What does metadata in photos reveal?

You may be familiar with the story of John McAfee, the founder of the antivirus that bears his name. In late 2012, McAfee was wanted for the murder of his neighbor, Gregory Viant Faull. The event took on a very high profile from the first minute, since upon being pursued by the US authorities, the Silicon Valley tycoon fled to Guatemala and entered the country illegally.

During his escape, McAfee defended his innocence on his Twitter account and blog. However, before his whereabouts were discovered and he was deported to Belize, a nonsense.

On December 3, 2012, the Vice website published an exclusive with a provocative headline "We are with John McAfee right now, suckers"In the publication there was a photograph of the computer scientist next to the editor-in-chief, Rocco Castoro. It did not take long to find out where it had been taken when a tweeter posted: "Check the photo's metadata. Oops...":

What is the metadata of a photograph

Every time a photo is taken with a digital device (be it a smartphone, a tablet or a digital camera) the image file contains data (metadata) that reveal information such as: date and time in which the photograph was taken, the device model and version of the operating system, the parameters used to take the photo (exposure time, diaphragm aperture, focal length...).

If you do not have location disabled on your smartphone or tablet, or if the digital camera incorporates GPS, it will also be will reveal the place where the image was made.

All this information is organized according to a multimedia metadata standard called EXIF (Exchangeable Image Format), which is what allows you to provide rich information to the JPG, TIFF, RIFF and WAVE image formats. This would be what the data from a photograph like the one in Vice would look like:

To know the metadata of a photograph you only have to use tools such as EXIFtool, one of the most used both to display this information and to remove it from the photograph.

It is clear that a tool like EXIFtool is the one that the Vice team or even McAfee himself should have used, since his company paradoxically revolutionized the computer security industry. However, it is not every day that security mechanisms have to be put in place because a fugitive is being interviewed. Therefore, many will wonder to what extent photos posted on other websites can compromise data private of a company.

Metadata and social networks

There is no doubt that when publishing an image, social networks They are the most used Internet sites. As this is a privacy issue, each social network has its own metadata management: some eliminate it and others maintain it. Let's review the treatment of metadata and privacy in the most popular social networks: Facebook, Twitter and Instagram.

Simply upload a photo to the servers. Facebook, copy the image link to the clipboard and paste it into this online tool to know that Facebook does not store metadata of the photographs that are published on the social network.

In the following image you can see the only metadata that can be extracted from a photograph uploaded to Facebook:

However, since Privacy Policy, the user is warned that Facebook collects information based on the content we share, such as where a photograph was taken or when a file was created and uploaded. On the same page it states that they use this information to improve their services and develop others.

With the same tool that we have used in the previous case, we verify that Twitter also clear image metadata that are uploaded to this social network. This occurs whether the image is published from the web application or from mobile.

This is a point in favor of this platform when it comes to preserving user privacy, however, from your Privacy Policy They also explain the number of ways they have to obtain user data, having a section dedicated to their location.

Other social networks that operate under the wing of Mark Zuckerberg are instagram. In this case, we will not be able to consult the metadata of the images, since currently it does not give the option to download the images or copy their link in the desktop version.

In conclusion, the aforementioned social networks do protect the user from information leaks, although not all do it (this is the case of Google+, Flickr or Tumblr). The same does not happen when the photographs are uploaded to cloud services such as Google Drive or Dropbox, since the files are not altered, anyone with access to those services will be able to read the image metadata.

Could metadata endanger a company's security?

At this point, it should be said that metadata is present in all types of digital files, not only in digital photography. Text documents, PDFs or videos contain metadata that can also be revealed or altered with tools that can be found on the Internet.

Many companies have no problem exposing the place where they are located or even the equipment they work with (remember that the model with which the photo was taken appears in the metadata).

Other companies or even freelancers, They prefer to control everything that is published regarding their professional activity on the Internet., and the truth is that this is the most recommended given that hacking techniques are constantly changing.

It is difficult to specify how they might use metadata of an innocent photograph to damage the corporate image or that of a professional. For example, metadata may be revealing for a hacker to use social engineering with a worker or self-employed person. It can extract relevant information such as an email address to send you an email posing as the technical service of your digital camera equipment, and asking you to click on a malware link .

Because cases like this happen every day, computer security training must be key for both companies and digital nomads. From ODS, we personalize the training according to your business activity so that your security is not compromised by the thousands of attacks that occur daily.