Tiny Twitter Thumbnail Tweaked To Transport Different File Types

Security researcher David Buchanan has found that Twitter image uploads can be polyglot files, meaning they can be valid simultaneously in multiple formats, such as a.jpg, a.rar archive and a.zip archive. From a report: Using some Python code he wrote, he created a thumbnail image of William Shakespeare overlaid with the words, 'Unzip Me' and posted it to Twitter. The.jpg image is also a valid.zip file, so if you download it, you can unzip it and extract the contents, a multipart.rar archive of the text of Shakespeare's plays. Twitter performs some processing on uploaded images, which has the potential to mess with the data. But Buchanan found that his multi-format file survived this process. It may be that image itself (excluding the rather bulky metadata) is light enough not to trigger any compression or post-upload processing.

Read more of this story at Slashdot.