google / google/magika

TGA file footer can be used to create adversarial examples

Open
#596 1 comment 0 reactions 0 assignees View on GitHub
adversarial misdetection
Dominant language
Rust
Stars
18.6k
Forks
1.2k
Avg merge
3d 12h
Merged PRs (30d)
20

Description

I noticed that somehow Magika's model is maybe too sensitive to the TGA file footer, and it can be used to create adversarial examples easily.

> I also made a CTF challenge about this, I have described how I found this behavior and crafted the adversarial example in my [write-up](https://github.com/lebr0nli/My-CTF-Challenges/tree/main/HITCON%20CTF%202024/ImagikaTragika#create-adversarial-example-for-magika).

Here's an adversarial example I created to make an ELF file be mistakenly identified as a TGA file:

[poc.so](https://github.com/user-attachments/files/16400982/poc.so.zip)

The above adversarial example can be compiled by `nasm -f bin -o poc.so poc.s` with this [poc.s](https://github.com/user-attachments/files/16400984/poc.s.zip)

> Since GitHub doesn't allow direct file uploads, I had to zip them for uploading. You'll need to unzip them.

If you `LD_PRELOAD=./poc.so /bin/cat` with a x86-64 Linux, you should see `/bin/id` been executed, which means this is definitely a valid ELF file, not a TGA file.

However, Magika will identify it as a TGA file, with score `1.0`:

```console
$ nasm -f bin -o poc.so poc.s
$ LD_PRELOAD=./poc.so /bin/ls
uid=0(root) gid=0(root) groups=0(root)
$ magika --json poc.so
[
{
"path": "poc.so",
"dl": {
"ct_label": "tga",
"score": 1.0,
"group": "image",
"mime_type": "image/x-tga",
"magic": "Targa image data",
"description": "Targa image data"
},
"output": {
"ct_label": "tga",
"score": 1.0,
"group": "image",
"mime_type": "image/x-tga",
"magic": "Targa image data",
"description": "Targa image data"
}
}
]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.