Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

A friend posted an image that was animating directly in the messages feed on my Facebook start page. How is this possible? How can this be done?

This is the URL used by Facebook: http://photos-c.ak.fbcdn.net/hphotos-ak-snc3/29301_442976909814_310716489814_5773694_3162803_s.jpg

Is it a GIF image just renamed to .jpg? Probably not.

I don't know if it helps or anything, but here is the portion (script) that contains that image URL:

<script>big_pipe.onPageletArrive({"phase":4,"id":"pagelet_photo_bar","css":["aes1F","FPnMi"],"js":["Py8xV","1k++i","9qrJd"],"onload":["PhotoTheater.init(HTML(\"\\u003cdiv id=\\\"fbPhotoTheater\\\" class=\\\"fbPhotoTheater hidden_elem narrowerWhiteBar\\\" tabindex=\\\"0\\\" role=\\\"region\\\" aria-label=\\\"Facebook-Diashow\\\" aria-busy=\\\"true\\\">\\u003cdiv class=\\\"container\\\">\\u003cdiv class=\\\"positioner\\\">\\u003ca class=\\\"uiTooltip closeTheater\\\" href=\\\"#\\\">\\u003ci class=\\\"closeImage img sp_6lzo0r sx_bbf9a4\\\">\\u003c\\\/i>\\u003cspan class=\\\"uiTooltipWrap middle left leftmiddle\\\">\\u003cspan class=\\\"uiTooltipText uiTooltipNoWrap\\\">Schlie\\u00dfen\\u003c\\\/span>\\u003c\\\/span>\\u003c\\\/a>\\u003c\\\/div>\\u003cdiv class=\\\"stageBackdrop\\\">\\u003c\\\/div>\\u003cdiv class=\\\"stageWrapper\\\">\\u003cdiv class=\\\"stage\\\">\\u003cimg src=\\\"\\\/images\\\/loaders\\\/indicator_black.gif\\\" class=\\\"spotlight\\\" \\\/> \\u003cdiv class=\\\"fbPhotosTheaterTags tagContainer\\\" id=\\\"fbPhotoTheaterTags\\\">\\u003cdiv class=\\\"tagsWrapper\\\">\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/div>\\u003cdiv class=\\\"videoStage\\\"> \\u003c\\\/div>\\u003cdiv id=\\\"fbPhotoTheaterError\\\" class=\\\"fbPhotoTheaterError hidden_elem stageError\\\">\\u003c\\\/div>\\u003c\\\/div>\\u003cdiv class=\\\"stageActions\\\" id=\\\"fbPhotoTheaterStageActions\\\">\\u003ca class=\\\"prev\\\" href=\\\"#\\\" title=\\\"Zur\\u00fcck\\\">\\u003c\\\/a>\\u003ca class=\\\"next\\\" href=\\\"#\\\" title=\\\"Weiter\\\">\\u003c\\\/a>\\u003cdiv class=\\\"fbPhotoTheaterButtons\\\" id=\\\"fbPhotoTheaterButtons\\\">\\u003c\\\/div>\\u003c\\\/div>\\u003cdiv class=\\\"photoInfoWrapper\\\">\\u003ctable class=\\\"uiGrid fbPhotoTheaterGrid photoInfo\\\" cellspacing=\\\"0\\\" cellpadding=\\\"0\\\">\\u003ctbody>\\u003ctr>\\u003ctd class=\\\"vTop detailsCell\\\">\\u003cdiv class=\\\"detailsContainer\\\">\\u003cdiv id=\\\"fbPhotoTheaterTitle\\\">\\u003c\\\/div>\\u003cspan id=\\\"fbPhotoTheaterContributors\\\">\\u003c\\\/span> \\u003cspan class=\\\"fsm fwn fcg\\\" id=\\\"fbPhotoTheaterCount\\\">\\u003c\\\/span>\\u003chr class=\\\"mvm\\\" \\\/>\\u003cdiv id=\\\"fbPhotosTheaterActions\\\" class=\\\"fbPhotosTheaterActions\\\">\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/td>\\u003ctd class=\\\"vTop commentsCell\\\">\\u003cdiv class=\\\"commentsContainer\\\">\\u003cdiv class=\\\"fbPhotosTaglist mbm tagpile\\\" id=\\\"fbPhotosTaglist\\\">\\u003cspan class=\\\"caption fsm fwn fcg\\\">Auf diesem Foto: \\u003c\\\/span>\\u003c\\\/div>\\u003cdiv id=\\\"fbPhotoTheaterUfi\\\">\\u003cform rel=\\\"async\\\" class=\\\"commentable_item autoexpand_mode\\\" method=\\\"post\\\" action=\\\"\\\/ajax\\\/ufi\\\/modify.php\\\" onsubmit=\\\"return Event.__inlineSubmit(this,event)\\\">\\u003cinput type=\\\"hidden\\\" name=\\\"charset_test\\\" value=\\\"&euro;,&acute;,\\u20ac,\\u00b4,\\u6c34,\\u0414,\\u0404\\\" \\\/>\\u003cinput type=\\\"hidden\\\" autocomplete=\\\"off\\\" name=\\\"post_form_id\\\" value=\\\"10711e587b061f39240641dbc74019ac\\\" \\\/>\\u003cinput type=\\\"hidden\\\" name=\\\"fb_dtsg\\\" value=\\\"AQBfQgRs\\\" autocomplete=\\\"off\\\" \\\/>\\u003c\\\/form>\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/td>\\u003ctd class=\\\"vTop adsCell\\\">\\u003cdiv class=\\\"adsContainer\\\">\\u003cdiv class=\\\"clearfix\\\">\\u003cdiv id=\\\"fbPhotoTheaterEgo\\\" class=\\\"fbPhotoTheaterEgo\\\">\\u003c\\\/div>\\u003cdiv class=\\\"fbPhotoTheaterEgoSponsored fss fwn fcg\\\">Gesponsert\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/td>\\u003c\\\/tr>\\u003c\\\/tbody>\\u003c\\\/table>\\u003c\\\/div>\\u003c\\\/div>\\u003c\\\/div>\"));"],"onafterload":["Bootloader.loadComponents([\"fb-photos-theater-css\"], function(){  });"],"content":{"pagelet_photo_bar":"\u003cdiv class=\"mbm fbProfilePhotoStrip\">\u003cul class=\"fbProfilePhotoBar\">\u003cli class=\"stat_elem\" id=\"thumb193067094054363\">\u003ca class=\"uiMediaThumb fbProfilePhotoThumb uiMediaThumbMedium\" href=\"http:\/\/www.facebook.com\/photo.php?fbid=193067094054363&amp;set=t.100000400858474&amp;type=1\" rel=\"theater\" ajaxify=\"http:\/\/www.facebook.com\/photo.php?fbid=193067094054363&amp;set=t.100000400858474&amp;type=1&amp;src=http\u00253A\u00252F\u00252Fa1.sphotos.ak.fbcdn.net\u00252Fhphotos-ak-snc6\u00252F179200_193067094054363_100000532222327_655777_5428850_n.jpg&amp;theater\">\u003ci style=\"background-image: url(http:\/\/photos-a.ak.fbcdn.net\/hphotos-ak-snc6\/179200_193067094054363_100000532222327_655777_5428850_s.jpg); background-position: -33px -17px;\">\u003c\/i>\u003c\/a>\u003c\/li>\u003cli class=\"stat_elem\" id=\"thumb185312914825402\">\u003ca class=\"uiMediaThumb fbProfilePhotoThumb uiMediaThumbMedium\" href=\"http:\/\/www.facebook.com\/photo.php?fbid=185312914825402&amp;set=t.100000400858474&amp;type=1\" rel=\"theater\" ajaxify=\"http:\/\/www.facebook.com\/photo.php?fbid=185312914825402&amp;set=t.100000400858474&amp;type=1&amp;src=http\u00253A\u00252F\u00252Fa8.sphotos.ak.fbcdn.net\u00252Fhphotos-ak-snc6\u00252F165369_185312914825402_100000400858474_523262_6205304_n.jpg&amp;theater\">\u003ci style=\"background-image: url(http:\/\/photos-h.ak.fbcdn.net\/hphotos-ak-snc6\/165369_185312914825402_100000400858474_523262_6205304_s.jpg); background-position: -22px -30px;\">\u003c\/i>\u003c\/a>\u003c\/li>\u003cli class=\"stat_elem\" id=\"thumb175015452521815\">\u003ca class=\"uiMediaThumb fbProfilePhotoThumb uiMediaThumbMedium\" href=\"http:\/\/www.facebook.com\/photo.php?fbid=175015452521815&amp;set=a.175015445855149.34462.100000400858474&amp;type=1\" rel=\"theater\" ajaxify=\"http:\/\/www.facebook.com\/photo.php?fbid=175015452521815&amp;set=a.175015445855149.34462.100000400858474&amp;type=1&amp;src=http\u00253A\u00252F\u00252Fa6.sphotos.ak.fbcdn.net\u00252Fhphotos-ak-snc4\u00252F156854_175015452521815_100000400858474_459703_1557976_n.jpg&amp;theater\">\u003ci style=\"background-image: url(http:\/\/photos-f.ak.fbcdn.net\/hphotos-ak-snc4\/156854_175015452521815_100000400858474_459703_1557976_s.jpg);\">\u003c\/i>\u003c\/a>\u003c\/li>\u003cli class=\"stat_elem\">\u003cdiv class=\"fbProfilePhotoThumbEmpty\">\u003c\/div>\u003c\/li>\u003cli class=\"stat_elem\">\u003cdiv class=\"fbProfilePhotoThumbEmpty\">\u003c\/div>\u003c\/li>\u003c\/ul>\u003c\/div>"}});</script> 

The important part of the above seems to be here:

style=\"background-image: url(http:\/\/photos-f.ak.fbcdn.net\/hphotos-ak-snc4\/156854_175015452521815_100000400858474_459703_1557976_s.jpg);\">
share|improve this question
    
You can't just rename a gif to a jpg and expect it work. –  ChrisF May 28 '11 at 13:47
    
Yeah, I just tried that. The GIF is still displayed correctly at facebook but does not animate. –  bitbonk May 28 '11 at 13:52

3 Answers 3

April 2012 - Current Exploit uses the mobile text application to pass images

http://www.facebook.com/connect/uiserver.php?app_id=2915120374
&method=stream_publish
&redirect_uri=http://www.facebook.com
&from=SENDERID
&target_id=RECEIVERID
&action_links=[{"text":"Your Text Here",
                "href":"http://www.blank.com/"}]
&attachment={'media':[{'type':'image',
                       'src':'animationurl',
                       'href':'anyurl'}],
             'description':'LongDescription',
             'properties':{'Anything':{'text':'Anything',
                                       'href':'anyurl'}}}

The only thing really needed is the animationurl, which needs to be a Facebook hosted image.

These are the ways that were previously possible

  • Changing filename to GIF
  • Changing file dimensions to around 120 px to bypass compression
  • Changing header data or adding bytes (example the ending 3B in the GIF data) to the end of the file to bypass Facebook image tools
    Data Change
  • Via Facebook FBML
  • Via Facebook HMTL tags in notes

The first working way seems to be somehow sharing the currently available set of gifs on Facebook servers via tagging users in it. I have not seen any new GIFs appear apart from those that currently circle around.

The second utilizes an abuse of the Facebook API via a Facebook Application. The developer hid the GIFs in a video embed preview.

Developer application

Now, assuming one were to figure it out, you would be banned... because this means the image upload system is flawed and dangerous code can be executed by being concealed in a GIF or picture. It seems that Facebook Photo Team will ensure that GIFs do not stay around anymore.

Nathaniel Roman

Quora Image: That was a bug that was on the site for just a short period of time. It got fixed awhile back.

And previously in the old Facebook Dev Wiki some of this may have changed by now but the gist remains the same

Facebook Platform handles img tags in a special manner. When publishing a page, Facebook servers request any image URLs and then serves these images, rewriting the src attribute of all img tags using a *.facebook.com domain. This protects the privacy of Facebook's users and allows them to better control the quality of service of their images.

There are several reasons for the existence of the image cache:

  • We need a way to ensure some degree of quality and uniformity in the images displayed on users' profiles (no animated images, no 50 MB images, etc.)
  • We need to protect users' privacy and not allow malicious applications to extract information from image requests made directly from a viewing user's browser
  • Probably most important to you, the image cache shields developers from the potentially enormous load of serving these images, putting the burden on Facebook's resources instead

And in the end as I have mentioned elsewhere

Also although not stated anywhere in the TOS,

By uploading a file you certify that you have the right to distribute this picture and that it does not violate the Terms of Service

So you may get a pat on the back for testing on a Test User Account but using an exploit (if found) on a personal account. I am certain you will end up seeing a termination of your account.

P.S. Don't think because that when you are browsing sites that Facebook Employees do not see this information. The moment an exploit is known publicly, in the same amount of time it will be shut down

share|improve this answer
    
+1 Awesome answer. –  Alpha May 15 '12 at 21:47

I researched and found that the image is generated by the application http://apps.facebook.com/animated-picture/ You can generate files like this from a SWF (flash) on this application as animated GIF and publish on your facebook!

share|improve this answer

Although the extension is jpeg, it's still a gif file

Firefox image

To answer your question, this is what I found:

What you have to do is upload a small animated gif (about 50 KB or less)as your profile photo (Facebook will flatten animated gifs which are to large, but do not detect the smaller ones). It will then be in your profile's album. Your icon itself will NOT be animated. However, you will see it as animated in your Facebook profile photos folder, and by going to that photo, & clicking on "share", it will appear on your wall as animated.

Profile Thumbnails are always generated from the base image. If the base image is under 120x120 then the animation will remain intact through both the minimized and maximized views. Anything over that size will need to be resized to fit as a minimized gallery thumbnail, and will lose animation, however the full-size should remain animated.

share|improve this answer

protected by Community Oct 31 '11 at 2:29

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.