I am trying to decrypt a completely black gif that I know has been encrypted by some sort of steganography. I've tried subtracting the bytes of the images with each other, and so far I have gotten a really weird image consisting of seemingly random patterns of black and white pixels. What are the most common techniques to go about decrypting this image?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
GIF images use look-up tables to store colours. If two entries in a table contain the same colour, then the pixels assigned to these colour values will be indistinguishable.
For example, here is a one-bit-per-pixel GIF image. It started out as a black and white image, but I edited the colour table so that the white pixels also appear black:
You can retrieve the message by restoring the colour table in a graphics editor like Gimp (Colors → Map → Set Color Map) or by editing the data directly (change bytes 13, 14 and 15 of the file from 000000 to ffffff).
Other possible approaches include storing information in a comment field, or appending it to the end of the GIF data. In animated GIFs, the delay time between frames (in hundredths of a second) is represented by an unsigned 16-bit value, so it's possible to create an image that freezes on an empty frame for almost 11 minutes (655.35 seconds).
(By the way, encryption and steganography are two different things. If your image contains encrypted data, then finding this data is only the first step.)
-
$\begingroup$ Is GIF format suitable for steganography? $\endgroup$ Commented Jan 11, 2016 at 11:30