HackThisSite - Forensic Mission 2

Posted on In Views: Disqus:

Challenge

Forensic 2 — Cheater

From: howard.davis@divorceattorneys.rus My client is being accused of cheating on his wife. A photograph has been presented in court that shows him with another woman in their bedroom, in their home. The woman in question is a known friend to them both. My client has stated that he did take the photo. However, he claims it was a selfie and no other person was present in the home or in the picture. As the forensic specialist for our law firm, are you able to detect any digital manipulation within this image?

Image link / Password: （提交字段名 forensic2，POST 回关卡页自身）

Solution

ELA 的基本假设是：JPEG 是有损压缩，整幅图被重新压一次时未编辑过的区域残余很小且分布均匀； 而被拼接、复制或二次压缩过的区域，其残余会明显偏离邻域。

完整的全局 ELA 脚本如下。它只计算整幅图的重压缩差异；区域统计和镜像/放大结果来自已保存的分析产物，未把缺失的脚本补写成确定步骤。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
#!/usr/bin/env python3
"""Compute a global JPEG Error Level Analysis (ELA) summary."""

import argparse
import io

import numpy as np
from PIL import Image


def ela_summary(path, quality=90):
    original = Image.open(path).convert("RGB")
    buffer = io.BytesIO()
    original.save(buffer, format="JPEG", quality=quality)
    recompressed = Image.open(buffer).convert("RGB")
    diff = np.abs(
        np.asarray(original).astype(int) - np.asarray(recompressed).astype(int)
    ).max(axis=2)
    values = diff.astype(np.float32)
    return values.mean(), np.percentile(values, 90), int(values.max())


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("image", nargs="?", default="selfie.jpg")
    parser.add_argument("--quality", type=int, default=90)
    args = parser.parse_args()
    mean, p90, maximum = ela_summary(args.image, args.quality)
    print("global  mean %.2f  p90 %.0f  max %d" % (mean, p90, maximum))


if __name__ == "__main__":
    main()
1
2
$ uv run python ela_summary.py selfie.jpg
global  mean 1.07  p90 3  max 24

Vulnerabilities

把两张照片拼在一起这种伪造只对人眼有效：JPEG 的压缩历史会把编辑痕迹留在像素的误差水平里， 同一张图里不同来源的区域永远无法伪装成一次拍摄。要真正伪造需要重编码整幅图并统一噪声指纹， 而有经验的取证者仍能用噪声一致性、压缩历史和多质量因子 ELA 把这些差异暴露出来。

ELA4LIFE!!