https://www.timwehrle.de/blog/i-stored-a-website-in-a-favicon/
A while ago I wrote about storing two bytes inside my mouse's DPI register. It wasn't useful. It wasn't practical. But it did something unfortunate to my brain. Once you've successfully hidden data somewhere it doesn't belong, you start looking at everything as potential storage.
A monitor is storage.A keyboard is storage.
A BIOS splash screen is (maybe) storage.
A favicon is storage.
And yes, here we are.
Every website has a favicon. It's that little icon in your browser tab. Usually you upload it once and then never think about it again. But. A favicon is just an image. An image is just pixels. And pixels are just bytes.
So of course I wondered if I could store something inside one.
This discussion was created by hubie (1068) for logged-in users only, but now has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
(1)
(Score: 5, Insightful) by Mojibake Tengu on Sunday June 28, @08:53AM (1 child)
The world is
brokenunreliable since the moment they added JavaScript to SVG.Now you can hide a whole operating system in a picture.
The kinder you are, the easier it is for wicked people to morally coerce you.
(Score: 4, Interesting) by anubi on Sunday June 28, @11:52AM
One thing I really liked about building my embedded microcontrollers is I could place my executing code in an EPROM, while the data was in RAM.
No one hacked my stuff. Even I couldn't hack it unless I had it in hand.
The last of that kinda stuff I made required me to bring another set of 27C512 if I needed to alter code.
Hacking it over the net was out of the question. It was too dumb to do that. Best it did was one-liners - .csv record lines. I don't remember if they were even called csv files. It was just fields separated by spaces, commas, line-feeds, or carriage returns. You could talk to it with a teletype machine. KSR-33. I think those were 110 baud. Western Digital and General Instruments made the UART chips, but you could do simple send-only with a 555 chip, two 8-bit shift registers, and a few gates.
Eh...what was that old phone phreak mag? Phrack? "Dial a mile, smile a while, here's more data for your file" or something like that printed in each issue?
It had a lot of info that turned out to be very useful for interfacing early computers to POTS lines. 300 baud FSK. All analog and lotsa trimpots. The phone company would come after us if they caught us connecting to their lines. So we used 600 : 600 ohm coupling transformers that were designed for carrying line hold current off-hook.
Ahhh, those were the days playing cat and mouse with the telephone company. Of course they didn't want anyone messing with their lines! My guess is we could keep hundreds of techs employed tracing down all the ground faults and external noise that got injected due to all the out-of-spec, made from innards of old washing machines and radio parts we kids were experimenting with. If we learned enough, we could make free phone calls to people we didn't know just to say we called someone on the other side of the world.
One guy was taking High School French language and loved calling France on a Blue Box from USA to talk to a real French person. That was a big deal back then.
We probably left in our wake many confused French people wondering why they were getting phone calls from people who obviously spoke French very poorly and asked meaningless questions.
I am getting old and recalling the crazy things I got mixed up in, and now consider it quite funny we did such things. I wish life was still that simple. I remember my Dad telling me some of the crap he did as a teen. Hilarious! Some of those old folks aren't nowhere near as stoic as they appear to be.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(Score: 2) by looorg on Sunday June 28, @09:24AM (5 children)
Do they really? I'm sure you can use the default browser one and not include a favicon if you don't want to. That said most do use one to differentiate themselves.
So he encodes some data in the favicon file. Even tho he sort of needs a boot strap to load the data from the icon. You can't just have one really large icon file that contains and loads everything on its own. Technically as far as I can recall there is no file size limit to the favicon so you could just make it as large as you like. You could attach as much data as you like or can handle to the file. Encoding it in the color bits if you like or just attach it all to the end of the file. It's not like people are going to sit around looking at favicon files for hidden data. Unless they are looking for it. Sort of like you can add as much text to a html file as you like. Most people don't even bother to read the source of the page. So you can put whatever you like in there in comments.
Not sure why you would bother encoding it in the color bits. Just attach it to the end of the file. Concatenation. I guess it's just not as cool as steganography.
What will the next project be? How he stores an entire website in any audio or image file or ...
(Score: 4, Funny) by chucky on Sunday June 28, @09:52AM (2 children)
After few more articles he will realize he’s become an expert on steganography and stop writing things publicly. Or he will publish further, hiding his articles in plain sight.
(Score: 4, Interesting) by JoeMerchant on Sunday June 28, @11:40AM (1 child)
>steganography
Yeah, he's impressed that his "website" fits in a 9x9 icon.
Most modern monitors don't even display the least significant 8 bits (3 Red, 2 Green and 3 Blue) out of each 24 bit color value, so if he further re-coded his 212 bytes to fit in just those bits his html text would fit inside a 16x16 icon of any arbitrary image without disturbing the appearence of it at all - much more "hidden" than making your website show a technicolor snow for an icon.
I made an encrypting steganography app that hid the data in ways that standard steganography detection methods can't detect about 15 years ago, and that was 17 years late to the party: http://justsolve.archiveteam.org/wiki/S-Tools [archiveteam.org] https://www.wired.com/1994/03/security-through-obscurity/ [wired.com]
🌻🌻🌻🌻✌️ [google.com]
(Score: 2, Informative) by Anonymous Coward on Monday June 29, @06:25AM
I've seen you say this a couple of times and it's not correct.
First, you're confusing two different things: the 16-bit color format, and the limited color palette of certain monitors.
16-bit color, obviously, has only 16 bits to work with, and it's 5-6-5 because the human eye is more sensitive to green than to red or blue. Hardly anyone uses 16-bit color for anything any more because
RAM is cheapRAM is plentiful enough that any reasonable display can be rendered in 32-bit. Even a 4K display at 32-bit is only 35MB of data. In the 90s 16-bit color was commonplace because video cards often only had a couple of megabytes of RAM; you couldn't fit 1024x768x32 into a 2MB video card, or 1280x1024x32 into a 4MB card, but you could with 16-bit. Also, the early 3D GPUs could only render 16-bit.Now, it's true that some monitors cannot render full 24-bit color, but they don't use 16-bit color, but rather 18-bit, 6-6-6. This is because they aren't limited by the data format but by the capabilities of the panel. But it's very wrong to say "most modern monitors." 18-bit color is a limitation of TN panels [wikipedia.org] only, and TN panels are, effectively, extinct for use as computer monitors, except for industrial displays with extended production lifetimes. Twenty years ago TN was the majority, ten years ago they were still common but on the way out. It used to be they were cheaper and had faster refresh rates which made up for their worse color, viewing angle, and general picture quality, but today IPS has improved in response time and price so much that it has taken over the entire low to medium end of the market, with OLED in the high end, and VA (which has similar characteristics to IPS) being around for curved monitors that aren't OLED. All of these panels can handle true 24-bit and the increasingly common wide-color-gamut and/or high dynamic range monitors are usually capable of 30-bit or 36-bit color. But the 30-bit color used by wide-gamut monitors is different from the 32-bit color format commonly used in image files and memory: 3x10 or 3x12 bits instead of 4x8. But, often you don't actually get the full 30 bits of color - just like how there were monitors that took 24-bit input but rendered 18-bit output, many of them take 30-bit input but render 24-bit output (or use the extra data to show HDR rather than finer color reproduction). However, for about five years now the whole pipeline from GPU memory through HDMI/DP to the monitor is 30-bit-color capable.
Lots of TN panels really did look very bad. An easy side-by-side comparison is with the Raspberry Pi 7" touchscreens. The first-generation touchscreen was a TN panel and the second-generation is an IPS panel. The original panel is certainly usable. But put them side by side and the old panel really looks like crap, especially with yellows, purples and other far-from-the-primary colors. On the other hand, I have an old 144Hz TN gaming monitor, old enough that 144Hz was high refresh rate, and it looks okay next to my nice 30-bit QD-LCD monitor, as long as I use it for office drone work and not anything that needs to really look good.
(Score: 4, Informative) by JoeMerchant on Sunday June 28, @11:13AM (1 child)
When you don't include a favicon file, your website triggers file-not-found errors as it is loading. It still loads, as you say it displays with a default for the icon, but most browsers ALWAYS look for the favicon file.
🌻🌻🌻🌻✌️ [google.com]
(Score: 1, Interesting) by Anonymous Coward on Monday June 29, @01:30AM
You can use <link rel='icon' href='...'> to specify the URI for the icon in anything reasonably modern, and the extra request can be prevented by using a data URI (any garbage data will do if your website does not have an icon).
(Score: 3, Interesting) by VLM on Monday June 29, @07:44PM
I read the fine article. 239 bytes. OK then.
One up that. A DS1302 real time clock chip for a microcontroller is a 64 byte sram (byte, not kilobyte, not gigabyte... byte) and it uses one byte for the clock info (long story) leaving you with 63 bytes of data.
I have personally stored network configs in a '1302. I'm not overly proud of it but its as re-writable as sram and is battery backed up and its intuitive that you can wipe the stored wifi config by removing the battery for awhile. I don't think I'm doxing myself LOL as I'm sure I'm not the first dude to try this.
Another thing I've tried that worked at a component level but was a failure at a systems level was storing network configs in a I2C accessible NFC tag. Supposedly, the smallest NFC tag in the spec is 48 bytes which would be even more challenging. My project used ST NFC tag chips and they were "like a K or so" it's been awhile I don't remember. NFC was like the IoT technology that would have been perfect but it died. You can also store stuff "outgoing" not just incoming config on a NFC tag. You can store a URL for the device including an auth tag you just wave the phone within 1 cm of the device surface and you can log in, pretty cool. Or read plain text error reports up to a couple K in length on devices without any display or output devices other than the NFC tag, pretty cool.
So yeah 239 bytes is cool, but try again with 63 byte RTC chips or 48 byte NFC tags.