Steganography Techniques and Countermeasures with Images, Text, and Audio  First speaker – Chris Kleeschulte  Second speaker – David Miller  Third speaker – Frederick Hendrix  Fourth speaker – Robert Flasher

Steganography Techniques 1. Null cipher 2. Invisible Ink 3. Least Significant Bit Insertion 4. Noise Manipulation

Null Cipher  Used to hide cipher text, as part of a more complex system  Example: News Eight Weather: Tonight increasing snow. Unexpected precipitation smothers eastern towns. Be extremely cautious and use snowtires especially heading east. The [highway is not] knowingly slippery. Highway evacuation is suspected. Police report emergency situations in downtown ending near Tuesday. Hidden message: Newt is upset because he thinks he is president

Invisible Ink  A substance used for writing, which is either invisible on application, which later on can be made visible by some means  Example inks:  milk, lemon, apple or orange juice, onion juice, sugar solution, diluted honey, diluted cola drink, vinegar /wine, or soap water (developed by heat)  phenolphthalein ink (developing by ultraviolet)

Least Significant Bit Insertion  Method of hiding data specifically in digital media that organizes data in the form of bytes and bits  “For example: a 24-bit bitmap will have 8 bits representing each of the three color values (red, green, and blue) at each pixel. The difference between say and in the value for blue intensity is likely to be undetectable by the human eye.” --Wikipedia  Real Example: the colors of these two boxes is # and #330098, which one is which?

Noise Manipulation  Method of hiding a secret message in data that is considered noise or extraneous artifacts in cover information.  When dealing with audio, reproduction errors, sound equipment imperfections, distortions from echoes in the studio itself, can introduce tiny errors in the recording of audio

Implementation of LSB Insertion  This application can take any kind of digital data and embed it into a picture  Each LSB in each color in each pixel will be considered by the encoding program to be even or odd. Odd will become a ‘1’ and even will be a ‘0’

Steganographic Triad of Trade-offs

Where to Hide the Data?  In the Fringes of the Cover oBy definition Fringe data is less useful and lacks robustness to processes like compression. oUsually has a higher capacity. oPerceptibility is variable.  In the Significant Portions of the Cover oMore robust to processes like compression. oMay have lower capacity. oPerceptibility is variable.

Transform Domain Steganography  Seek to hide data in the significant portions of the Transform Space  Two Major Types in use  Discrete Cosine Transform  Subdivides cover into blocks  Transforms blocks to summation of cosine coefficients  Work with coefficients and perform a reverse transform.  Discrete Wavelet Transform  Kind of like DCT but block size and transform mechanism are variable. Pixel values DCT coefficients

How Does it Work with Steganography?  Subdivide cover into blocks.  Convert block to a series of frequency coefficients.  Select coefficients to work with.  Encode or Decode  Ignore, Modulate and/or Swap coefficients.  Compress or Perform reverse transform. DCT coefficients Quantization table Quantized DCT coefficients

Trade-offs Choice of Coefficients, Level of Modulation and Block Size all Impact  Perceptibility  Capacity  Robustness

Other Advantages and Disadvantages  High Entropy vs. Low Entropy Covers  Audio with talk and music intermixed  Images of a cloudless sky or other such scenes  Choice of DCT vs. DWT with regard to Entropy  Symmetric / Private Key Exchange  Match transform to cover choice

Digital Video  Can be treated as a stream of images  Same steganographic techniques can be used.  Potential Increase in capacity, perceptibility and/or robustness.  Additional Avenues of Attack  Frame Rate – Frames may be dropped.  Drift – Additional level of compression and error handling.

The Future of Steganography  New Technologies  Bioengineering  New Uses  Medical Records  Anti-counterfeiting  Tunable Authentication  Corporate Espionage  Copyright Enforcement

Detecting Steganography Main Approaches  Automated Detection  Visual Inspection  Hand Crafted Statistical Analysis

Automated Detection  What is Automated Detection?  Automated detection involves using software or a system to read a file and determine if it contains steganography.  How does it work?  Using an algorithm written in the software or system, the file is analyzed for the presence of steganography and the results of the test are given to the user.  Tools  Software: StegDetect  Machine Learning System  Method Comparisons  Benefits and Limitations +Fast +Low Cost - High Error Rate - Defeated by Newer Steganography Algorithms

Automated Detection Cont.

Visual Inspection  What is Visual Inspection?  This involves using the aided or unaided human eye to determine if a picture contains steganography  How does it work?  Unaided: Look at the image for signs of tampering  Aided: Map the bit planes and examine them  Benefits and Limitations + Low Cost + Good for LSB insertions on GIFs -Unreliable -Requires skill/experience

Visual Inspection Example Original: Enhanced LSB Map Bit Plane Mapping Unaided (Note Artifacts)->

More Visual Inspection Examples Clean Steganography Clean Steganography

Statistical Analysis  What is Statistical Analysis?  Statistical Analysis involves analyzing patterns in image to determine if it contains a stego payload.  How does it work?  Using properties of the stego image, steganalysis in done using a hand crafted algorithm.  Approaches  Pairs of Values Analysis  Dual Statistics Analysis  JPEG Compatibility  Benefits and Limitations +Flexible +Reliable -Costly -Time Consuming

Summary of Detection  There is no “end all” method  Steganography is always trying to defeat steganalysis, and vice versa  The cost, benefits and limitations of each method must be weighed

Steganalysis Destruction Attack  Purpose oReplace stego-message data oRender message inextricable oBackup for detection attacks  Steganogram? oImage files (gif, jpeg, bmp, etc…) oText oVideo (mpeg, wav, etc) oAudio (mp3, CD, tape, etc…) oVirtually any digital media or file

Desired Attack Characteristics  Removes hidden data  Stealth oImperceptible (human senses) oI = v + t  Low resource use oHuman oComputing

Image Domain Destruction Attack  File Compression oEncode  Outputs compact file  Removes unnecessary data bits oDecode  Generates data bit values  Not the same bit values  Stealth – Does not affect v + t  Resource use oEasily automated process oLittle human interaction

File Compression Attack - Sample  Before File Compression Attack  After File Compression Attack

Image Transform Destruction Attack  Manipulates essential bits of perceptible media properties  Attack types oContrast oBlur oRotate oSharpen oEtc…

Image Transform Attack (cont.)  Remove Stego-Message? Stealth? oSteganographer hides message in t’ such that t’ is a subset of t oSteganalyst must insert t’’ such that t’’ is a subset of t and t’ is a subset of t’’  Resource use – Significant human interaction

Image Transform Attack - Sample  Before Contrast Attack  After Contrast Attack

Conclusions  There is no “end all” method  Steganography is always trying to defeat steganalysis, and vice versa  The benefits and limitations of each method must be weighed

Questions?