Secure Computing: Sec-C

The DC3 just posted all of the solutions submitted this year (click on "Challenge Results" and then "View" next to the team's name). [Update: The links have been taken down temporarily, but will return shortly. Update: They're back!]

Challenge #402 was advanced image analysis. Most teams focused strictly on meta data. However, a few teams did use the Error Level Analyser. (Brag: Error Level Analyser was created by Noah and is based on the Error Level Analysis description found in my Black Hat paper.) One team, APWG, used Error Level Analyser and their own variant of the same algorithm.

JPEG Ballistics

One way to tell if an image is "original" is to see if it came from a known original source.

JPEG Fingerprinting (also called "ballistics") attempts to match meta data and file structure with a known device. For example, the JPEG meta data may include a camera make and model. Using programs like Exiftool and JPEGsnoop, this meta information can be quickly extracted.

However, there is a problem with analysis based strictly on meta data: meta data can lie. Here's a fun test: Start with a picture from a digital camera. Exiftool should list lots of juicy meta data that identifies the camera. Load the image in Photoshop, draw on it, then resave it. The new picture has your drawing on it, but meta data that still identifies the camera.

While Exiftool only extracts meta data, other tools, including JPEGsnoop, evaluate a variety of image attributes.

Size Matters

JPEG Fingerprinting goes much further than just the meta data. For example, the Fujifilm Finepix F10 6.3MP Digital Camera can only take pictures at 3024x2016, 2848x2136, 2048x1536, 1600x1200, or 640x480. If you have a picture at any other resolution, then you know it did not come directly from this camera -- even if the meta data says that this camera was involved in the picture creation.

Q Table Matching

More wicked is quantization tables analysis. Quantization tables (Q tables) are used by JPEGs to reduce the signal level and increase compression. Ideally the Q tables should be optimized for each image. However, this is computationally expensive -- imagine clicking on "Save As Jpeg" and then waiting 2 minutes for it to save. It is even worse with digital cameras; most cameras lack the resources for high intensity computations.

Rather than computing the Q tables as needed, most applications and cameras use hard-coded Q tables. If your camera has three quality levels (high, medium, low) then you are actually selecting one of three hard-coded Q tables stored in the camera. Photoshop actually has 13 different hard-coded Q tables (I'm ignoring Save For Web, which has even more options). And different versions of Photoshop have different Q tables.

Most applications and devices use custom Q tables. For cameras, the tables may be optimized for the CCD, manufacturer's color space, or image size. Most cameras have different Q tables -- they can even be different between different cameras in the same product line.

Unfortunately, Q tables are not always unique. Many open source tools use the same Q tables (why derive when you can reuse?), and practically everyone does "99% quality" the same way (the Q tables are all "1 1 1 1 1 ...."). But even between different cameras, the same Q tables may appear. For example, the Nikon E2500 has Q tables that match 92% quality. The exact same Q tables are used by the Seiko Epson Corp. PhotoPC 3000Z.

All Together

Ideally, you want to match the meta data, image size, and Q tables (and anything else you can find) to known samples from a real camera. If something does not match, then you know it did not come directly from the camera. And if you get a perfect match, then it is a strong indicator (but not necessarily proof) that it came from the camera.

Applied Ballistics

Different digital cameras have different quality images. Some pictures may be grainy, others may have trouble with bright colors, and still others may not have a very white "white".

Let's say that you want to evaluate pictures from a digital camera before deciding on buying it. There is a web site called Digital Photography Review (DPR) that offers a gallery of pictures taken with different digital cameras. They have the images scaled to 50% (not original, but good for viewing) as well as the original images from the camera.

Ah, "original images". This is where the problem comes in. They have literally hundreds of high quality pictures that really came from the cameras. These are "original". However, of the 300+ original photos, I have found nearly 10% are not "original".

In most cases, the non-originals were saved using Photoshop. Now keep in mind, I am certainly not saying that these pictures have been edited or doctored or are forgeries. They appear to have just been saved using Photoshop. The problem is, JPEGs lose quality each time they are resaved, and these have been resaved -- they are not "original from the camera".

Here are three examples:

• Fujifilm FinePix S100 FS. The first picture shows a golden mirror hanging on a red wall. The original image is huge (3840x2880), but it shows a lot of grain and noise. The original was actually saved using "Adobe Photoshop CS3 Windows". Considering that the resave should remove noise, this is really a horrible picture. Then again, all of the other original gallery pictures from this camera do not show as much noise -- so maybe the noise was added using Photoshop or emphasized by Photoshop. (Probably not, but it is an option since the image is not "original".)
  
  
• Kodak DCS Pro SLR/c. The first picture is a wonderfully clean image of a Ferris wheel. The problem is, this original was actually saved using Adobe Photoshop CS Windows.
  
  
• Leica M8. The first picture is a stunning black-and-white cityscape. However, it has meta data saying that it was saved using Photoshop 3.0. The other black-and-white sample image also says Photoshop 3.0. However, the color samples each lack this Photoshop meta data. I suspect that Photoshop was used to create the black-and-white images from color images.

Then again, perhaps we should not trust the gallery images provided by the actual camera manufacturers. For example, Leica has a gallery of sample images taken by their cameras. Every one that I have checked so far was actually saved using tools like "Adobe Photoshop CS3 Macintosh" and "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 100.". I cannot find a single sample on Leica's web site that actually came directly from a camera.

So as not to pick on Leica, the same can be said for sample pictures at Nikon. I could find no camera-originals to download, but they have a cool Flash wrapper around post-processed and resaved sample images.

In contrast, Kodak and their Kodak Gallery has no sample pictures (but lots of things you can buy) and I could find no way to browse images at http://www.kodakgallery.com/. One would think that with two different web locations that are both titled "Kodak Gallery", that this camera manufacturer want people to see samples from their cameras. One would be wrong.

But all is not lost: galleries at Canon and Casio really do have straight-from-the-camera samples.