142

As a guy working in security/pentest, I regularly take screenshots of exposed passwords/sensitive information. Whenever I report these, I mask parts or complete info as in the sample given below

test_image

I often wonder, is it possible for someone to 'reverse engineer' these pics and recover the original information? If so, what should be the correct way of masking such kind of info?

I am using shutter for taking screenshots and using accompanied edit tool to add the black stroke.

EDIT:

As pointed out by some of you, my question is different from this since:

  • I am not asking about MS paint/black strokes. The image is just an example to better explain the question
  • I have clearly asked for the correct/most secure way of producing photographic evidence.
Improve this question
2
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Commented Apr 25, 2018 at 21:58
  • 1
    I have reverted to the version prior, as the answers have been posted based on the use of shutter, and removing that will invalidate them to a large degree.
    – Rory Alsop ♦
    Commented Apr 25, 2018 at 21:58

8 Answers 8

Reset to default
191

Yes, it can be recovered.

As long as shutter does not use layer (it almost certainly does not) and as long as the black is really all black (it must not be transparent), it is enough.

The picture that you provided uses some amount of transparency, see here:

enter image description here

All I had to do is use the Fill tool in MS Paint. If I used some algorithm that would take the jpg compression into account, I could probably get better results.

Solution:

Use an editor that does not make the block transparent. Make sure layers are not used. Make sure change history is not stored (to allow undo) in the file. I believe MS paint + bitmap format satisfy all the requirements. Most editors combined with bitmap (BMP) format without compression should satisfy these requirements, but I can not confirm this.

Remove the data. You can do so in many editors by selecting it and pressing delete or Ctrl + X. Then apply redaction graphics, whether black box, or anything else.

DO NOT use JPEG (jpg) or other lossy formats anywhere from capture until redaction. JPEG may leave artifacts that may convey information about the deleted pixels. This may also apply to other lossy formats, use lossless formats if possible. Using any format after the image is redacted is fine.

As lossless formats may also retain some information, if they are not completely re-encoded after the edit, it is recommended to either only use pure bitmap format with no compression before redacting, or to change the format after redacting.

Double check:

You can double check no compression is used in BMP format by checking the file size. The size should be larger than color_depth / 8 * width * height (resolution in pixels, color depth usually 24). Note that this check will not reveal transparency and artifacts caused by lossy compression, so make extra sure you did not use lossy format at any point.

It may also be useful to post a specific question about your proposed setup here, so you can see additional opinions and recommendations. It is hard to give definitive answer, that would work in general for all platforms, formats and editors as they all have their specific caveats.

Improve this answer
19
  • 22
    It doesn't have to be black. It can be any color as long as it's fully opaque.
    – Pikamander2
    Commented Apr 23, 2018 at 3:20
  • 3
    your first paragraph makes it sound like it can be recovered only if it's not transparent
    – Aequitas
    Commented Apr 24, 2018 at 2:57
  • 3
    @user13267 PNG is lossless compression and therefore, by definition, has no artifacts, because an artifact is the result of a lossy compression algorithm throwing away some data and degrading the image quality for a smaller image file. JPG, on the other hand, does have artifacts, which can be used to determine redacted pixels because the original artifacts are still there and depended on the pixels you blocked out, so you could theoretically extract some information.
    – anon
    Commented Apr 24, 2018 at 5:06
  • 2
    @PeterHarmann It seems like the safest thing is to 1) redact, 2) convert the image from one format to another, and 3) then to delete the original in a secure way, such as with the shred command on Linux.
    – jpaugh
    Commented Apr 24, 2018 at 21:15
  • 2
    @jpaugh I'd add one small thing to that: Use lossless formats. While they can have artifacts (See Ray's comments above) the artifacts are less likely to persist when converted into another file format.
    – anon
    Commented Apr 24, 2018 at 22:45
79

You don't even need to use an image editor in this case to recover the "redacted" text. Simply zooming in on the image is enough to read it.Visible redacted text

So I would say that yes, it most certainly is possible to recover the original text.

Improve this answer
8
  • 3
    This would be easier to see if it was more closely cropped.
    – Michael Hampton
    Commented Apr 20, 2018 at 5:45
  • 69
    Simply leaning close to the monitor works here
    – Chris H
    Commented Apr 20, 2018 at 8:15
  • 2
    I can see it when it's on the bottom half of my monitor but not the top half.
    – Captain Man
    Commented Apr 20, 2018 at 15:01
  • 9
    This doesn't answer the question: "what should be the correct way of masking such kind of info?"
    – Ghoti and Chips
    Commented Apr 20, 2018 at 15:35
  • 2
    @IsmaelMiguel I replicated CaptainMan's observation; in my case it's to do with viewing angle. If it's on the top half and I stand up, I can make it out again.
    – Stack Exchange Supports Israel
    Commented Apr 21, 2018 at 1:48
70

In this case the image can be recovered very well

As others already pointed out the dark patch is not completely black. It has a transparent effect and only darkens the original image. The original image can be recovered almost completely: recovered screenshot

In this case the recovery was pretty straightforward. I needed to check the range of grey levels of the patch and re-adjust the range to the original values. I used Gimp for that. The unmodified text uses only 7 visibly distinctive levels of grey. The darkened part has retained about 6 levels (when ignoring the anti-aliased border and JPEG artifacts) so we can get almost exactly the original image. adjusting levels in Gimp

The level and curve adjustment in Gimp and similar image editors can be used to check almost invisible information in the image.

To summarize the recommendations:

  • Use an image editor which covers the area completely (non-transparently).
  • If compression artifacts (JPEG, dithered GIF etc.) surrounding the area could reveal some information, hide them too.
Improve this answer
2
  • impressive! Can you unblur as well? blur radius 12, data starts with DEADBEEF: i.sstatic.net/Q6Ry9.png
    – NH.
    Commented Apr 24, 2018 at 20:02
  • @NH. Unblurring is incomparably more difficult. Here is one example of what can be done: mathworks.com/help/images/examples/… ... In your example I think the blur radius is too large compared to the image details. Also the information outside of the blur box which was cut off will be missing for reasonable restoration. --- Here are other examples of how you can make some information in an image more visible: ampedsoftware.com/five-samples
    – pabouk - Ukraine stay strong
    Commented Apr 25, 2018 at 6:01
29

Yes, the text can be unmasked, either by simply zooming in or using any of the techniques - but not restricted to - pointed by pabouk and Peter answers.

I have clearly asked for the correct/most secure way of producing photographic evidence.

Completely remove any sensitive data from print-screens.

Steps

  1. Press the PRT SCR button on your keyboard (lossless capture, no artifacts);

  2. Open gimp/photoshop/paint and select new file, the default image size should be the same as your print-screen, hit CTRL+V to paste the ps into the newly created file and export it immediately as your original;

  3. Select the sensitive data using the appropriate tool on your software and hit CTRL+X to cut it;

  4. Cover the hole with a black rectangle, as you normally do (purely visual, nothing under);

  5. Export your dummy_copy as a new file (jpeg, gif, png);

  6. Keep the original untouched and share the dummy_copy.

Note

Even if any of the safe masking techniques presented on this page work at the moment, you've absolutely no guarantee that your "secret" data will remain like that tomorrow. The only way to be 100% sure is to cut/remove/destroy/erase/nuke the sensitive data from the original file and export it as new file.

Bottom Line:

enter image description here

Improve this answer
13
  • 3
    There are still considerations to be made about JPEG artifacts leaking some amount of information if the area redacted is not large enough.
    – Peter Harmann
    Commented Apr 20, 2018 at 9:05
  • 17
    @PeterHarmann: If done exactly as described here, straight from Print Screen to image editor, there is no JPEG compression step in between. The image editor gets a pixel-perfect image to work on.
    – MSalters
    Commented Apr 20, 2018 at 12:43
  • 10
    put a black patch on top of it; it doesn't matter which color it is, hell it could even be white. Or yellow. Or pink. As long as it's (100%) opaque. @spunkpike used a (slightly) transparent patch.
    – RobIII
    Commented Apr 20, 2018 at 15:11
  • 7
    @PedroLobito None of the "cut/remove/destroy/erase/nuke" provide clear instructions on how. If someone paints a (slightly transparent) patch over a word that could be considered "removed" or "erased" or, from their perspective, even "nuked". So you need to be clear that the "drawing over"-method only works with opaque patches; telling people to "nuke" it has no actual meaning (unless you happen to have a nuke lying around, in which case we got bigger problems).
    – RobIII
    Commented Apr 21, 2018 at 1:12
  • 6
    "None of the "cut/remove/destroy/erase/nuke" provide clear instructions on _how_" This is addressed on STEP 3 via CTRL+X, so, when you say, "Transparent patches don't overwrite_ but they change/add/subtract the original pixels.", it means either that you don't know or remember what CTRL+X actually do, which is cutting, aka removing, destroying, erasing. Nuke was a figure of speech for "just get rid of it".
    – Pedro Lobito
    Commented Apr 21, 2018 at 1:57
11

Examples

As shown above, your example was breakable,the blacks of the redaction had variation showing the text.

Real life example

New York Times Suffers Redaction Failure, Exposes Name Of NSA Agent And Targeted Network In Uploaded PDF

This was an example of a PDF that appeared redacted, but the data could be recovered.

Ways data can leak

  • Document titles
    • Quite a simple one, but can be dangerous
  • Colour variations like the one you had
  • Blurring
    • If the data is not varied enough it can be attacked source
  • Unedited thumbnail
    • You may redact the details in the image itself, but not in the thumbnail -Metadata
    • A surprising amount of data can be stored in some image format's metadata

Defences against the above attacks

  • Titles
    • Check the filename doesn't contain anything sensitive
  • Colour variations
    • Make sure the blocked out area is all one consistent character, so that it can't be read
  • Blurring
    • Always block out, rather than blurring
  • Thumbnail and metadata
    • Re-export the image in a format that has less metadata, or use a tool to strip the metadata. Make sure the thumbnail is remade.
Improve this answer
6
  • 2
    None of this answers the question of OP, which was "the correct/most secure way of producing photographic evidence."
    – Tom K.
    Commented Apr 23, 2018 at 7:46
  • "Thumbnail and metadata" - Stored "thumbnails" in the EXIF metadata can be surprisingly large and some editors neglect to regenerate these when resaving the image. (Particularly relevent if editing a previously saved JPG screenshot, although I believe it could also apply to later versions of the PNG standard also.)
    – MrWhite
    Commented Apr 23, 2018 at 21:04
  • "Always block out, rather than blurring" Always cut .
    – Pedro Lobito
    Commented Apr 24, 2018 at 12:29
  • 1
    A point on thumbnails - often times thumbnails aren't modified when the image is cropped - back in the days of yore, an actress from a popular technology news channel accidentally leaked a nude photo of herself when she cropped it to use as a headshot. The thumbnail retained all of the original information, despite the crop that was performed.
    – Monica Apologists Get Out
    Commented Apr 24, 2018 at 16:08
  • Why even remake the thumbnail as opposed to not storing one in the EXIF data in the first place? If you're worried about accidentally leaking data, stripping EXIF data 100% of the time seems like a no brainer. As an aside, I took a quick glance at a few different images I had sitting around on my computer and not a single one had thumbnail EXIF data. Makes me think that's more the norm and certainly doesn't give me a good reason to ever keep any EXIF data.
    – Kat
    Commented Apr 24, 2018 at 19:07
8

I think you may be misusing what's meant to be a highlight tool (I'm not at any of my Ubuntu machines ATM and don't have shutter installed anyway to test). I can't quite believe that a tool meant for redacting would have such an obvious flaw as working with transparency takes more effort than not).

In the GIMP you can select an area and fill that area with solid colour (the "fill whole selection" option). Then save in a format that doesn't support layers (perhaps flattening manually first).

Here's a sample image: enter image description here

and here's an indication of the tools in the GIMP (red freehand shows rectangle select, bucket fill, and fill whole selection):

enter image description here

You can equally do this in MS paint but the GIMP is FOSS and cross-platform. Note that you should export rather than saving in GIMP's own .xcf file format, as that supports a few features that could reveal this (like layers, which actually aren't created in this approach) and is also not widely supported.

Note that I didn't save the image at any point in any format until after masking the password. This doesn't mean it's not saved locally in an undo buffer but I assume your machine is sufficiently secure for the purpose, at least as far as this question goes.

Improve this answer
4
  • 1
    This still leaks the length of the password, and if you cut it so close with the black box you might inadvertently reveal that there was no g or q in the string (which go way below the normal line).
    – Polygnome
    Commented Apr 24, 2018 at 7:21
  • @Polygnome, it leaks the maximum length, that's true. My example used an absurdly short password so a longer box would be better in reality. Also my example had no characters with descenders so I can't be absolutely sure, but my intention was to go low enough. Of course the "password" here bears no resemblance to any of my real passwords, in fact it's chosen as a challenge
    – Chris H
    Commented Apr 24, 2018 at 7:29
  • 1
    If you cover the whole input field, it yields the maximum length. But you did not. You only covered a very small portion of the input field, which puts much more constraints on the length of your actual password. Most people don't realize just how much info they give away.
    – Polygnome
    Commented Apr 24, 2018 at 7:36
  • 1
    @Polygnome It reveals an upper limit on the length of my password, i.e. the maximum length of my password (about 10 chars if they're not too narrow. I used 8 -- unrealistically short). Masking the entire input field is undoubtedly better as it reveals nothing (not even the maximum permissible length as the box can scroll sideways. I was basically sticking to the OP's sample but blacking it out properly. I've recreated it and it does mask descenders
    – Chris H
    Commented Apr 24, 2018 at 8:11
8

Don't provide screnshots. Provide descriptions OR sample screenshots taken at times when sensitive data is not on the screen, with description that "X appeared here".

"It's no evidence!" you may say. BUT - a screenshot that had been redacted is also not an evidence. It's just a product of your artistic skills. Your testimony of the situation usually carries more weight.

Many answers here focus on making sure that the masking rectangle is actually uniform. But that's not all. The masked text can be recovered with statistical analysis of the size of the masked area. Especially when there is unmasked text before and after, its layout says quite a lot about what was redacted. Proportional fonts are particularly prone to this technique, as characters have more or less unique width. Monospace fonts disclose less information, but the length is known with 100% accuracy.

Improve this answer
3
  • 1
    All other answers completely miss this, which is a very important point. length of the text is not the only thing, line height is as well (make sure all black boxes are wide enough to cover low chars like g or q to not disclose whether or no the masked text actually contained them).
    – Polygnome
    Commented Apr 24, 2018 at 7:24
  • As an IT person, I find that the primary purpose of screenshots is not to convey evidence, but exactly to replace words for communication. A written description of the screen would be tantamount to a (very lossy) image compression format.
    – jpaugh
    Commented Apr 24, 2018 at 21:29
  • @jpaugh That's why I wrote "OR sample screenshots taken at times when sensitive data is not on the screen"
    – Agent_L
    Commented Apr 26, 2018 at 8:37
0

Most consumer and professional products just put a layer over the top. Most application recover the image under the redaction is a good thing.

Wipe out the image under is often referred to as burning the redaction.

If the image had been OCRs and you are producing text then need to OCR again after burning.

You come across this in litigation where on parties produce. Also search on dDiscovery.
Guidance on Redacting Personal Data Identifiers in Electronically Filed Documents.

As far a shutter not sure but unless it specifically give you an option to burn it is probably just a layer.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .