1

2 Discussion Topic: Steganography By Chris Turla, Darien Hager, Jeremy Cheng, Pui Chee Chan INFO 498 – Information Security Autumn ’04

3 What is Steganography? Derived from the Greek steganos (covered or secret) and graphy (writing or drawing). Hiding of information within electronic media: text, graphics and sound. Hiding of information within electronic media: text, graphics and sound. Used synonymously with Cryptography but different. Used synonymously with Cryptography but different. Cryptography: rendering of information as unreadable to others.Cryptography: rendering of information as unreadable to others. The presence of ciphertext makes it obvious that a secret lies within.The presence of ciphertext makes it obvious that a secret lies within.

4 History In Ancient Rome: hidden messages were tattooed on messengers shaved head. When the hair grew back, the messengers set off with a decoy message in hand. A process that usually took months. In Ancient Rome: hidden messages were tattooed on messengers shaved head. When the hair grew back, the messengers set off with a decoy message in hand. A process that usually took months. In Greece: Messages were inscribed on wooden tablets and covered with wax to make the text disappear. In Greece: Messages were inscribed on wooden tablets and covered with wax to make the text disappear. World War II: Microdot developed by the Germans. World War II: Microdot developed by the Germans. Pre 911: Terrorist utilized hotmail to distribute images between each other as a form of communication. Pre 911: Terrorist utilized hotmail to distribute images between each other as a form of communication. Post 911: Alleged conspirators were suspected using pictures posted in online auction sites (e.g. ebay) to camouflage hidden messages. Post 911: Alleged conspirators were suspected using pictures posted in online auction sites (e.g. ebay) to camouflage hidden messages.

5 How is it used? Expressed verbally: result file = container file + message file result file = container file + message file The secret message is hidden in distributed manners through algorithmic mean in the file meant to contain the secret data. Using white noise contained in electronic media. Using white noise contained in electronic media. Replacing LSB - least significant (rightmost) bit in colors. Replacing LSB - least significant (rightmost) bit in colors.

6 How it works Maroon and gold boxes show altered bytes. Maroon and gold boxes show altered bytes. Only 8 pixels changed: Only 8 pixels changed: 2, 4, 5, 6, 7, 8, 9, 10 The following sequence of 24 bits represents a single pixel in an image. Its 3 bytes of color information provide a total of 256 different values for each color (red, green and blue) and thus can represent a total of 16.7 million colors. This particular value displays as a dark green: Now, let’s take 11 of these pixels that represent, say, part of a solid-color background. In the following sequence, the least significant (rightmost) bit of each 8-bit byte has been co- opted to hide a text message—the four characters Aha!—in ASCII binary: The two figures below represent the 11 colored pixels we’ve been manipulating. The figure on the left is the original, unaltered version. The one on the right has been modified, as shown above. Can you see a difference? I can’t either. The hidden message occupies 32 of those 264 bits (about 12%) and contains four 8-bit bytes. In the diagram, each maroon or gold box represents a bit that had to be changed to include the hidden message. Notice that only 15 of 264 bits (less than 6%) had to be changed and only eight of the 11 pixels were altered. Here are the bits behind those 11 pixels:

7 Demo

8 Legitimate use of Steganography: Document tracking. Document tracking. Watermark containing copyright information. Watermark containing copyright information. Authentication. Authentication. Possible document locator. Possible document locator.

9 Ways to detect Steganography: Steganalysis - the art of discovering and rendering hidden messages useless. Steganalysis - the art of discovering and rendering hidden messages useless. Compare images to look for degradation with characteristic. Compare images to look for degradation with characteristic. Record anomalies and compare with original pictures. Record anomalies and compare with original pictures. Gather information on color composition, luminance, pixel relationship to form knowledge database and analyze the data to find patterns. Gather information on color composition, luminance, pixel relationship to form knowledge database and analyze the data to find patterns.

10 Ways to remove hidden messages: Overwrite areas of files which might contain noise space. Overwrite areas of files which might contain noise space. Heighten levels of noise. Heighten levels of noise. Image processing technique: lossy compression such as that used by JPEG. Image processing technique: lossy compression such as that used by JPEG.

11 Why is it hard to detect? Because of human inability to discern minor changes in colors and sound quality, any electronic media can hide information. Because of human inability to discern minor changes in colors and sound quality, any electronic media can hide information. The same steganography tool and pass- phrase are needed to unhide the information. The same steganography tool and pass- phrase are needed to unhide the information. Too many data to process and too time consuming – which picture is the original? Secret messages can be hidden in any picture! Too many data to process and too time consuming – which picture is the original? Secret messages can be hidden in any picture!

12 Why is Steganography not pervasively used (with ill intention)? Limited data can be hidden. A picture with 2048 by 3072 pixels (each containing 24 bits) can only hide 756K of data. Limited data can be hidden. A picture with 2048 by 3072 pixels (each containing 24 bits) can only hide 756K of data. Large files attract attention! Large files attract attention! Original information must remain intact in order for recovery of hidden message. Original information must remain intact in order for recovery of hidden message.

13 References Deborah Radcliff. “Steganography: Hidden Data.” Computerworld. Framingham: Jun 10, Vol. 36, Iss. 24; 52. James David Ballard, Joseph G Hornik, Douglas McKenzie. “Technological Facilitation of Terrorism”. The American Behavioral Scientist. Thousand Oaks: Feb Vol. 45, Iss. 6; Sharon Gaudin. “The Terrorist Network.” Network World. Framingham: Nov 26, Vol. 18, Iss. 48;

14 Thank you!