Slashdot Mirror
New Service Converts Torrents Into PNG Images
jamie points out that a new web service, hid.im, will encode a torrent into a PNG image file, allowing it to be shared easily through forums or image hosting sites. Quoting TorrentFreak:
"We have to admit that the usefulness of the service escaped us when we first discovered the project. So, we contacted Michael Nutt, one of the people running the project to find out what it's all about. 'It is an attempt to make torrents more resilient,' Michael told [us]. 'The difference is that you no longer need an indexing site to host your torrent file. Many forums will allow uploading images but not other types of files.' Hiding a torrent file inside an image is easy enough. Just select a torrent file stored on your local hard drive and Hid.im will take care the rest. The only limit to the service is that the size of the torrent file cannot exceed 250KB. ... People on the receiving end can decode the images and get the original .torrent file through a Firefox extension or bookmarklet. The code is entirely open source and Michael Nutt told us that they are hoping for people to contribute to it by creating additional decoders supported by other browsers."
The.Black.Hole.1979.dvdrip.xvid.torrent -> goatse.png
.
Trolling is a art,
I still think the solution is to change TPB to a TpayB. Allow us to pay $1 for a movie and allow studios to save face and jump in. More hiding like this will just put the Congressmen in action to filter. If this path is chosen, we will all be living in wifi-caves before long.
No "steganography" tag yet?
Slashdot, I'm disappointed in you. :P
Hosting a bunch of images doesn't do any good unless you have a text (or at least searchable) description of what you're downloading. Without context, warehoused information is useless. And these PNG files are just different representations of the same quasi-legal information (that is, they're still colored bits.
you mean the pirates are going to continue to beat out "the man" and get away with it?
I'm just utterly shocked.
doesn't re-scale or tag your uploaded images first!
"I bless every day that I continue to live, for every day is pure profit."
If the conversion process is resilient enough, it might not depend upon the image having an identical binary format.
My blog
I can download all of my pirated torrents and view pr0n in one convenient step? If so, this is one brilliant Nutt!
"The code is entirely open source and Michael Nutt told us that they are hoping for people to contribute to it by creating additional decoders supported by other browsers."
Ok, ok, I do understand that a browser plugin adds some convenience, but how about a stand-alone version (native executable, or maybe something like a Java, Python, Perl, or Lisp program [which would be cross-platform]), which I can just run either as a GUI, or even a command line. . .
png2torrent in.png out.torrent
(heck, the original torrent filename might be stored in the png, so you might only need to specify the input file, and optionally an output path/filename if you want to change the name or extract to a different directory).
Maybe a drag-and-drop icon on the desktop - drag the png to the icon, and it automatically creates the torrent on the desktop.
All sites hosting images will just be required to filter for those images which have torrents inside (it shouldn't be hard, just try to decode the torrent, and if you succeed, reject the image). Or alternatively, to implement software which destroys the included torrent before putting the image online.
The Tao of math: The numbers you can count are not the real numbers.
If you're trying to post torrents into a web board that won't let you, wouldn't it be easier to encode the torrent to ASCII somehow? Say, MIME or yEnc? I mean, you want people to find the .torrent, so there's no point in hiding it with steganography.
Give me Classic Slashdot or give me death!
OMG, who uses PNG files?! The compression routine is rubbish! I'm going to use this technology, but I'm going to convert the files to JPEG before I upload them. When people see how much smaller the file is that they have to download, they'll quickly move over to my way of thinking.
Summation 2
Here's an example. It's the OpenOffice.org 3.1.0 win32 torrent taken from the OO.o site.
Couldn't you just use the comments section of a .tif file instead? At least then the picture could still look like kittens instead of a broken magic eye.
If people constantly found ways to rob banks without implications there wouldn't be many banks left, would there? Instead there would be another solution that fits reality better. I don't know if you're trying to be funny or really using this as an argument, but if you're serious then you have to understand that if a method doesn't work, you need to rethink it and adapt it so that it does. The same goes with robbing banks. The very reason that we have banks left is because they've been adapted to reality. Bigger and more secure safes, security staff, panic buttons etc. The fact that avoiding getting caught filesharing is so easy means that something is wrong. Either we keep up this charade and try to limit internet without any results, or we adapt ourselves and our businesses to it and create new rules that can coexist with internet.
I am the lawn!
I'm half tempted to pop it open myself and add a feature that inserts a text description into the encoded PNG. Really, I don't think it would be too hard (hell, it could just have a few flag bits that tell the interpreter how much of the image needs to be cropped to remove the description.)
"Sorrow is better than laughter, for by sadness of face the heart is made glad." [Ecclesiastes 7:3]
Lack of transparency support for your PNGs won't let those bastards see through the image to your thinly veiled P2P activity! Looks like IE6 just won the browser war.
Take a .png of the Mona Lisa and convert it to a torrent and it downloads several thousand hours of voice notes by Da Vinci... and porn
"The Y chromosome is genetic. The odds are very good that if you are male then your father was too." -Internet Commenter
Instead, what they're doing here is encoding the data contained in a torrent file as valid image data. I'm not sure exactly what technique they're using, but the process is essentially analogous (though surely more complex) to treating each bit as a black/white pixel indicator. Given some agreed upon dimensions for the image (either width or height, doesn't matter which) this gives you a black and white bitmap which could then be encoded as a png.
Clearly what they are doing is more complex since their images are color (and they may be relying on specifics of the way png images are formatted), but the basic idea is the same.
The.Black.Hole.1979.dvdrip.xvid.torrent -> goatse.png
goatse.png->The.Black.Hole.1979.dvdrip.xvid.torrent
Well, that explains why in the UK piracy is down.
A while ago it was a common thread on 4chan to have torrents hidden within rar files appended to jpgs. This lead to massive amount of virus infected files being uploaded. 4chan banned images that it could detect rar headers within. I can imagine similar practices would be up and about on other image boards as well.
It won't work as intended but not for the reason you say. Regardless of whether it's steganongrphyically encoded or not, this is just amtter of detectability to the eye.
let's work through the logic:
If a firefox plugin and retreive the torrent then so can any image hosting site. all reputable ones will decline to host those images. the torrents might be legal ones, but the image hosting sites will not see it valuable to their bussiness model to offer a service which might be hosting links to tainted goods.
if the encoding is done is some way that while a firefox plugin can easily recover a code that represents a torrent but you can't tell from the code if it is a torrent (without say actually trying it out) then you will have to have some other signifier that the image contains a valid torrent and the identity of what the torrent contains (so you can search for what you want). ANd again the image sites will decline to host those.
so you might as well just post hex encoded torrents and their plain language desciptions right to slashdot in the comments or in your journal. Anyone can then use slashdot's search feature or for that matter google with a site:slashdot.org search term to find them.
so it seems like this has no value as a means of hosting torrents.
Now it does have two uses one legitimate and one not. it could be just a conveinet way to pass around a torrent assoiciated with an image all in one handy container (kind of like a bussiness card printed on a mini-cd). nd it could be a way for someone to establish plausible deniability that they were posting a torrent. e.g. a blog post deploring the loss of revenue for Metalica with a picture of the band's latest almbum that happens to hide a torrent for that albumn. ("oh the irony, I just grabbed that image off google images and little did I know that particular one held a torrent. wink wink")
Some drink at the fountain of knowledge. Others just gargle.
This is for encoding the .torrent file. Not whatever it points to.
For example, I just found a torrent file for Terminator Salvation - 14kB
Filename extensions are a form of metadata, and I don't think it sets a good precedent to lie in the metadata for a file. It's bad enough that we have Windows hiding filename extensions from the user, and encouraging people to just double-click on a file to launch the associated app. This just seems like asking for more problems, as people try to double-click on mjthriller.png and it launches - and crashes - IE.
I know, I know... This is Slashdot, nobody reads the article. But could you at least read the summary?
They aren't re-naming a file. They aren't just dropping the .torrent extension and replacing it with .png The resulting file isn't going to run any malicious code or do anything bizzarre.
They're encoding the bits of the .torrent file in a .png image. It actually creates an image. Looks like some kind of abstract/modern art kind of thing... Blocks of bright colors. You could open it with any graphics program... Set it as your wallpaper... Send it off to WalMart to be printed on photo paper...
"Work is the curse of the drinking classes." -Oscar Wilde
I built a utility that can be used for the same purpose back in april. http://cosmodro.me/blog/2009/apr/11/smuggle-improved/
It's a small flash movie that can encode files into pngs and decode them back. It's not limited to torrents, so you can encode any file that's less than about 16MB.
------- Driver carries less than 64K of cache.
Steganography hides data in an innocuous-looking "carrier" signal; e.g., a photo from your vacation; it's about hiding in plain sight. These images are not pictures of anything, and very obviously represent just a bunch of bits shoved into an image. It's the difference between a spy sending the message "So, I hear the Yankees won the other day" to communicate "assassinate the prime minister" to his partner, and sending the message "ENCRYPTED: XLAIHOIUHLEGDHGDLHSLKJHDGS" to his partner. The former avoids suspicion; the latter arouses it.
Better would be to just shove the torrents into some "reserved" or "metadata" portion of the image format, say somewhere in the header, or after the last byte of the image data (or similar; I'm not super familiar with the implementation details of these formats).
This must be a different use of "hiding" that I'm aware of, which apparently means 'make it blatantly obvious that this image is encoding something'. The point of steganography is that the image doesn't appear to have any hidden data in it.
So I suppose there might be some use for this, but it's not about to fool any hosting provider that dislikes torrents.
So now, what this is telling me is that you can post porn videos INSIDE porn pictures? mind boggling!
Why can't a forum owner scan all uploaded images for torrents using the same technology?
I'm suprised no-one has mentioned this, but Spore Creation files are PNGs with a picture of the creation, with the data needed to create it in the game hidden in the alpha channel. This scheme, obviously, just generates a blurry group of pixels, but I wonder if you could change it somehow so the png looks like its contents... Like text of what's in the .torrent.
No, the size of the files listed in the torrent doesn't make a difference to the filesize. The number of trackers, nodes, and piece size (etc.), however, does. I just downloaded a .torrent file describing an 8GB 1080p movie, and it was 41KB in size.
And if the xxAA gets the torrent from the image, they're illegally circumventing a technical protection measure!
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Yes, it's detectable. But I think a lot of site maintainers have better things to do, than continuously work on the image-that's-not-used-as-an-image format du jour. If an image file decodes as an image file, then as a programmer I am done worrying about it, except for maybe secondary things, like "does the width cause it to fuck up the layout so that it needs rescaling?" It doesn't take much to sneak this by me. And that's not technical incompetence (flame me for my real mistakes (there are lot) but not this); it's just that blocking images based on possible meanings of their pixels, isn't something worth spending infinite time on.
Programmers are not going to play whack-a-mole. Turn this into whack-a-mole, and you've beaten me. I whitelist image files that behave like image files. I am not going to maintain (i.e. spend recurring time on) a blacklist.
At that point, maybe a human moderator might decide, "This image makes no sense," and see it as spam or something, and delete it. But that person isn't someone who keeps up with all the latest tech fluff and isn't going to know it's a torrent. The software could know it's a torrent and explain it to the moderator, but like I said, I'm not going to bother, because once I set down that road, it's a continuous job to keep up, and that's time I could spend doing real work instead.
If the hosting site doesn't have human moderators that are looking at the images and saying, "I don't get it, this was a discussion thread about lawnmowers, why did some user post a comment containing a picture of random colorful snow?" then it's not going to get blocked.