EXIF Metadata Privacy Leak
JPEG and TIFF images containing EXIF metadata that reveals GPS coordinates, camera model, timestamps, and potentially the photographer's identity.
How This Attack Works
Digital cameras and smartphones embed EXIF metadata in photos including GPS coordinates (latitude/longitude), device model, serial number, timestamp, and sometimes the owner's name. When photos are shared online without stripping metadata, this information becomes publicly accessible.
Attack Vector
User uploads a photo to a website or forum. Attacker downloads the image and extracts EXIF data to determine the user's home location, daily routine, or device information for targeted attacks.
Real-World Example
John McAfee's location in Guatemala was revealed through EXIF GPS data in a photo posted by a Vice journalist in 2012. Multiple stalking cases have involved EXIF location data from social media photos.
Safe Implementation
// SAFE: Strip EXIF with sharp (Node.js)
const sharp = require('sharp');
await sharp(inputBuffer)
.rotate() // Apply EXIF rotation first
.withMetadata({ exif: {} }) // Strip EXIF
.toBuffer();Safe Handling Guidelines
Strip all EXIF metadata from user-uploaded images before storing or serving them. Use libraries like sharp (Node.js), Pillow (Python), or ExifTool to remove metadata. Major platforms like Facebook, Twitter, and Instagram strip EXIF data automatically.