1
edit
Changes
Year Zero Research/Weak Leads (view source)
Revision as of 07:15, 18 March 2008
, 07:15, 18 March 2008→Strange ._0X Jpeg's
'''The Tools'''
*[http://www.outguess.org/stegdetect-0.4.zip Stegdetect / Stegbreak]
*[http://www.uplinklounge.com/projects/jpseek-crack/ jpseek-crack] A modified version of jphide for extracting data hidden with the normal jphide.
*[[Dictionary]] Dictionary containing all words from currently confirmed active Year Zero websites.
It is possible that this image does not use standard steganography, so the chance of it needing a password is low. It is believed that any data may be hidden in plain sight, and is probably a plaintext message of some sort. Photoshop and a working knowledge of number systems are probably the best tools in this instance.
===Strange ._0X Jpeg's===
Recently I Downloaded the Year Zero desktop wallpapers and found 8 odd jpegs that seem to be not jpegs
they are called: ._01, ._02, ._03, ._04, ._05, ._06, ._07, and ._08
so at least knowing some odd things i opened them with notepad, 1-7 have identical info but #8 is different
It is full of code and such and has Adobe Photoshop cs3 written near the top. im not sure how much of a
lead it is but I found this strange to include files that are not in a wallpaper package.
link to wallpapers http://yearzero.nin.com/wallpaper/index.html
There is likely nothing hidden in these files, nor is there anything strange about them. On the Macintosh, there is additional data that may be stored with a file beyond what a Windows PC stores. When the file is transported across systems non-natively, the additional bits need to be preserved in some way. The convention is to create files of the same name, but prefixed with ._ to make them hidden, to hold the extra data. The apparently extra files in the zip are just these files from a Mac. This should not be surprising as it is well known Trent does most of his work on a Mac. When the archive is unzipped on a Mac, the data in the extra files is merged back transparently and only 8 regular files appear as a result. The purpose of the extra data becomes obvious when the files are looked at in Finder. All 8 files are shown as being created by Photoshop and set to open with Photoshop (if available) rather than with the default handler for files of .jpg type. 08.jpg has a larger ._08.jpg because it also has a thumbnail rather than the default icon.