Turkish Airlines_330

Can you tell if a picture is fake?

Click to see full image.

Click to see full image.

Internet is already full of digital images and more is added every day. Digital pictures have become a cheap way for journalists to tell a story and ordinary people upload tons of them to social media. It’s quicker and easier to snap a shot and upload than to describe where you are and what the place looks like.

Photographs have always been seen as some kind of proof. Like a captured piece of reality. We are however aware of the fact that photographs can be manipulated. Digital image processing has revolutionized this area and brought amazing new techniques to us. But image manipulation has actually been a known technique since photography was invented. It is amazing to see what a skilled person can do to traditional images in the darkroom. Not to mention the fact that you can lie a lot just by taking the picture in a certain way.

This article is about our relationship to the digital images on the net. There’s a lot of manipulated pictures out there, but are you able to recognize a fake? And are you even alert and aware that the picture may not be the full truth? We are all confronted with many pictures a day that aren’t completely real. Objects may be added or removed, or heavy retouching has been used to make models look better. Here’s some concrete hints about how to tell the fakes from the real ones.

  • In what context is the picture presented? Image manipulation is the norm in some contexts, like product and fashion photography, and some kinds of artistic photo. News agencies and nature photographers on the other hand have strict ethical rules against manipulation. First think about if manipulation is to be expected and if it should be accepted. Does it matter if the photo isn’t real?
  • Is the image realistic overall? Some manipulated images are so surrealistic that you can dismiss them as unreal at once, even if they are very well done technically. Ask yourself; can this be real? See the illustration to this article for an example.
  • Do you have access to several shots from the same scene? Are there discrepancies between them?
  • Are light and shadows similar between objects in the picture? Pay attention to which side is lighter, how hard the light seem to be and how the objects cast shadows. Needless to say, objects close to each other get the same light in real life. If they are illuminated differently, they may originate from different photos. Also pay attention to the environment. From what direction is the light supposed to come?
  • Is the perspective right? Getting this right is always a challenge when combining objects from different pictures. Just look at the shot and trust your gut feeling. Pictures with minor perspective errors do often feel wrong even if you can’t tell what the problem is.
  • Does the objects’ edges look right? A lot of work may go into the edges when putting something in front of a new background. They often give away the fake if they are done sloppily or with lacking skills. Pay special attention to people’s hair as that is hard to mask.
  • Image manipulation often requires filling areas to replace removed objects. Patterns that repeat in an unnatural way is a sure sign of sloppy cloning. Cloning can also be used to multiply an object, but several identical object do rarely look exactly identical in a real photo due to differences in perspective and lighting. It’s fishy if they look identical in a picture.
  • Is the color consistent? Do different parts of a human’s body have the same skin color? An object’s apparent color depends very much of the illumination’s color temperature. Do the different objects have a consistent color cast?
  • All digital capture devices leave some kind of structure in the picture. Most notable is the noise produced by digital cameras. You can check that this structure is constant over the whole picture if you have access to a fairly hi-resolution image. It’s futile to try this on small images from on-line news sites.
  • Metadata is data hidden inside the image files. One important piece of data is the software used to save the file. A camera model name would indicate no manipulation at all. Workflow programs like Adobe Lightroom and Apple Aperture are typically used to do moderate adjustments of images, but no real manipulation. The image may be heavily manipulated if it is saved by Photoshop. But this does on the other hand prove nothing as you can do minor adjustments is Photoshop too. Also remember that this data may be lacking or even forged.
  • Even if a picture is totally genuine, it may be misleading if presented in the wrong context. Like someone using a picture of somebody else for a dating site profile. Here Google Image search comes in handy. Click on the camera to the right in the search field to open “Search by image”. Upload a copy of the image or paste in a link to it on the net. Google will search for images that look the same regardless of what context they are published in. This can often reveal that the image was found on the net rather than taken by someone who has posted it as his own.

That’s a quick list of things that help you spot the fakes. Using these hints require some training, but you will soon start seeing the manipulations if you keep them in mind when looking at images. But is it possible to make a perfect fake that is undetectable? Yes, especially if a skilled artist can work on a high resolution image and the result is scaled down to be published on the web. That down-sampling can hide the signs of manipulation effectively and make the fake practically undetectable for laymen. Scientific analysis methods are more capable, but they are not available to us mortals. And they may also fail to detect good fakes.

So the moral of the story is really that a photo shouldn’t be trusted too much unless its background is known and we know what ethical principles the photographer and publisher adhere to. News agencies typically pay attention to this and promise us authentic news pictures. These pictures are typically trustworthy, even if scandals do occur.

Safe surfing,Micke

PS. This funny video is one of my favorites on YouTube.

More posts from this topic

Hillary Clinton, email scandal, phishing scam

A phishing scam may hurt Hillary Clinton’s career — could it cost you yours?

This email was one of five phishing scams found in the 6,400 pages of Hillary Clinton's emails released on Wednesday. While there's no confirmation that former First Lady fell for the scam, her political opponents are using it to attack her for the security risks of the unconventional private server she used while in office -- even though a recent report found that 1 of 7 emails received on official U.S. Defense Department servers were either spam, phishing or other malware attacks. Receiving such attacks is inevitable. Cyber criminals have long known that one the best ways to hack into something is to simply ask you for the password. This technique has long relied on the fact that most of are used to entering our credentials so if a site looks trustworthy enough, we'll just type our credentials. From there, the bad guys can use these keys to unlock our digital life. As we've become more savvy in recognizing untrustworthy emails like the one above, criminals have taken advantage of our growing desire to share information about ourselves online to pioneer a more advanced technique called "spear phishing," which usually arrives in the form of a personalized email from an person or business you have a relationship with. This sort of attack was pioneered to hack high-value targets like Clinton. The Russian-backed Dukes group used this method in its 7-year campaign against western interests and others. In our Business Insider blog, Eija offers an inside look at how the CEO of a Finnish startup was the victim of an attempted spear phishing. "However, anyone can be a target..." Eija explains. And if you work in the U.S. government your chances of being hit with a very personalized attack have greatly increased as a result of the recent hack of the Office of Personnel Management. “Every bit of my personal information is in an attacker’s hands right now,"Paul Beckman, the Department of Homeland security’s chief information security officer, said at the Billington Cybersecurity Summit in September. "They could probably craft my email that even I would be susceptible to, because they know everything about me virtually.” Beckman said he regularly sends fake phishing emails to his staff to see if they fall for them, and “you’d be surprised at how often I catch these guys.”' Getting caught results in mandatory security training. But even after two or three rounds of instruction, the same people still fall for similar scams. “Someone who fails every single phishing campaign in the world should not be holding a [top secret clearance] with the federal government,” he said. “You have clearly demonstrated that you are not responsible enough to responsibly handle that information.” Beckman said he has proposed that those who prove they cannot detect a scam be stripped of their clearance, which could limit their career possibilities or even cost them a job. If you're the CEO of a startup, you recognize that security of your business is essential to your success. But if you're just an employee, your incentives for protecting intellectual property are nowhere as strong. Criminals only need one victim to make one mistake to succeed. So what are employers to do when education just isn't good enough? How about positive reinforcement for those who successfully avoid a scam? The truth is we're all only as secure as our training and focus. Organizations need to work on the best methods for developing both. Whether it's at work or at home or in the U.S. State Department, you're likely to be faced with a phishing attempt before long. Here's basic guidance from Eija on how to avoid being hooked: Be vigilant when entering your password anywhere Enable two-factor authentication Use Google’s built-in Security Checkup and Privacy Checkup tools Periodically review forwarding and mail filter settings, Connected apps & sites, Devices and Activities, shared files Disable POP and IMAP access if you don’t need them for a desktop or mobile client Cheers, Sandra

September 29, 2015
The Dukes

“The Dukes” – Ask the Experts

Last week, F-Secure Labs published a new study that provides a detailed analysis of a hacking group called “the Dukes”. The Dukes are what’s known as an advanced persistent threat (APT) – a type of hacking campaign in which a group of attackers is able to covertly infiltrate an organization’s IT network and steal data, often over a long period of time while remaining undetected. The report provides a comprehensive analysis of the Dukes’ history, and provides evidence that security researchers and analysts say proves the various attacks discussed in the report are attributable to the Duke group. Furthermore, the new information contained in the report strengthens previous claims that the group is operating with support from the Russian government. Mikko Hypponen has said that attacker attribution is important, but it’s also complex and notoriously difficult, so the findings of the report have considerable security implications. I contacted several people familiar with the report to get some additional insights into the Dukes, the research, and what this information means to policy makers responsible for issues pertaining to national cybersecurity. Artturi Lehtiö (AL) is the F-Secure Researcher who headed the investigation and authored the report. He has published previous research on attacks that are now understood to have been executed by the Dukes. Patrik Maldre (PM) is a Junior Research Fellow at the International Center for Defense and Security, and has previously written about the Dukes, and the significance of this threat for global security. Mika Aaltola (MA) is the Program Director for the Global Security research program at the Finnish Institute for International Affairs. He published an article of his own examining how groups like the Dukes fit into the geopolitical ambitions of nations that employ them.   Q: What is the one thing that people must absolutely know about the Dukes? PM: They are using their capabilities in pursuit of Russian strategic interests, including economic and political domination in Central and Eastern Europe, as well as the Caucasus region, and a return to higher status at the international level. AL: They are a long-standing key part of Russian espionage activity in the cyber domain. MA: The geopolitical intention behind the vast majority of targets. Q: We now know the Dukes are responsible for a number of high profile attacks, and seemingly target information about politics and defense. But what kind of information might they obtain with their attacks, and why would it be valuable? AL: They might obtain information like meeting notes, memos, plans, and internal reports, not to mention email conversations. In essence, the Dukes aim to be a fly on the wall behind the closed doors of cabinets, meeting rooms, and negotiating tables. PM: The targets of the Dukes include government ministries, militaries, political think tanks, and parliaments. The information that can be gained from these organizations includes, among other things, sensitive communication among high-level officials, details of future political postures, data about strategic arms procurement plans, compromising accounts of ongoing intelligence operations, positions regarding current diplomatic negotiations, future positioning of strategic military contingents, plans for future economic investments, and internal debates about policies such as sanctions. MA: The targets are high value assets. Two things are important: data concerning the plans and decisions taken by the targeted organizations. Second, who is who in the organizations, what are the key decision-making networks, what possible weaknesses can be used and exploited, and how the organization can be used to gain access to other organizations. Q: The Dukes are typically classified as an APT. What makes the Dukes different from other APTs? MA: APT is a good term to use with the Dukes. However, there are some specific characteristics. The multi-year campaigning with relatively simple tools sets Dukes apart from e.g. Stuxnet. Also, the Dukes are used in psychological warfare. The perpetrators can even benefit from they actions becoming public as long as some deniability remains. AL: The sophistication of the Dukes does not come as much from the sophistication of their own methods as it comes from their understanding of their targets’ methods, what their targets’ weaknesses are, and how those can be exploited. PM: They are among the most capable, aggressive, and determined actors that have been publicly identified to be serving Russian strategic interests. The Dukes provide a very wide array of different capabilities that can be chosen based on the targets, objectives, and constraints of a particular operation. They appear to be acting in a brazen manner that indicates complete confidence in their immunity from law enforcement or domestic oversight by democratic bodies. Q: There are 9 distinctive Duke toolsets. Why would a single group need 9 different malware toolsets instead of just 1? AL: The Dukes attempt to use their wide arsenal of tools to stay one-step ahead of the defenders by frequently switching the toolset used. MA: They are constantly developing the tools and using them for different targets. Its an evolutionary process meant to trick different “immunity” systems. Much like drug cocktails can trick the HIV virus. PM: The different Duke toolsets provide flexibility and can be used to complement each other. For example, if various members of the Dukes are used to compromise a particular target and the infection is discovered, the incident responders may be led to believe that quarantines and remediation have been successful even though another member of the Dukes is still able to extract valuable information. Q: Many people reading this aren’t involved in geopolitics. What do you think non-policy makers can take away from this whitepaper? AL: This research aims to provide a unique window into the world of the Dukes, allowing people not traditionally involved with governmental espionage or hacking to gauge for themselves how their lives may be affected by activity like the Dukes. PM: It is important for people to understand the threats that are associated with these technological developments. The understanding of cybersecurity should grow to the point where it is on par with the wider public’s understanding of other aspects of international security, such as military strategy or nuclear non-proliferation. This knowledge is relevant for the exercise of fundamental liberties that are enjoyed in democratic societies, including freedom of speech, freedom of the press, freedom of association, as well as of basic rights such as voting in elections. MA: The geopolitical intent is clearly present in this activity. However, the developments in this realm affects other types of cyber-attacks. Same methods spread. There is cross-fertilization, as in the case of Stuxnet that was soon adapted for other purposes by other groups.   F-Secure’s Business Security Insider blog recently posted a quick breakdown on how the Dukes typically execute their attacks, and what people can do to prevent becoming a victim of the Dukes or similar threats. Check it out for some additional information about the Dukes.

September 22, 2015

Did a funny test in Facebook? Time to clean the permissions.

You are precious. You are very valuable. At least to companies dealing in advertising and customer profiling. The value of you and your peers make giants like Google and Facebook tick, with a combined revenue of about $78 billion. I’m sure most of you understand this value. But how many are really making smart choices to guard it? If you’re on Facebook, you may have seen posts like this: “Your Friday night. Tina wants to sleep. Jan destroys furniture. Aaron wakes up handcuffed. Wilhelm starts a drinking competition.” Clicking the image takes you to nametests.com, or a localized version in your own language. Once there you can create your own test that reveals funny things about you and your friends. It’s obvious that these test are more entertaining than scientific. And this site can’t be blamed for lacking fantasy! Who thinks you’re sweet? How many children will you have? Who should you write a love song for? Who of your friends belong in your stuffed animal collection? Stuffed animal collection! OMG. LOL. :) You can find out all this and much more with the tests at nametests.com. The site is operated by a German company named Socialsweethearts, that claim to have over 1500 tests in more than 40 languages! OK, just another funny and harmless site that creates virally spreading posts and cashes in on advertising, you might think. But let’s take a closer look at what’s going on here. Many of the test involve your friends, revealing whom would be or do something. And to provide this they must know who your friends are, right? So it’s perfectly legit when a dialog pops up asking for access to your Facebook account and friends list. Wait! This is where you should stop and think. Let’s rephrase what’s going on. You purchase an automatically generated joke about you and your friends and pay by allowing them access to your friend list and Facebook wall, including all your past, current and future posts. A good deal? No, I don’t think so. And on top of that, you pay with knowledge about all your friends too, but without asking them for permission. Ok, Socialsweethearts is a German company, and Germany has strong privacy laws. I think there is a pretty good chance that this company isn’t misusing your data shamelessly, even if they definitively has the technical opportunity to do so. But this is pure luck. I bet that virtually none of the folks using these tests actually checked the background of the company and made an educated decision to trust it. Did you? But on the other hand. Pretty much all the giants that make billions on our private data are from the Americas. Europe has totally lost this race. A German company entering the same business successfully would be bright news, sort of. Bad news for your privacy but good news from European business perspective. So don’t worry too much if you have used the services on nametests.com. But this is anyway an excellent opportunity to clean up the list of apps that have access to your data. In Facebook, go to Settings and choose Apps in the menu to the left. Now you see a list of all apps and sites that have been granted access. Some of them are no doubt legit, for example apps that should be able to post to your wall. But the permissions will stay when you stop using something. And some permissions are only needed on a one-time basis, but they will stay on the list. Nametests.com belongs to that category and should be erased. Go through the list and remove anything you don’t need. If you see something that you don’t understand the meaning of, it’s safest to remove it too. Permissions can always be added back and apps that lose their permissions will notify you and ask you to grant new permissions. Happy cleaning, Micke   [caption id="attachment_8485" align="alignnone" width="300"] This is what it looks like when nametest.com want's permission to access your data in Facebook.[/caption]   Images: Screenshots from nametest.com and facebook.com  

September 21, 2015