Welcome!

Cloud Security Authors: Liz McMillan, Elizabeth White, Gregor Petri, SmartBear Blog, Tom Kelly

Related Topics: Cloud Security

Cloud Security: Blog Feed Post

Stripping EXIF from Images as a Security Measure

And you thought FourSquare was a security risk…

Mobile phones with great cameras are an awesome tool. Many of these end up on Facebook, visible to friends, family and, well, friends of friends and maybe even the public. They get shared around so much, you can’t really be sure where they might eventually wind up.

According to Justin Mitchell, an engineer for Facebook Photos, answering a Quora question on the subject last year, Facebook has “over 200 million photos uploaded per day, or around 6 billion per month.  There are currently almost 90 billion photos total on Facebook.  This means we are, by far, the largest photos site on the Internet.”

 

exif-house

As most of these are uploaded via modern cameras – whether on mobile phones or digital cameras – which are almost universally enabled with GPS technology, they almost all certainly include some data that you might not want others to find: the exact location the picture was taken.

Pshaw! Many may think. After all, “checking in” via FourSquare and adding location to Facebook and Twitter posts is something many do regularly. But this data can be very dangerous, and not just for soliders who have been warned against geotagging photos uploaded to facebook, as cited by a recent Gizmodo article, “US Soldiers Are Giving Away Their Positions with Geotagged Photos”:

The Army has issued a warning to its soldiers to stop geotagging their photos on Facebook and other social media outlets. Because it's putting soldiers in danger, and has been for years.

Now you might not be worried about giving away the location of helicopters inside a compound that leads to the enemy able to “conduct a mortar attack, destroying four of the AH-64 Apaches” there, but the risks to everyone exists. Those who share photos of their home or things in their home (can’t resist showing off your latest collectible addition to friends, can you?) are opening themselves up to theft, especially if they also like to broadcast their latest travel schedules via a host of other socially connected tools. Even if you aren’t actively sharing your address, all a potential thief needs to do is grab a photo of your fat loot and extract the GPS coordinates hidden in the EXIF data to find his target and then move in, right after you made sure everyone know you were out of town by broadcasting your latest flight information (ATL –> ORD –> SEA).

“But I’ve locked down my photos using Facebook’s privacy features!” you say. You might have done so, but do you really know everyone on your list of “friends”? Are they really who they claim to be? And did any of them share your photo with their friends, and their friends? Facebook privacy doesn’t prevent the old standby of “save as” and “upload”, and a quick tag of your name and a Twitter search and bam! You’ve shared data with people you wouldn’t have, if only you had known.

mediated exif strippingWhile perhaps requiring a bit more paranoia than the average user (and an inherent distrust in humanity), there are very real security implications for a wide variety of folks to embedding Geotags in photos via EXIF, though perhaps those in service to their country more than others.

There is a simple and more automated mitigation for this risk. In addition to turning off Geolocation tags on your camera or phone or manually eradicating the EXIF info from photos, a mediating application delivery service can, on-demand, strip this data from images.

MEDIATED EXIF STRIPPING

With the right application delivery tier implementation, mediated EXIF stripping is as simple as other content scrubbing exercises. Requests are received as normal for an image object. When the image is retrieved from the origin server, a service in the application delivery tier is invoked that strips EXIF data from the image before it is returned to the end-user or deposited in a caching solution. Subsequent requests for that same image, then, though served out of cache are also clear of potentially dangerous GPS information – without modifying the original.*

That’s important, as for some folks having that information available to them may be necessary or desirable, but serving it up to the public may simply incur too much risk.


Given the velocity with which we click and share photos today, we may be underestimating the associated risk. Others may think that’s just far too paranoid and desire to keep EXIF data in their images. This is another opportunity to monetize a service for providers. The right application delivery tier, capable of interpreting context as well as being instructed by external infrastructure (including applications), could be configured such that only image-containing responses with specific HTTP headers are subject to EXIF stripping. The more security-minded users may desire such a service – and be willing to pay for it – while others could simply continue on as they were, EXIF and all.

And even if you aren’t concerned with potential security risks associated with EXIF, you might want to consider that stripping out that extraneous data from images like thumbnails and product shots can reduce the overall size of the image, which is a boon if you’re trying to improve overall performance – particularly on network and resource constrained devices like mobile phones.

* Image optimization techniques are always best-effort and sometimes cannot be applied to an image given other factors. Also, if a positive caching models is used, the original image is served the first time it is requested, but not cached.

More Stories By Lori MacVittie

Lori MacVittie is responsible for education and evangelism of application services available across F5’s entire product suite. Her role includes authorship of technical materials and participation in a number of community-based forums and industry standards organizations, among other efforts. MacVittie has extensive programming experience as an application architect, as well as network and systems development and administration expertise. Prior to joining F5, MacVittie was an award-winning Senior Technology Editor at Network Computing Magazine, where she conducted product research and evaluation focused on integration with application and network architectures, and authored articles on a variety of topics aimed at IT professionals. Her most recent area of focus included SOA-related products and architectures. She holds a B.S. in Information and Computing Science from the University of Wisconsin at Green Bay, and an M.S. in Computer Science from Nova Southeastern University.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 ad...
As enterprises work to take advantage of Big Data technologies, they frequently become distracted by product-level decisions. In most new Big Data builds this approach is completely counter-productive: it presupposes tools that may not be a fit for development teams, forces IT to take on the burden of evaluating and maintaining unfamiliar technology, and represents a major up-front expense. In his session at @BigDataExpo at @ThingsExpo, Andrew Warfield, CTO and Co-Founder of Coho Data, will dis...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
The cloud promises new levels of agility and cost-savings for Big Data, data warehousing and analytics. But it’s challenging to understand all the options – from IaaS and PaaS to newer services like HaaS (Hadoop as a Service) and BDaaS (Big Data as a Service). In her session at @BigDataExpo at @ThingsExpo, Hannah Smalltree, a director at Cazena, will provide an educational overview of emerging “as-a-service” options for Big Data in the cloud. This is critical background for IT and data profes...
SYS-CON Events announced today that VAI, a leading ERP software provider, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. VAI (Vormittag Associates, Inc.) is a leading independent mid-market ERP software developer renowned for its flexible solutions and ability to automate critical business functions for the distribution, manufacturing, specialty retail and service sectors. An IBM Premier Business Part...
SYS-CON Events announced today that Alert Logic, Inc., the leading provider of Security-as-a-Service solutions for the cloud, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Alert Logic, Inc., provides Security-as-a-Service for on-premises, cloud, and hybrid infrastructures, delivering deep security insight and continuous protection for customers at a lower cost than traditional security solutions. Ful...
Fortunately, meaningful and tangible business cases for IoT are plentiful in a broad array of industries and vertical markets. These range from simple warranty cost reduction for capital intensive assets, to minimizing downtime for vital business tools, to creating feedback loops improving product design, to improving and enhancing enterprise customer experiences. All of these business cases, which will be briefly explored in this session, hinge on cost effectively extracting relevant data from ...
With the Apple Watch making its way onto wrists all over the world, it’s only a matter of time before it becomes a staple in the workplace. In fact, Forrester reported that 68 percent of technology and business decision-makers characterize wearables as a top priority for 2015. Recognizing their business value early on, FinancialForce.com was the first to bring ERP to wearables, helping streamline communication across front and back office functions. In his session at @ThingsExpo, Kevin Roberts...
With an estimated 50 billion devices connected to the Internet by 2020, several industries will begin to expand their capabilities for retaining end point data at the edge to better utilize the range of data types and sheer volume of M2M data generated by the Internet of Things. In his session at @ThingsExpo, Don DeLoach, CEO and President of Infobright, will discuss the infrastructures businesses will need to implement to handle this explosion of data by providing specific use cases for filte...
SYS-CON Events announced today that Fusion, a leading provider of cloud services, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Fusion, a leading provider of integrated cloud solutions to small, medium and large businesses, is the industry's single source for the cloud. Fusion's advanced, proprietary cloud service platform enables the integration of leading edge solutions in the cloud, including clou...
Most people haven’t heard the word, “gamification,” even though they probably, and perhaps unwittingly, participate in it every day. Gamification is “the process of adding games or game-like elements to something (as a task) so as to encourage participation.” Further, gamification is about bringing game mechanics – rules, constructs, processes, and methods – into the real world in an effort to engage people. In his session at @ThingsExpo, Robert Endo, owner and engagement manager of Intrepid D...
Eighty percent of a data scientist’s time is spent gathering and cleaning up data, and 80% of all data is unstructured and almost never analyzed. Cognitive computing, in combination with Big Data, is changing the equation by creating data reservoirs and using natural language processing to enable analysis of unstructured data sources. This is impacting every aspect of the analytics profession from how data is mined (and by whom) to how it is delivered. This is not some futuristic vision: it's ha...
WebRTC has had a real tough three or four years, and so have those working with it. Only a few short years ago, the development world were excited about WebRTC and proclaiming how awesome it was. You might have played with the technology a couple of years ago, only to find the extra infrastructure requirements were painful to implement and poorly documented. This probably left a bitter taste in your mouth, especially when things went wrong.
Learn how IoT, cloud, social networks and last but not least, humans, can be integrated into a seamless integration of cooperative organisms both cybernetic and biological. This has been enabled by recent advances in IoT device capabilities, messaging frameworks, presence and collaboration services, where devices can share information and make independent and human assisted decisions based upon social status from other entities. In his session at @ThingsExpo, Michael Heydt, founder of Seamless...
The IoT's basic concept of collecting data from as many sources possible to drive better decision making, create process innovation and realize additional revenue has been in use at large enterprises with deep pockets for decades. So what has changed? In his session at @ThingsExpo, Prasanna Sivaramakrishnan, Solutions Architect at Red Hat, discussed the impact commodity hardware, ubiquitous connectivity, and innovations in open source software are having on the connected universe of people, thi...
WebRTC: together these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at WebRTC Summit, Cary Bran, VP of Innovation and New Ventures at Plantronics and PLT Labs, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it may enable, complement or entirely transform.
There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, showed how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants received the download information, scripts, and complete end-t...
For manufacturers, the Internet of Things (IoT) represents a jumping-off point for innovation, jobs, and revenue creation. But to adequately seize the opportunity, manufacturers must design devices that are interconnected, can continually sense their environment and process huge amounts of data. As a first step, manufacturers must embrace a new product development ecosystem in order to support these products.
Manufacturing connected IoT versions of traditional products requires more than multiple deep technology skills. It also requires a shift in mindset, to realize that connected, sensor-enabled “things” act more like services than what we usually think of as products. In his session at @ThingsExpo, David Friedman, CEO and co-founder of Ayla Networks, discussed how when sensors start generating detailed real-world data about products and how they’re being used, smart manufacturers can use the dat...
When it comes to IoT in the enterprise, namely the commercial building and hospitality markets, a benefit not getting the attention it deserves is energy efficiency, and IoT’s direct impact on a cleaner, greener environment when installed in smart buildings. Until now clean technology was offered piecemeal and led with point solutions that require significant systems integration to orchestrate and deploy. There didn't exist a 'top down' approach that can manage and monitor the way a Smart Buildi...