there are ways to “depixelate” it, so you better cross it out altogether

  • 63

It is normal that before sending a document you need to hide certain parts, such as text fragments. A common practice was to pixelate (or ‘pixelize’) those parts or blur them, but it has now become clear that this method is of no use, as there are tools that allow you to depixelate the text and reveal what was hidden.

The systems to try to discover what was behind “crossed out” texts became more striking when working with digital documents: pixelating them, blurring them or “crystallizing” them (as in the image of our logo) are common techniques. The problem? that don’t work: it is possible to invert them and be able to see what one had crossed out.

Blurring and pixelating text is useless

In 2017, the French television channel France 2 broadcast a documentary about bitcoin. In it they interviewed a user named @rogerkver who offered a $1,000 bitcoin reward for viewers, but the QR code that gave access to the wallet’s private key was out of focus because the chain was not authorized to give economic prizes during the transmission.

Screenshot 2022 02 16 At 11 22 23

That’s where two developers they got to work. The objective, to achieve “refocus” that QR code to obtain the reward. How to achieve it? The key was that the chain did end up showing a small part of the QR code focused on the end of the documentary. They succeeded after rebuilding the code and a 16 hour reverse engineering process that allowed them to access the QR code and that money.

Spies, billionaires and paid VPNs: the disturbing story of Kape Technologies and an ecosystem with a very dark side

To “depixel” images, the process is similar to the one used when looking for passwords by brute force: the same encryption algorithm as the original password is applied to a list of words, and they are compared with the target. With pixelized images what is done is try to compare them with words that are pixelated to see if they look like the original image.

how do you explain in Positive Securitythe techniques take advantage of the so-called “avalanche effect” which means that when a detail in the source image changes, it only affects a small part of the resulting image, so it is possible to apply the “divide and conquer” and deal with the problem by dividing it into several that are easier to solve.

The process is not so striking if we take into account that there are many applications that allow focus algorithms to be applied. Photoshop is the best known thanks to its filtersbut artificial intelligence has allowed things to go further with examples such as the one proposed by PULSE.

The truth is that there are various tools that already allow something like this both in still images and even in videos in which information is blurred or pixelated, but the experts at Positive Security went a little further and verified that there is a curious effect when information is pixelated or out of focus in the videos.

Screenshot 2022 02 16 At 11 39 06

That image doesn’t seem to reveal anything on the license plate, but the video it’s part of causes those pixels to shift slightly, and that’s enough to “depixelate” that bit of hidden information.

In those videos the way the pixels change that hide the information can end up being an important clue to reverse the process. The tests carried out by these experts revealed that the method worked quite accurately and allowed, for example, to find out the license plate numbers of cars that appeared pixelated in the video.

Other developments show that indeed pixelate text to hide it in documents and images is not a good idea. Those responsible for BishopFox — an offensive security consultancy — explained How is it possible to reverse the process?

Screenshot 2022 02 16 At 11 41 01

They actually created a little tool called Unredacter whose code is available on GitHub and that allows to execute this type of process. There are other alternatives like Depix —although it seems that it may not work so well— and his extensive analysis showed the challenges in reversing those pixelation/pixelization processes.

The conclusion for both was the same: if you need to hide text, the best thing to do is cross it out directly with black bars. “Artistic” methods are not effective.

It is normal that before sending a document you need to hide certain parts, such as text fragments. A common…

It is normal that before sending a document you need to hide certain parts, such as text fragments. A common…

Leave a Reply

Your email address will not be published.