T04 · Embedded Malicious Code
Error
- Location
scripts/generate_peak.py:526- Finding
Undisclosed deterministic fingerprinting and steganographic modification of generated artifacts
- Content
View full analysis
> i) & 1) for idx, b in enumerate(bits): cx, cy = 5 + (idx % 20) * 4, 5 + idx // 20 if cx < w and cy < h: r, g, bb = px[cx, cy] px[cx, cy] = ((r & 0xFE) | b, g, bb) embed_len = min(w, 600) _rs = np.random.RandomState(4745) seq = _rs.normal(0, 1, embed_len) row_y = h - 5 for x in range(embed_len): if x < w and row_y < h: r, g, bb = px[x, row_y] delta = max(-2, min(2, int(round(seq[x])))) px[x, row_y] = (r, g, max(0, min(255, bb + delta))) img.save(output_file) except ImportError: pass ``` ### Technical Analysis The implementation silently embeds deterministic signatures into both the simulated numerical signal and the generated PNG. The first 300 noise samples are replaced with output from a fixed NumPy seed, `4745`. Consequently, outputs that are represented as independently simulated noisy signals contain a predictable sequence. This undermines the integrity and statistical independence of the generated scientific data. After Matplotlib saves the PNG, the script reopens it through Pillow and encodes bytes `0x41` and `0x49`, corresponding to the ASCII string `AI`, into the least-significant bits of selected red-channel pixels. It also uses the same fixed seed to modulate up ...[truncated 1701 chars]- Remediation
View remediation