Friday, February 17, 2012

Re: Vim Script Spam

On Fri, Feb 17, 2012 at 02:20:56PM +0100, Marc Weber wrote:
> Excerpts from John Beckett's message of Fri Feb 17 00:18:00 +0100 2012:
> > Thanks, Bram has alerted me to that. I will be deleting it
> > (and some related stuff) in about 24 hours.
> The exif data does' not look suspicious. Wondering what the purpose of
> this kind of spam is?
>
> winrar also is said to be able to "hide" bytes in jpeg files - but fails
> on those.

The seganography angle actually makes a lot of sense, since the
picture wasn't a goatse-style shock image.

https://en.wikipedia.org/wiki/Steganography_tools

If WinRAR can't extract the data, you could always try one of these:
http://www.jjtc.com/Steganography/tools.html

> But they are uncompresed - thus they may contain some unkown custom made
> data information.
>
> At least one of those images can also be found on flickr (found by using
> searching for the name in google)

Maybe someone's just "testing the water" to see what they can get away
with later? If their images are deleted a few hours later, then
they'll know that's not a good place to hide their stegonography?
What with MegaUpload being taken down, they may feel the need to find
somewhere else to hide things in plain sight.

--
Erik Falor
Registered Linux User #445632 http://linuxcounter.net

No comments: