Hatta]

If the public can find it, so can the middleman. What am I missing?

PNGs?!

[Rik Sweeney]

OMG, who uses PNG files?! The compression routine is rubbish! I'm going to use this technology, but I'm going to convert the files to JPEG before I upload them. When people see how much smaller the file is that they have to download, they'll quickly move over to my way of thinking.

Re:PNGs?!

[wexsessa]

OMG, who uses PNG files?! The compression routine is rubbish! I'm going to use this technology, but I'm going to convert the files to JPEG before I upload them. When people see how much smaller the file is that they have to download, they'll quickly move over to my way of thinking.

Those of us that need lossless compression, but we use SuperPNG, which has better compression.

The conversion to JPEG might be a disappointment - my gut feel says this torrent trick won't work if the data are altered by JPEG's lossy compression.

Re:PNGs?!

[Anonymous Coward]

wooooooooooooooooOOOOOSSSSSSH!

Re:PNGs?!

[Anonymous Coward]

Looks like #competitivegeekbaiting escaped Twitter.

Re:PNGs?!

[BeardedChimp]

In fact sod the torrent altogether, I'm going to turn my films in to a series of animated GIFs and post them instead.

Re:PNGs?!

[rubycodez]

instead of difficult compression algorithms, I've a better solution for embedding text information in ascii porn. I'll share it as soon as the patent is granted.

Re:PNGs?!

[Gothmolly]

Try lzip instead, you can get close to 100% compression that way, depending on how you specify the command line.

Re:PNGs?!

[TheVelvetFlamebait]

And can you say "utter moron" any louder?

Apparently so. ;)

Re:PNGs?!

[Yvan256]

You mean like this?

Re:PNGs?!

[LordKronos]

Hey, at least he didn't say "udder moran"

Re:PNGs?!

[Anonymous Coward]

But JPEG is lossy. :(

This puts a new twist...

[Anonymous Coward]

...on the contents of certain imageboards...

Bad metadata

[tverbeek]

Filename extensions are a form of metadata, and I don't think it sets a good precedent to lie in the metadata for a file. It's bad enough that we have Windows hiding filename extensions from the user, and encouraging people to just double-click on a file to launch the associated app. This just seems like asking for more problems, as people try to double-click on mjthriller.png and it launches - and crashes - IE.

Re:Bad metadata

[slim]

You misunderstand. It *is* a PNG. Load it with a PNG viewer and you'll see a fuzz of random looking pixels.

But it can be translated into a .torrent.

It's a bit like a barcode, only with more capacity since it's 2D and colour.

Re:Bad metadata

[mdwh2]

I'm not sure where you're getting all this from? If the PNG file is a valid PNG file, it's not lying in the metadata. It's perfectly correct - and actually, it would by lying to label it .torrent in this form, since it isn't a valid torrent file.

This just seems like asking for more problems, as people try to double-click on mjthriller.png and it launches - and crashes - IE.

Why would IE crash? IE would display the PNG file. But if you fed an encoded file to your torrent application, it wouldn't know what to do with it.

(And as an aside, even if the file is invalid, the application shouldn't really crash...)

Re:Bad metadata

[IBBoard]

It's still a valid PNG, so it shouldn't crash IE when you open it. Based on the examples then it looks ugly as hell (it's more "render the file as-is but interpret as RGBA colours in a PNG" than "discretely hide the important data in some way" ala Spore's creature photos), but it is still an image.

That said, I wouldn't trust some versions of IE not to choke on standard 32-bit PNGs anyway :D

Re:Bad metadata

[duguk]

It's not lying - it IS actually an image, it just so happens to contain other data, if you look at it the right way. Try reading up on Steganography and hopefully you'll understand.

Re:Bad metadata

[maxwell demon]

But they do create a valid PNG image. So if IE crashes on trying to show that image, it must be an IE bug.

Re:Bad metadata

[terrukallan]

No, these actually are png images. They can be handled by any software that is capable of working with png images. This is not (as many seem to think) simply changing the extension of torrent files, or attaching a torrent as some sort of metadata to an image.

Instead, what they're doing here is encoding the data contained in a torrent file as valid image data. I'm not sure exactly what technique they're using, but the process is essentially analogous (though surely more complex) to treating each bit as a black/white pixel indicator. Given some agreed upon dimensions for the image (either width or height, doesn't matter which) this gives you a black and white bitmap which could then be encoded as a png.

Clearly what they are doing is more complex since their images are color (and they may be relying on specifics of the way png images are formatted), but the basic idea is the same.

Re:Bad metadata

[Ephemeriis]

Filename extensions are a form of metadata, and I don't think it sets a good precedent to lie in the metadata for a file. It's bad enough that we have Windows hiding filename extensions from the user, and encouraging people to just double-click on a file to launch the associated app. This just seems like asking for more problems, as people try to double-click on mjthriller.png and it launches - and crashes - IE.

I know, I know... This is Slashdot, nobody reads the article. But could you at least read the summary?

They aren't re-naming a file. They aren't just dropping the .torrent extension and replacing it with .png The resulting file isn't going to run any malicious code or do anything bizzarre.

They're encoding the bits of the .torrent file in a .png image. It actually creates an image. Looks like some kind of abstract/modern art kind of thing... Blocks of bright colors. You could open it with any graphics program... Set it as your wallpaper... Send it off to WalMart to be printed on photo paper...

Re:Bad metadata

[Anonymous Coward]

+1 insightful, best analogy/explaination here yet.

Re:Bad metadata

[DutchUncle]

... and hopefully you'll understand.

No reason to be obnoxious. YOU are the one who isn't understanding, or more probably just isn't listening.

M$ already spreads FUD about open standards like PNG, and this encourages people to think "Maybe this PNG isn't a real picture". /.ers get upset at M$ for putting executable code in places it's not expected, and mixing unrelated concepts, and subtly changing the meanings of standards so that they're not standard anymore; the average non-techie would consider this misuse of picture format to be similar enough.

I don't consider this steganography, either, because it's not hiding one thing behind another. It might be elegant to take some standard picture of Tux or the Mona Lisa, and use the file-to-be-hidden as delta modulation on it, and call the result "dynamic art"; using the bits as multicolor barcode isn't much different from amplitude & phase modulation on carrier signals (as if it wasn't obvious enough that I can call it "multicolor barcode" because the conceptual extension is "obvious to a practitioner in the field").

Re:Bad metadata

[mcrbids]

Filename extensions are a form of metadata, and I don't think it sets a good precedent to lie in the metadata for a file.

It's not a lie - the images are valid PNG images. Look at them - they look like random color noise - but they are perfectly renderable, spec-compliant PNG images of random noise. (torrent data)

Re:Bad metadata

[nschubach]

Now if we can only somehow combine this with Piet...

Re:Bad metadata

[Jesus_666]

How would this damage PNG's reputation? The file is a valid image; there's no executable code anywhere. You can extract a fancy pseudo-URI from it with the proper tools but without those there's just no way these images can cause any trouble that random "regular" PNGs wouldn't.

This is akin to ASCCI armoring content for upload to newsgroups. That allowed you to disseminate random binary data, yet it didn't ruin ASCII's reputation. This PNG wrapping is a way to allow people to share torrent files without having to host and link them or modify the board configuration to allow .torrent attachments to posts. Nothing more, nothing less.

Re:Bad metadata

[DutchUncle]

It's labeled as a picture but it's not a real picture. Simple as that. Well, yeah, it's a picture that is a "barcode-like" data transfer, and you could print it out and scan it into your Altair with one of those old photocell wands. Of course back in those days, if we could have downloaded a picture we wouldn't have needed magazines to print barcode. ;-)

In fact, where's the savings? If it's just the .torrent header that's being saved under a fake name, the file still has to be hosted; and if it's the actual file that's been hidden as a .png, it will be downloaded individually instead of as a torrent, which completely misses the purpose. The *only* benefit is to get around a restriction by filename for people who distrust .torrent, so in exchange it's going to make people distrust and double-scan .png. Sounds like identity theft to me.

Re:Bad metadata

[swilver]

Insightful?

Even if it WAS an invalid PNG file, if IE crashed because of that then you have much bigger problems to worry about (hint: such "crashes" are exactly the thing hackers exploit to gain access to your machine). IE should not crash on any invalid data it is fed, that includes images, HTML, bad javascripting, and so on. If a bad image file crashes IE, then it is possible hackers could craft an image file that doesn't crash IE but may do something nasty instead.

Re:Bad metadata

[Jesus_666]

You, sir, are a crackpot. What's with PNGs of barcodes? Or QR Codes? Those represent non-image data in an image, yet are somehow okay? (And yes, I've seen QR Codes on websites). You could easily have a QR code point to a goatse mirror and host that, yet people keep trusting PNG to not randomly perform malicious actions against them.

As for the usefulness: Yes, in the case of the torrent scenario it's somewhat limited. However, other people have released implementations that turn random files into PNGs, which allows one to share small files through an image hoster like Photobucket instead of a file hoster like Rapidshare. File hosters usually employ all manners of nag screens while image hosters don't. Of course there's abuse potential but there's abuse potential everywhere.

An example..

[Anonymous Coward]

Here's an example. It's the OpenOffice.org 3.1.0 win32 torrent taken from the OO.o site.

Re:An example..

[Hadlock]

It's a shame the default size isn't 100x100 pixels or 125x125... a more common size, particularly for VBB avatars and whatnot. 32x* will be considerably easier to filter/block by hosts.

Re:An example..

[PitaBred]

I'd think it's a bit smaller than the original torrent, too... some torrents can get quite large. Can anyone check that? .torrent's are filtered where I'm at.

Re:An example..

[symbolset]

How did you get that ghostly omage of Steve Ballmer in there?

Re:An example..

[shawnce]

If I squint my eyes and try focus behind the image I think a see a tea pot... or maybe two whales humping? Cool 3D effect!

Re:An example..

[Divide By Zero]

They say if you stare at it long enough, you can see a sailboat in some weird 3D, but I'm not convinced.

Re:An example..

[maxume]

PNG is 25.5 KB, torrent is 22.1 KB (I haven't decoded the PNG to make sure that I have the correct torrent, but I'm pretty sure I do, and besides, most of the OO torrents should just be for 1 file).

Re:An example..

[nschubach]

Wow! It's a schooner.

Re:An example..

[mattstorer]

huh, so the app doesn't even do any form of steganography at all - anyone looking at the image can clearly tell it's not a regular image. probably overwrites all 8 bits of each red, green, and blue color channel with the payload. if you want the app to actually hide the torrent, you have to take a regular PNG, and overwrite only the least N significant bits of each color channel with the payload. the more bits you overwrite, the more payload you can store, but eventually (overwriting around 4 or 5 bits per color channel) the image begins to get all grainy and you can pretty easily tell there's something going on with it. overwriting all 8 bits generates an image like the example linked to in parent.

Re:An example..

[afxgrin]

The Firefox 3.5 plugin doesn't work under Linux. It saves exactly 0 bytes for all files.

Alternatively

[planetmatt]

Couldn't you just use the comments section of a .tif file instead? At least then the picture could still look like kittens instead of a broken magic eye.

Re:Alternatively

[duguk]

Couldn't you just use the comments section of a .tif file instead? At least then the picture could still look like kittens instead of a broken magic eye.

Most forums only allow PNG and JPEG, not TIFF. Nice thought though.

Re:Alternatively

[terrukallan]

A fair number of message boards only allow for a certain subset of image formats to be uploaded. In my experience, png is nearly always one of those. .tif is not.

Re:Alternatively

[Anonymous Coward]

JPG has a comments section that you could put this in...

Re:Alternatively

[tuffy]

PNG could also place torrent data in non-image file chunks which regular viewers would ignore. That's the method I was expecting, but it doesn't look that way from the screenshots.

Re:Alternatively

[T Murphy]

Dude, all magic eyes are broken. Never once have I managed to get those things to work for me.

Excellent, it's open source.

[BlueKitties]

I'm half tempted to pop it open myself and add a feature that inserts a text description into the encoded PNG. Really, I don't think it would be too hard (hell, it could just have a few flag bits that tell the interpreter how much of the image needs to be cropped to remove the description.)

Re:Excellent, it's open source.

[dave420]

The header used by the format already describes where the data is in the image, so it already has the ability to ignore other stuff in the image.

Re:Excellent, it's open source.

[izomiac]

It seems like a better method would be to just have the interpreter read the data by spiraling in from the outer edge. At some point there's a signal to stop, and the rest (e.g. middle) of the image can be whatever. So, effectively you could have an image that describes the torrent with a border around it that encodes the data. Perhaps even reduce the data density so the border more or less appears to be a solid color.

Re:Excellent, it's open source.

[BlueKitties]

I don't know why we'd need to spiral; the text can be in the middle of the screen anyway -- the initial flag information just describes the locations that need to be cropped. For that matter, it could even describe the location of the text on a letter-to-letter basis, meaning the text can be as complex as needed (for that matter, anything could be inserted, so long as the crop algorithm can keep up.)

Re:Excellent, it's open source.

[izomiac]

Simplicity, although that's probably a matter of opinion. If it's a spiral then one doesn't have to define locations or anything (other than a termination sequence). OTOH, defining locations affords greater control over text placement. But I figure that for most situations it'd be easier to have a description PNG and simply add the encoded data as a border around it. Or perhaps just use the PNG alpha channel to just make the "border" transparent (either 100%, or >=50% and use the remaining 7 bits of the alpha channel to encode data).

E.g. "torrent2png --image=Description.png --torrent=file.torrent --output=Encoded.png" where Description.png has the textual description along with a screenshot or logo or something (really it could be any PNG).
VS "torrent2png --crop=20,20,-20,-20 --image=Description.png --torrent=file.torrent --output=Encoded.png" although figuring out the proper area to crop might be difficult.

"torrent2png --crop=text --text='Description' --torrent=file.torrent --output=Encoded.png" would be easy to use, but it doesn't give the user as much control, and is likely more complex to program.

Re:Excellent, it's open source.

[BlueKitties]

A termination sequence could accidentally arise within the encoded torrent itself; Unlike a C string with a specialized termination character, we're using purely bitwise flags that could naturally arise within the system. However, if we inject our sequence at the start (with the termination inserted at the end of the initial flag) then we don't need to worry about "noise."

Unless there's a different way to do it I'm not thinking of?

Re:Excellent, it's open source.

[izomiac]

You're right that termination sequences can arise naturally. For my own (small and unreleased) programs I generally take that risk, or scan for it first and die with an error if it occurs. Two better ways to do it would be to either specify the size of the torrent file initially as you said, or use the first bit of the alpha channel. If it's set to zero (IIRC that means >=50% transparent) then you're still in the encoded torrent section. If it's set to one then you've left it and can stop decoding.

Re:Excellent, it's open source.

[BlueKitties]

Hey, that is a nifty approach; I didn't think about flagging things on a per-pixel basis. In fact as you mention it, so long as the torrent bits are kept in order, it's like having "//" comments inserted into your pixels -- the alpha flagged bits are just ignored.

IE6 FTW!

[wangahrah]

Lack of transparency support for your PNGs won't let those bastards see through the image to your thinly veiled P2P activity! Looks like IE6 just won the browser war.

The REAL Da Vinci Code

[Blixinator]

Take a .png of the Mona Lisa and convert it to a torrent and it downloads several thousand hours of voice notes by Da Vinci... and porn

Just use MAGNET uris

[Anonymous Coward]

Both Azureus and uTorrent support it, maybe even more. For example in uTorrent, right click any torrent and choose "Copy Magnet URI" and use it in Open Location dialog. The torrent file is downloaded thru DHT network.

Re:PNG vs JPG

[Anonymous Coward]

I think that commenter was being super sarcastic.

secret in secret

[Anonymous Coward]

I wonder if this would be useful if the torrent data was also encrypted with your own secret key and then converted to an image.
Only the person with the secret key could then decode the image to find teh filez. ...or a we just chasing our own tail?

RARJPG?

[Anonymous Coward]

I don't know if it's detected by forum though.

what does this do that

[kickedfortrolling]

ren *.torrent *.png

wouldnt?

(on windows...)

4chan banned similiar images

[Pingh]

A while ago it was a common thread on 4chan to have torrents hidden within rar files appended to jpgs. This lead to massive amount of virus infected files being uploaded. 4chan banned images that it could detect rar headers within. I can imagine similar practices would be up and about on other image boards as well.

Re:4chan banned similiar images

[Aladrin]

Except that this looks just like image data... Because it is! There's no 'appended' file. It's converted into image data, then reconverted at the end user. It will be a lot harder to detect this.

Re:4chan banned similiar images

[SuiteSisterMary]

Nonsense. You just run it through the exact same torrent-data-extractor process that the end-user would use.

Re:4chan banned similiar images

[Anonymous Coward]

In cmd: (assuming pic.jpeg and file.rar in the current working directory, otherwise specify path)

copy /b pic.jpeg + file.rar output.jpeg

where pic.jpeg is your source pic, file.rar is the .rar file you create in which your 'hidden' files are, and output.jpeg will be a .jpeg file, which when executed will open in your picture manager, but when opened with WinRAR, will reveal the contents of the .rar file you added.

copy /? in cmd says that the /b flag is for indicating a binary file, so I guess it doesn't mess up the extension headers when you combine files. I haven't gotten around to finding a bash equivalent.

Re:4chan banned similiar images

[Aladrin]

Running every image file through the extractor is a lot more processor-intensive than just looking for data beyond the 'end' of the file.

Re:4chan banned similiar images

[4D6963]

I don't get it, appending anything to a JPG is only useful if a) the recipient is aware of that and b) wants to open the rar for what's inside. I fail to see how that's a virus infection risk otherwise.

Re:4chan banned similiar images

[maxume]

It might be harder to detect variations, but all that is needed to detect this is to pop open the image and scan for a magic sequence that is used to mark the data.

Re:4chan banned similiar images

[SuiteSisterMary]

Probably not, and even if it is, I think you'll find that most webservers these days have processor to burn.

Re:4chan banned similiar images

[Khyber]

You only have to run it once on the incoming file, not every time someone tries to download it. that doesn't take up too much more overhead.

Re:4chan banned similiar images

[icebraining]

cat pic.jpeg file.rar > output.jpeg?

"When using the cat utility with shell redirection to copy binary files, cat normally performs a raw copy, preserving the 8-bit integrity of the file."

Good for small torrents maybe, but...

[Anonymous Coward]

Most torrent files for feature length 1080p releases, especially those with DTS sound, are quite a bit larger than 250kB.

Re:Good for small torrents maybe, but...

[slim]

This is for encoding the .torrent file. Not whatever it points to.

For example, I just found a torrent file for Terminator Salvation - 14kB

Re:Good for small torrents maybe, but...

[dave420]

No, the size of the files listed in the torrent doesn't make a difference to the filesize. The number of trackers, nodes, and piece size (etc.), however, does. I just downloaded a .torrent file describing an 8GB 1080p movie, and it was 41KB in size.

Re:Good for small torrents maybe, but...

[4D6963]

Am I the only one who can't determine whether you're trying to be funny or if you're just being confused?

*WHOOSH*

[Anonymous Coward]

That would be the joke, going over your head.

Re:PNG vs JPG

[Anonymous Coward]

Once you realize it is lossless you might even see a benefit

I think the lossless versus lossy bit was the crux of the joke. Converting the torrents to jpeg would lossily compress the torrent, thus breaking it upon decompression.

Why not just use slashdot instead?

[goombah99]

It won't work as intended but not for the reason you say. Regardless of whether it's steganongrphyically encoded or not, this is just amtter of detectability to the eye.

let's work through the logic:
        If a firefox plugin and retreive the torrent then so can any image hosting site. all reputable ones will decline to host those images. the torrents might be legal ones, but the image hosting sites will not see it valuable to their bussiness model to offer a service which might be hosting links to tainted goods.

      if the encoding is done is some way that while a firefox plugin can easily recover a code that represents a torrent but you can't tell from the code if it is a torrent (without say actually trying it out) then you will have to have some other signifier that the image contains a valid torrent and the identity of what the torrent contains (so you can search for what you want). ANd again the image sites will decline to host those.

so you might as well just post hex encoded torrents and their plain language desciptions right to slashdot in the comments or in your journal. Anyone can then use slashdot's search feature or for that matter google with a site:slashdot.org search term to find them.

so it seems like this has no value as a means of hosting torrents.

Now it does have two uses one legitimate and one not. it could be just a conveinet way to pass around a torrent assoiciated with an image all in one handy container (kind of like a bussiness card printed on a mini-cd). nd it could be a way for someone to establish plausible deniability that they were posting a torrent. e.g. a blog post deploring the loss of revenue for Metalica with a picture of the band's latest almbum that happens to hide a torrent for that albumn. ("oh the irony, I just grabbed that image off google images and little did I know that particular one held a torrent. wink wink")

Re:Why not just use slashdot instead?

[Nathrael]

There are ways to circumvent that. For example, you could place the torrent information at a random address in the picture, and display that address in captcha-form in the picture itself. If you'd like to get the torrent information, you'd have to open the picture in your favorite image display tool, write down the address, enter the address in the decryption tool, and let it do it's work.

There you go, no more hosting services filtering out .pngs containing torrents.

Re:Why not just use slashdot instead?

[elashish14]

Parent is wise. It would be easy for any image hosting site to detect something like this. They would just have to scan it as they receive it. Nobody wins when you just encode it using a simple straightforward and one-time algorithm.

What the authors need to do is provide some sort of key to decoding the torrent file. Instead of creating an entire image of it, they should instead take a standard image, and use some cypher method that would slightly distort the it (blur, stretch, etc.) in some way that would allow recovery of the torrent data. Then it wouldn't be obvious to the naked eye and you could just post the information necessary to decode the information from some other location. But is this worth the effort when torrents are still easy to find? Probably not yet, but in the future it may be.

Re:Why not just use slashdot instead?

[Anonymous Coward]

If you encode it such that you can only find out that it's a torrent if you convert it back, and they take it down, then you have proff that they had in their posession the torrent. MPAA can just upload a ton of images, and wait for the "We're guilty" takedowns and then sue.

Re:Why not just use slashdot instead?

[Sir_Lewk]

Anyone can then use slashdot's search feature

I take it you've never actually tried to use slashdot's search function.

Re:Why not just use slashdot instead?

[Anonymous Coward]

Is anyone else looking at all the typos in the parent's message trying to figure out if there's a message hidden? Typos (not including cases):

steganongrphyically amtter retreive bussiness desciptions conveinet assoiciated bussiness nd Metalica almbum albumn

Including cases:

steganongrphyically amtter let's retreive all the bussiness if ANd so desciptions slashdot slashdot's so conveinet assoiciated bussiness nd Metalica almbum albumn oh google

I deliberately left out a few things that I'd rather assign to casual error, however given these I find it less likely that there is an ingeniously hidden message, and more likely the poster will cry upon reading this.

Re:Why not just use slashdot instead?

[jcwayne]

00000000 FF D8 FF E0 00 10 4A 46-49 46 00 01 01 01 00 60
00000010 00 60 00 00 FF DB 00 43-00 08 06 06 07 06 05 08
00000020 07 07 07 09 09 08 0A 0C-14 0D 0C 0B 0B 0C 19 12
00000030 13 0F 14 1D 1A 1F 1E 1D-1A 1C 1C 20 24 2E 27 20
00000040 22 2C 23 1C 1C 28 37 29-2C 30 31 34 34 34 1F 27
00000050 39 3D 38 32 3C 2E 33 34-32 FF DB 00 43 01 09 09
00000060 09 0C 0B 0C 18 0D 0D 18-32 21 1C 21 32 32 32 32
00000070 32 32 32 32 32 32 32 32-32 32 32 32 32 32 32 32
00000080 32 32 32 32 32 32 32 32-32 32 32 32 32 32 32 32
00000090 32 32 32 32 32 32 32 32-32 32 32 32 32 32 FF C0
000000A0 00 11 08 00 2D 00 3C 03-01 22 00 02 11 01 03 11
000000B0 01 FF C4 00 1F 00 00 01-05 01 01 01 01 01 01 00
000000C0 00 00 00 00 00 00 00 01-02 03 04 05 06 07 08 09
000000D0 0A 0B FF C4 00 B5 10 00-02 01 03 03 02 04 03 05
000000E0 05 04 04 00 00 01 7D 01-02 03 00 04 11 05 12 21
000000F0 31 41 06 13 51 61 07 22-71 14 32 81 91 A1 08 23
00000100 42 B1 C1 15 52 D1 F0 24-33 62 72 82 09 0A 16 17
00000110 18 19 1A 25 26 27 28 29-2A 34 35 36 37 38 39 3A
00000120 43 44 45 46 47 48 49 4A-53 54 55 56 57 58 59 5A
00000130 63 64 65 66 67 68 69 6A-73 74 75 76 77 78 79 7A
00000140 83 84 85 86 87 88 89 8A-92 93 94 95 96 97 98 99
00000150 9A A2 A3 A4 A5 A6 A7 A8-A9 AA B2 B3 B4 B5 B6 B7
00000160 B8 B9 BA C2 C3 C4 C5 C6-C7 C8 C9 CA D2 D3 D4 D5
00000170 D6 D7 D8 D9 DA E1 E2 E3-E4 E5 E6 E7 E8 E9 EA F1
00000180 F2 F3 F4 F5 F6 F7 F8 F9-FA FF C4 00 1F 01 00 03
00000190 01 01 01 01 01 01 01 01-01 00 00 00 00 00 00 01
000001A0 02 03 04 05 06 07 08 09-0A 0B FF C4 00 B5 11 00
000001B0 02 01 02 04 04 03 04 07-05 04 04 00 01 02 77 00
000001C0 01 02 03 11 04 05 21 31-06 12 41 51 07 61 71 13
000001D0 22 32 81 08 14 42 91 A1-B1 C1 09 23 33 52 F0 15
000001E0 62 72 D1 0A 16 24 34 E1-25 F1 17 18 19 1A 26 27
000001F0 28 29 2A 35 36 37 38 39-3A 43 44 45 46 47 48 49
00000200 4A 53 54 55 56 57 58 59-5A 63 64 65 66 67 68 69
00000210 6A 73 74 75 76 77 78 79-7A 82 83 84 85 86 87 88
00000220 89 8A 92 93 94 95 96 97-98 99 9A A2 A3 A4 A5 A6
00000230 A7 A8 A9 AA B2 B3 B4 B5-B6 B7 B8 B9 BA C2 C3 C4
00000240 C5 C6 C7 C8 C9 CA D2 D3-D4 D5 D6 D7 D8 D9 DA E2
00000250 E3 E4 E5 E6 E7 E8 E9 EA-F2 F3 F4 F5 F6 F7 F8 F9
00000260 FA FF DA 00 0C 03 01 00-02 11 03 11 00 3F 00 F1
00000270 D6 6C 0A E9 41 23 4B B7-03 FE 79 E6 B9 56 3D 2B
00000280 B4 48 77 E8 D6 EC 3E F2-A0 3F A5 70 4A 3A 1D 8D
00000290 D8 D2 D1 AE 95 A3 F2 40-F9 B1 C0 AD 2B 31 14 51
000002A0 B1 71 82 A4 8C 1A E4 F4-B9 24 87 52 40 AD 85 EA
000002B0 0F 71 5D D5 84 49 25 D9-7F 27 76 FE 44 8C D9 C7
000002C0 D0 56 4D 23 55 16 F6 1F-13 79 8A 02 C6 C7 3D 78
000002D0 E9 53 41 13 88 4A 98 5F-1C 8E 07 35 D2 C1 6B 6F
000002E0 6B 03 BB CC 22 70 32 77-AE 4D 62 49 AA 46 B3 12
000002F0 2E 81 4C F5 1F E7 A5 64-A0 DB D0 D3 95 AD CC 0D
00000300 41 30 A3 78 64 E7 0C 40-C6 45 73 D7 9A D5 A5 94
00000310 FE 49 2C 08 19 C2 0E 05-7A 54 16 51 6B B1 30 58
00000320 98 43 B7 2C C5 72 58 7B-67 03 F1 AC CD 43 C1 FA
00000330 7C 17 01 6D 84 51 A1 50-4A EE CF 3C F7 AE 88 D9
00000340 2B 34 67 EC A4 DD D1 E1-85 BA 57 74 92 79 3A 3C
00000350 67 B8 8C 0F D2 B8 0D DC-57 6D 2C 81 34 58 41 3C
00000360 B2 00 3F 2A DA 4A C8 E7-96 B6 37 3C 23 E1 F8 35
00000370 B8 E5 32 BB 47 26 F0 B1-C8 BD 50 E3 F5 CE 71 5B
00000380 5A 0D DF 97 77 6A 27 4C-A8 7F 98 01 91 91 C1 C5
00000390 54 F0 3C FF 00 67 B2 60-C7 0C 5F 38 F6 C0 AD 77
000003A0 B6 B6 88 70 B2 45 22 48-4A BC 79 F9 87 63 C7 43
000003B0 EB 59 38 DD 58 E9 A7 2B-3B 9B 77 B7 1E 72 CA 15
000003C0 C2 02 1B 04 A9 EB EF E8-2B 83 79 EF 26 91 9A 41
000003D0 B8 33 E1 95 10 81 F9 74-AD 5B AF 12 5F 5A 6F 89
000003E0 6E 19 83 8F 98 B0 DC 71-55 E3 BF 78 A0 DA 3C B0
000003F0 80 64 90 A3 3F 9D 11 A6-D2 D4 E8 86 29 26 DA 47
00000400 41 E1 9B B5 1A 2B 2D C3-43 BD 18 AB 19 98 F0 3B
00000410 00 3D 85 17 7A C3 45 28-48 6F 46 D0 BD 12 D7 70
00000420 1F 8D 61 E9 FA 92 31 2E-B1 AB 49 EA DC 91 57 3E
000004

Re:Why not just use slashdot instead?

[Sir_Lewk]

This is probably what uuencode is for.

Re:Why not just use slashdot instead?

[Snaller]

"let's work through the logic:"

Which isn't really, but just your opinion.

"If a firefox plugin and retreive the torrent then so can any image hosting site."

Duh, the whole point is you can put it on a website.

"If a firefox plugin and retreive the torrent then so can any image hosting site. all reputable ones will decline to host those images."

In your opinion. How would they know that it is?
Ah, so they have to hire programmers to write code to determine
if its a picture or not?
And so they ban version1, then the pictures morph to version2, and when they ban that they morph to version 3 and 4 and 5 and 6 and 10000.

Far more likely they are going to say, a picture is a picture.

Re:Why not just use slashdot instead?

[goombah99]

This is probably what uuencode is for.

which is probably what the slashdot lameness filter is for.

Re:Why not just use slashdot instead?

[MattXBlack]

How about turning it into a CAPTCHA? The only way to detect and decode the torrent file is to type the code that is shown in the PNG. The code could be written over a screenshot of whatever creative commons/public domain film the torrent points to, and the filename is something like charlie_chaplin_the_champion_screenshot.png? The code wouldn't even have to be that well distorted, as I'm sure most image sites don't have the same computing resources that spammer have to break these things.

Re:Why not just use slashdot instead?

[Anonymous Coward]

"...a picture of the band's latest almbum that happens to hide a torrent for that albumn."

That is the solution.

The image shows you what's on the torrent. You can't list it as a specific band or album in the text or tags, but you can tag the post as "music, rock, metal" then use your eyes, just like you always do, to find what you are looking for. Search for a movie, you search for the year and genre, then eye-ball the results and see if you find the corresponding movie poster image, or a still that is from the movie torrent itself so you can see the quality. You may be able to put the title as a grapic in the image that you can see.

This way, the torrents are hidden from specific, direct text based web searches yet still relatively easy to find.

Re:Why not just use slashdot instead?

[Anonymous Coward]

a captcha on the same picture would be a good way of passing the key i think.

Re:Why not just use slashdot instead?

[Anonymous Coward]

Totally. What is with the huge indentations?

Re:Why not just use slashdot instead?

[toddestan]

If a firefox plugin and retreive the torrent then so can any image hosting site. all reputable ones will decline to host those images. the torrents might be legal ones, but the image hosting sites will not see it valuable to their bussiness model to offer a service which might be hosting links to tainted goods.

Why not? Any image hosting site that accepts any image that someone uploads to it is already full of copyright violations as it stands now.

Re:Why not just use slashdot instead?

[PMBjornerud]

And it could be a way for someone to establish plausible deniability that they were posting a torrent. e.g. a blog post deploring the loss of revenue for Metalica with a picture of the band's latest almbum that happens to hide a torrent for that albumn. ("oh the irony, I just grabbed that image off google images and little did I know that particular one held a torrent. wink wink")

That would be steganography.

According to TFA, Hid.im pictures look like this: http://torrentfreak.com/images/hidim.jpg

Even better ...

[Anonymous Coward]

if the images involved are on RIAA etc websites - just a thought. mind you.

Re:Even better ...

[malinha]

you create a image ( artistic work, protected by copyright ) host in some site, RI** download the image so they can see what torrent is hiding in image, RI** try to sue you, the shoot backfires, you sue the RI** for using your copyrighted material without paying the 80k imaginary market value, because you would sell the pic for 80k.

profit!!

Binaries

[jkxx]

I'll be impressed when they start hiding torrents in EXE files, like with hydan. Bloated installer archives (Nvidia drivers being a good example) should make for nice carriers for this. Or even better, expand to making it possible to hide the info in any kind of file.

Why limit it to torrents?

[Steve S]

I built a utility that can be used for the same purpose back in april. http://cosmodro.me/blog/2009/apr/11/smuggle-improved/
It's a small flash movie that can encode files into pngs and decode them back. It's not limited to torrents, so you can encode any file that's less than about 16MB.

Re:Why limit it to torrents?

[skeeto]

I also wrote a tool to wrap files in PNGs two years ago. It's a command line that would be operated in a similar way to a compressor, like gzip. As for file sizes, it should only limited by the PNG format itself.

http://nullprogram.com/projects/pngarch/

Or just grab the repository,

git clone http://git.nullprogram.com/pngarch.git

All data is stored in visible pixels, not hidden away in metadata. It also has some simple parity checks to make sure the image wasn't damaged somewhere along the way (some kind of lossy transformation), and keeps track of the original filename by storing that in the image as well.

(Retrospectively, I think it could probably be a lot better than the state I left it in.)

Re:Why limit it to torrents?

[soniCron88]

Fun thing to do with this: convert a raw audio waveform to PNG with his tool, then convert it to JPG (with some modest compression), then back to waveform.

Obviously, it's not going to sound wonderful, anymore, but it's a fun experiment in lossy compression in the audio domain. (Albeit a wholly inefficient and crappy one, but fun!)

Re:PNG vs JPG

[Anonymous Coward]

He was being ironic.

Re:PNG vs JPG

[Anonymous Coward]

Whoooosh!!!

Re:PNG vs JPG

[Anonymous Coward]

They see me trollin', they hatin'...

Not really steganography...

[TerranFury]

Steganography hides data in an innocuous-looking "carrier" signal; e.g., a photo from your vacation; it's about hiding in plain sight. These images are not pictures of anything, and very obviously represent just a bunch of bits shoved into an image. It's the difference between a spy sending the message "So, I hear the Yankees won the other day" to communicate "assassinate the prime minister" to his partner, and sending the message "ENCRYPTED: XLAIHOIUHLEGDHGDLHSLKJHDGS" to his partner. The former avoids suspicion; the latter arouses it.

Better would be to just shove the torrents into some "reserved" or "metadata" portion of the image format, say somewhere in the header, or after the last byte of the image data (or similar; I'm not super familiar with the implementation details of these formats).

Re:Not really steganography...

[Anonymous Coward]

So, you take the image created by this program, reduce the intensity 10 fold (assuming the storage method allows this) and do a sum of this image with an innocuous template image. The receiver then subtracts the template image, increases the intensity 10 fold and wallah, the image encoding the torrent.

!steganography

[Chris Pimlott]

This must be a different use of "hiding" that I'm aware of, which apparently means 'make it blatantly obvious that this image is encoding something'. The point of steganography is that the image doesn't appear to have any hidden data in it.

So I suppose there might be some use for this, but it's not about to fool any hosting provider that dislikes torrents.

full rounded pr0n

[uncanny]

So now, what this is telling me is that you can post porn videos INSIDE porn pictures? mind boggling!

Forums can use it too

[Anonymous Coward]

Why can't a forum owner scan all uploaded images for torrents using the same technology?

Why worry about the torrents?

[fishbowl]

And not worry about the *transport?*

The Torrent file is just a little bit of text information, but what about the actual transfer, where huge amounts of data are transferred with the endpoints just flapping in the breeze, waiting for some authority figure to take notice? This is the 21st century. Shouldn't some cryptographic scheme be in place making it impossible for things like governments and XXAA's to take any interest in what goes on in the torrent transfer?

Off Topic Sig Correction

[AP31R0N]

There's no way to send PMs here AFAICT, so here goes:

- Censorship is obscene.

Show goatse to your children, and let me know how that goes for you. i hope you don't have children. Or, make it your computer wall paper at work.

- Patriotism is bigotry.

Which would mean that loving your family is bigotry. Patriotism is nothing like bigotry (or racism). Bigotry and racism are about fear. Patriotism is about pride and love. Some people take patriotism too far and into the realm of nationalism, patriotism's evil little brother. Don't confuse the two.

- Slashdot 2.0 sucks.

Opinions are not facts and should not be expressed as such. Try something more adult, like... "I don't like Slashdot 2.0 because of X and Y".

And no, i won't be reading your whiny ass response. Try to learn and grow. Maybe be a bit less cynical.

Re:Off Topic Sig Correction

[Hatta]

Show goatse to your children, and let me know how that goes for you.

What's the worst that could happen? The kids say "ewww!". So what? If someone of any age thinks they want to see that stuff, I don't see why they should be stopped. Frankly the overreaction by authorities would be much more harmful than the actual image itself.

Patriotism is about pride

Like white pride?

Opinions are not facts and should not be expressed as such. Try something more adult, like... "I don't like Slashdot 2.0 because of X and Y".

I'm scraping up against the character limit as it is. I think my meaning is clear as it is.

And no, i won't be reading your whiny ass response. Try to learn and grow. Maybe be a bit less cynical.

Well thanks for the advice anyway. Have a nice day.

Re:Off Topic Sig Correction

[Sir_Lewk]

Opinions are not facts and should not be expressed as such. Try something more adult, like... "I don't like Slashdot 2.0 because of X and Y".

You are an overreactive and offtopic ass. How's that for fact?

Re:Off Topic Sig Correction

[kayditty]

I think a better response to his first problem is that it's completely unrelated to censorship. as for his second, he has a fair point. I don't see that anything's wrong with "white pride," for what it's worth, but I understand your argument to be something along the lines of 'it doesn't make sense to be proud of something that you had no hand in being responsible for'? i.e. nationality is not something that is earned and blind patriotism doesn't make sense. fair enough, but, as he said, that isn't the same thing as patriotism. that's nationalism.

it is possible to be proud of things that have been done, even irrespective of your involvement, whether or not you happen to be related to those things by sheer chance or anything else, including being proud at where you live, and not necessarily without scrutiny and reservation, and not necessarily just because you are there.

humanity may be insignificant in the grand scheme of the universe, but we can be proud of our achievements; as Sagan would say, we show great promise. on the topic of patriotism, I really love Penn Jillette's thoughts, as exemplified here. it's a lovely illustration of the point.

if you can find this, by whatever means most convenient to you (and assuming you haven't already seen it--if you have, see it again), it's an even better illustration and what I'd intended on linking. that show and the episode in particular are really moving.

Why bother to hide it at all?

[symbolset]

I'm sure the process creates works of intrinsic art of themselves, new works.

Re:Why bother to hide it at all?

[Amazing Quantum Man]

And if the xxAA gets the torrent from the image, they're illegally circumventing a technical protection measure!

Re:Why bother to hide it at all?

[Anonymous Coward]

What does the Gay Nigger Association of America have to do with this ?

Similar to Spore

[kevmatic]

I'm suprised no-one has mentioned this, but Spore Creation files are PNGs with a picture of the creation, with the data needed to create it in the game hidden in the alpha channel. This scheme, obviously, just generates a blurry group of pixels, but I wonder if you could change it somehow so the png looks like its contents... Like text of what's in the .torrent.

I'm waiting for larger file support

[sootman]

250k? Instead of images, they should move to a file that's naturally larger and gives them more room to work... like movies! I can't wait until one movie is hidden inside another. Like I can download "The Fast and the Furious" but it's actually got "3:10 to Yuma" inside. Then maybe they can make a VLC plugin so when I open the container movie I see the hidden movie instead.

Somebody quick, get XZibit on this right away!

Junk Tech

[kenp2002]

MAFIAA: We'll sue torrent hosters.

Web Site Operators: Make sure to convert all images that are uploaded and embed a stenographic message of "This image has been processed by (web site name here)"

Result: The Encoded torrent info is destroyed due to the subsequent stenography applied to the image.

I expect that code to be in drupal and damn near every CMS within the next month to avoid the MAFIAA.

Re:Junk Tech

[HTH NE1]

stenography != steganography. The former is what the court reporter uses to record the proceedings when you get prosecuted for using the latter for illegal purposes.

BTW, in their attempt to properly index the whole Internet, is Google going to have legal trouble when these start showing up in Google Image Searches for "torrent"?

Re:Junk Tech

[swilver]

Perhaps. But one can also include error correction information in the image, allowing even partial or damaged images to reconstruct the torrent file. Assuming of course it is not damaged beyond recognition or cropped too much (but I doubt such image hosting sites would live long).

Re:Junk Tech

[kenp2002]

typo on my part

Mod peers up

[AlpineR]

Seven informative responses and not a mod point to spend. Maybe every logged in user should get a half mod point to spend every day. If two of those seven spent a tenth as long modding as talking, the misunderstanding would be corrected and closed.

Er.. wha? What use is this?

[brunes69]

Do these guys even know how Bittorrent works? A .torrent file is useless without a tracker. What tracker are these files using? Whatever THAT host is, why isn't it just hosting the .torrent files?

Invert-Trick

[allcoolnameswheretak]

If you encode a .torrent into a PNG, invert the colors in Photoshop and decode the image back again, you get the torrent download and save alot of bandwidth.

How about torrent hosting?

[iYk6]

Does this solution seem worthless to anybody else? It is less convenient to the users who have to download it, and it is full of potential problems, such as image hosting sites scanning their images for stuff like this and banning them, or simply resizing or compressing the images, and therefore corrupting the hidden data.

This solution is less convenient than the current one, which is to upload a torrent to a torrent hosting service, such as TPB or MiniNova, and then providing a link.

PNG metadata

[handy_vandal]

[PNG is] a bit like a barcode, only with more capacity since it's 2D and colour.

PNG also supports internal textual metadata. Example: Adobe Fireworks "... by default also stores meta data for layers, animation, vector data, text and effects [in PNG]."
- http://en.wikipedia.org/wiki/Portable_Network_Graphics

Re:PNG metadata

[slim]

PNG also supports internal textual metadata. Example: Adobe Fireworks "... by default also stores meta data for layers, animation, vector data, text and effects [in PNG]."

All true, but the hid.im scheme doesn't use any of this. It just puts a single image in the PNG, that's not supposed to look like anything more than a bunch of pixels, and can be decoded into a torrent file.

Re:WARNING! Your toddlers might violate a Patent!

[glodime]

WARNING! Your toddlers might violate a Patent! http://preview.tinyurl.com/22yk38

My parents have evidence of my prior art dating back to the mid 1980s on VHS-C. I'd show you but the cassette adapter is broken.

What's the point of .torrent files?

[Hurricane78]

I can put my ed2k and magnet links right in here. No problem at all. :)

ed2k://|file|[DivX - ENG] Monty Python And The Holy Grail 1975.avi|734478336|DD25EDAE3F63726F19C9B86CE4F117DE|/

What a great technology from... 2000! ^^

In my opinion, BitTorrent was a huge step backwards. Imagine if Bram Cohen had created some darknet (which would be the logical next step) with the same success instead.

right!

[goombah99]

well don't forget to include a description in plain text so it's search able. You could however post that in another comment with a link back to the hex torrent comment.

Doesn't matter if software can detect THIS version

[Anonymous Coward]

all reputable ones will decline to host those images.

Yes, it's detectable. But I think a lot of site maintainers have better things to do, than continuously work on the image-that's-not-used-as-an-image format du jour. If an image file decodes as an image file, then as a programmer I am done worrying about it, except for maybe secondary things, like "does the width cause it to fuck up the layout so that it needs rescaling?" It doesn't take much to sneak this by me. And that's not technical incompetence (flame me for my real mistakes (there are lot) but not this); it's just that blocking images based on possible meanings of their pixels, isn't something worth spending infinite time on.

Programmers are not going to play whack-a-mole. Turn this into whack-a-mole, and you've beaten me. I whitelist image files that behave like image files. I am not going to maintain (i.e. spend recurring time on) a blacklist.

At that point, maybe a human moderator might decide, "This image makes no sense," and see it as spam or something, and delete it. But that person isn't someone who keeps up with all the latest tech fluff and isn't going to know it's a torrent. The software could know it's a torrent and explain it to the moderator, but like I said, I'm not going to bother, because once I set down that road, it's a continuous job to keep up, and that's time I could spend doing real work instead.

If the hosting site doesn't have human moderators that are looking at the images and saying, "I don't get it, this was a discussion thread about lawnmowers, why did some user post a comment containing a picture of random colorful snow?" then it's not going to get blocked.

How about StegTorrent

[ccool]

Parent is correct, also, a little software based on steghide does exactly what is mentionned here... It would be just a matter of putting everything in a firefox extension and you could have something much better than hid.im (although it is a good idea)

I really like the idea where, instead of a blob of color with no real meaning, you could use a representative image, like a movie-poster image...

Use GIF. No 250K limit

[wiredlogic]

You can concatenate anything onto the end of a GIF image and still have a valid file without any limit on payload size. The classic example is to append a zip file which keeps its "headers" at the end of the file and doesn't measure any offsets from the beginning. This allows you to attach anything to a GIF without having to have special tools to extract the payload.

Re:Use GIF. No 250K limit

[Skapare]

... unless the image hosting site does any processing of the pixels to re-create the image file for some reason (and there are some). Of course if you have your own web site, this is easy.

Might still be useful

[nurb432]

Would let you host them anonymously on freenet without the trouble of how to run a regular tracker on there.

There you can post descriptions to your hearts content.

Thanks a lot asshole

[Anonymous Coward]

You just wiped my buddy's mind!

- Hiro

Processing power

[Well-Fed Troll]

It would be easy enough to require an obscene amount of processing power to find the image. Simply run the image through an encryption algorithm 100 times. The end user could wait a few minutes to decrypt the image, but there's no way a website could do that.
Another way to do it is to include a decryption key as a captcha in the image.

Re:Processing power

[SuiteSisterMary]

And doing all that obviates the stated goal of having the torrents easily spread and accessed, and solves the problem anyway.

qr code instead

[Anonymous Coward]

A better option would be to encode the torrent's magnet URL into a QR code and the distribute that.

Steps to prevent trivial decoding by adversaries?

[Anonymous Coward]

As mentioned by others, what are potentially reasonable methods for keying the input data to prevent trivial decoding, while providing decent usability?

One half assed way would be encoding using the DNS name of the intended image hosting service as a kind of salt, which would allow the firefox plugin to quickly pick up the salt based on the URL, but that wouldn't really help prevent the image hoster from decoding the image, only when the image is stored on an unintended server with a different DNS name. To preent the original image hoster from doing trivial decoding, there would have be some sort of contextual separation of the salt/key, maybe a comment tag or field which contains the actual text key. I suppose for a firefox plugin, right click an image to activate the plugin, and then you would be prompted to select a section of text for the key.

Another related idea is being able to use a preexisting image and modify/distort it. The problem with this is there would need to be a reference unmodified image to detect and determine the distortions and reverse them to decode the data. Because of the payload size issue, it would have to be a fairly large image to begin with, which is somewhat unattractive.

Host-proof hosting concepts really are hard to implement in reality.

goombah99: time to grow up

[ChrisCampbell47]

OK OK, I won't mod him down like I was going to. But JESUS CHRIST goombah99, take a extra minute and proofread your post next time and fix all the errors! There's apparently something of value in there, but trying to read it makes my brain bleed.

Re:goombah99: time to grow up

[goombah99]

sorry dude. My wrist and thumb are in a cast. (really) I'm not used to making this many typos yet. gotta improve my proof reading I guess.

Yo dawg

[Anonymous Coward]

I heard you like pr0n so I put pr0n in your pr0n, so you can watch pr0n while you download pr0n.

Captcha

[Anonymous Coward]

I imagine image hosting sites will have a hell of a time if you encrypt the torrent portion and add the key to the image. Imagine slapping a captcha on the image which is used to decode the contents.

Way to do it

[Anonymous Coward]

At the moment people are afraid that companies can track them down using IP logs, contacting ISPs to obtain their details and then trying to sue. But that could easily change if someone came up with a worm which participates in p2p sharing on infected machines and imitates various p2p clients.

It would give really strong argument to people trying to defend themselves from these companies, by saying they had infection.

What do you think?

Re:Way to do it

[Anonymous Coward]

great thinking!! worm would need to make the news worldwide. then every piracy suspect could claim innocence!!

life on the chans is good

[Nyder]

sweet, now on 4chan (and 12chan) not only will CP be hidden in a torrent, but a torrent will be hidden in CP...

life is good

Uh, QR code?

[mykro76]

Has nobody heard of them? http://en.wikipedia.org/wiki/QR_Code An established standard for encoding text as an image. Bonus is - any current smart phone with the right app can recognise qrcodes. There's dozens of open source libraries to encode and decode them.

Simpler and easier solution

[Anonymous Coward]

Just post the output of 'gpg -a --store something.torrent'. On forum will block ascii text