Hacker News new | ask | show | jobs
by mananaysiempre 1510 days ago
In 2018 people discovered that Twitter would recompress images but leave the embedded ICC profile, if present, intact, and used that to make a Twitter-surviving JPEG+ZIP polyglot[1], although that got patched out once someone used it as a C&C channel[2]. Apparently that still worked (and was utilized for the same purpose) on Steam user profiles in 2021[3].

[1] https://twitter.com/David3141593/status/1057042085029822464

[2] https://www.trendmicro.com/en_us/research/18/l/cybercriminal...

[3] https://twitter.com/miltinh0c/status/1392944896760238080

1 comments

This technique is still fully functional: https://github.com/DavidBuchanan314/tweetable-polyglot-png