Steganography Detection Brittnee Morgan December 22, 2004 HPR 108B

Topics of discussion: What is Steganography? What is Steganalysis? What are some detection methods? Is this a growing threat?

What is Steganography? Steganography is the hiding of information within a more obvious kind of communication. Used for centuries traced back to the Roman Empire traced back to the Roman Empire messenger shaved his head tattooed a message on it waited for his hair to grow back traveled to his destination traveled to his destination shaved his head to reveal the message. Also used invisible ink etc.

Round 1 - Bitmap One of these is just a regular image, the other has a 22.0 KB document hidden inside it. Can you tell which is which by just looking? The image on the right is the one with the embedded data.

Round 2 – GIF The same 22 KB document is hidden inside one of these. The original was 4.8 KB, because it is compressed, the steg image is 251 KB

Steganalysis Steganalysis is the detection of steganography by a third party. Visual analysis- detecting changes in the appearance that are noticeable to the human eye. Statistical (algorithmic) analysis- more powerful, reveals small alterations in an image’s statistical behavior caused by steganography

Different Statistical Tests Average bytes - above 175 indicates data embedded, below indicates clean file. Differential values – above 150 is dirty, below 50 is clean You can also use variation of the bytes, kurtosis, and average deviation graphs, but they have no distinct breaking point, and therefore can not be universal. There are also more complicated types, such as mathematical steganalysis

Types of Detection Types of Detection S-tools & Hide and Seek – examine color table of.bmp images for near duplicates J-Steg – hides in DCT coefficients, use statistical testing EZ-Stego – look at color table, can see by looking at image if it is degraded

WetStone Technologies WetStone delivers cyber security and digital investigation products delivers cyber security and digital investigation products training to government, law enforcement, and private sector organizations around the world. training to government, law enforcement, and private sector organizations around the world. Stego Suite 4.1 Stego Suite 4.1 Stego Watch Stego Watch Stego Analyst Stego Analyst Stego Break Stego Break

StegoWatch, Stego Analyst and Stego Break Stego Analyst- An imaging tool that allows searches for visual clues Can examine characteristics such as color palettes, hue, intensity, used colors, etc… Stego Break- Applies a dictionary based attack, to obtain passwords. Stego Watch- This allows users to detect the presence of hidden communications in digital images or audio files.

Niels Provos and StegDetect Niels Provos is one of the leaders in Steganography detection, he developed Stegdetect. This program uses a webcrawler to save images and send them to Stegdetect. It also includes Stegbreak which launches dictionary based attacks on jpegs. Problems: Many false positives Many false positives Too slow Too slow

Dangers of Steganography Explosion on internet traffic provides perfect environment for steganography Over 100 free steg programs on the internet, over 1 million downloads Terrorism – In a New York Times article it explains the use of steganography by terrorists linked to Osama Bin Laden, as well as the Zacarias Moussaoui case that we read about. Used for industrial espionage, trade secret theft, cyber weapon exchange, and criminal coordination and communication.

Future of Steg and Steganalysis As the use of steganography becomes more widespread in both the traditional and criminal world, the techniques are becoming better and better. Steganalysis is also getting better, but as people publish their findings, it is easier to protect against it. Laws are changing to encompass digital information. on Niels Provos’ website, the legality is said to be questioned. website

My Thoughts There is a lot of information out there. Too many images Easy access

Summary Today we talked about What steganography is What steganography is What steganalysis is What steganalysis is Some detection methods Some detection methods Some programs used Some programs used The growing threat when used maliciously The growing threat when used maliciously For more information look at my website at: