General security

Fake Image Detection

Introduction

This is a frying pan.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

This is a frying pan with a badly drawn pair of eggs in it.

Any questions?

The phrase “X has been Photoshopped” has become shorthand for “this piece of media has been edited in some manner.” Sometimes it's as simple as adding on a pair of fried eggs to an image, or other times its color correction, film grain additions, creating motions, adding in additional elements — the list really is just about limitless. 

This sort of image manipulation has been popular for many reasons for decades, and can be seen on social media on a daily basis. Since it has such a wide-ranging reach though, what can we do about detecting modified images? 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

File details and comparisons

Comparing details about a particular file can be very telling about what is an original image and what has been tweaked after the fact. The first things we can check are creation and modification dates. To do this in Windows, we can right-click on the file and select “Properties.”

In this case, because we saved it from an online source, it can be difficult sometimes to get accurate data due to the way that files are saved. Fortunately, we can still take a look at the image's EXIF (Exchangeable Image File) metadata to see what it can show us. To do this under Windows, all we have to do is click on the “Details” tab above. 

 

This now shows us that the picture itself was taken in 2010, and edited in Photoshop CS2. Metadata has an enormous amount of information about images such as resolution, camera hardware, shutter speed — information that can help professionals in determining if what they are seeing on the screen is what the data is showing. 

While Metadata can potentially be modified or removed with the proper tools, file size itself can also be very telling. 

Cast-Iron-Pan.jpg is our original, while fryingpan.png is our secondary. In this instance, we can tell just from the timestamp that one was modified after the other. However, we can also see that the second file is significantly larger than the original. This is because there is considerably more data in the file, and as a result, it's bigger. Granted, this is not entirely an apples-to-apples comparison because one is a .jpg image file and one is a .png image file, but the principle remains. 

A seriously underused tool when it comes to verifying images is the Google Image Search function, which can be accessed via https://images.google.com. This utility has been taught through machine learning to be able to recognize objects and not only identify what they are, but where they are online.

In order to use this, we can first click on the camera icon and select the image we want to search for from our local storage.

This brings up a list of pages that are using this exact same image, along with timestamps of those pages. The more reputable the source, the more likely it is to be using the original version of the image. 

Pixels where they shouldn't be and physical impossibilities

When images are modified, they can leave telltale pixels from the editing process — elements that either could not be cleaned up entirely or were overlooked. For example, if we zoom in on a particular section of our edited image, we can see something that isn't quite right.

Notice that the “egg” appears to overlap the rim of the pan. While this sometimes can happen, the egg itself appears to be an unbroken element — something that would be very difficult to do in 3D space but quite easy to do in a 2D image. 

Notice, also, the perfectly flat edges. An egg is a random element, yes, but multiple completely straight sides would be improbable. 

 

Note also that the white of these two eggs are identical, just that one has been rotated relative to the other. Again, this is an extremely improbable physical element but one that is performed easily in photo editing software.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Shadows and background elements

If you take a look at the pan itself, you will notice that it has highlights (brighter areas), shadows (darker areas) and midtones (the actual color of the pan). By contrast, the eggs themselves have no shadows at all, instead being the same color across the entire object. This creates an inconsistency in the rest of the image, showing that they were not taken under the same lighting conditions and therefore are not a part of the original image.

Backgrounds can also be significantly impacted in unintended ways during image editing. To give this a practical example, let's say for a moment that we were going to make this a feature image for an article — something like the cover of a magazine or a banner on a website. But the image just looks too plain: we want to introduce more elements and make it look more interesting. So we take this basic image, apply a background to it and make a few other tweaks to produce this image.

Along the bottom, we see white pixels left over from the original image background — signifying that something has been removed and not very cleanly. Then, if we look at the handle, we can see some major problems compared to the original.

The original handle shows a clean smooth grip all the way around.

 

This modified version, however, shows a major break in the handle where it was ballooned up to seem much larger than the original. We can also see that the background was applied before this modification was, as the background itself has also been altered. Instead of being a gradual change from blue to red as it is in the rest of the image, it now is a large wedge diving into the red section. 

When we are trying to deal with fake images, consistency is always the first line of defense. If something looks off, it more than likely is because somebody made it that way. All of these recommendations can be applied across the board in different ways, such as someone adding a famous person into their vacation photos, changing what a particular sign says or making it look like two people who have never met are shaking hands. Sometimes it's all in fun; other times, it's for marketing or political gain. 

When used for the wrong reasons, this form of manipulation can be extremely dangerous and we must be prepared to show if something has been changed from what it was originally meant to be. Fake image detection is just one form of information assurance.

Sources

1. Cast-iron cookware, Wikipedia (image source)
2. This is How You Can Tell if an Image has Been Photoshopped, Lifehack
3. Adobe Research and UC Berkeley: Detecting Facial Manipulations in Adobe Photoshop, Adobe Blog
4. How to See an Image’s EXIF Data in Windows and macOS, How-To Geek