Camera Obscura: Exploiting in-camera processing for image counter forensics

For the last two decades Image Forensics has been providing an arsenal of forensic tools to detect tampered images. At the same time, anti-forensics technologies kept evolving to mislead forensic detectors. Such attacks are generally designed to affect a single forensic trace (e.g. JPEG compression, sensor patter noise, histogram statistics) without considering that the image alteration can negatively affect other traces, thus making harder to mimic multiple statistics of natural images. Nevertheless, performing of several attacks can ruin the image quality. In this paper we introduce Camera Obscura, a method that, given a tampered picture, generates a pristine image with native camera metadata, JPEG structure, Quantization Tables, Preview, Thumbnails, their corresponding Quantization Tables, single compression statistics and any in-camera (even proprietary) processing. The attack is performed by exploiting and extending Magic Lantern, an alternative camera firmware, to perform in-camera image buffer substitution. As opposed to available image anti-forensic techniques, Camera Obscura accurately reproduces multiple image statistics in one attack with a limited effect on global image quality. With these characteristics, it can be applied for many different applications such as injecting reference image statistics into a computer generated image, exchange the supposed source of a given image or hide any signal-based editing operation.