Tiny Twitter Thumbnail Tweaked To Transport Different File Types (theregister.co.uk)

Security researcher David Buchanan has found that Twitter image uploads can be polyglot files, meaning they can be valid simultaneously in multiple formats, such as a .jpg, a .rar archive and a .zip archive. From a report: Using some Python code he wrote, he created a thumbnail image of William Shakespeare overlaid with the words, "Unzip Me" and posted it to Twitter. The .jpg image is also a valid .zip file, so if you download it, you can unzip it and extract the contents, a multipart .rar archive of the text of Shakespeare's plays. [...] Twitter performs some processing on uploaded images, which has the potential to mess with the data. But Buchanan found that his multi-format file survived this process. It may be that image itself (excluding the rather bulky metadata) is light enough not to trigger any compression or post-upload processing.

Comments

Twitter preserves image data fairly well

[suso]

A while back I tried posting an image with a hidden steganographic message in it to Twitter and to my surprise the hidden message was preserved and not lost due to recompression. Also, the recent Banksy-style shreded image I posted to climagic that was basically a corrupted jpg file was preserved pretty well. In other words the corrupted part looks identical to what I see with the original on my own computer. However posting it to Mastodon.social resulted in a reprocessed image with compression artifacts