Steganography and Data Hiding Presented for CRIME by Steven Russelle Detective (retired) Forensic Computer Analysis Police Bureau Portland, OR Box 277 Gaston, OR RUSSELLE HEVANET.COM

Steganography is data hiding Don’t think it’s just for hiding stuff in pictures Steg has dozens of “commercial” uses: –Watermarking of: photographs chemical structure sets GIS data sets printed documents audio and video files/streams television (authorized viewer) firmware

–Data Protection in pictures can be used to add labels, GPS coordinates, inset magnification, and set resolution, all independently according to clearance level of the viewer Tamper-proofing of texts

Unlimited “non-commercial” uses: –Hidden messages or data in files pictures –bitwise –transform movies sound –echo –spread spectrum –codec Acrobat (.pdf) fake spam mail text document files HTML Most any file by appending (PGEnvelope) or DOS MP3 - just type data in

–Hiding data in “structures” other than files Fonts TCP/IP headers flash memory Hard Drives/Floppies/media –Steg FS –unused or ignored areas Other Covert Channels

Detecting Steganography –Know the available applications and their hiding methods –File name and Hash value database of known Steg applications,.dll’s, and associated files but study reverse engineering/software hacking sites –.EXE encryptors/compressors –patchers, etc. –disassemblers/debuggers

–Steg detection software There are some commercial applications –KNOW its limitations and capabilities, and –LEARN data hiding techniques –else you’re toast

–Steg detection by other means recognition of known steg “signature” –e.g. F5’s header or the color palette or color space characteristics caused by some of the other tools statistical analysis look for appended data –know your file headers and structure –search tools Network data analysis –TCP headers, etc.

Hardware/Software dependencies Data Streams (Keep your eyes peeled HERE) Examples of actual use, and who’s talking about steg? University of Michigan Studies –Study 1 - ebay –Study 2 - usenet

Links to info: –Steg generally: raphy4.php php?id=552 –Steg tools archives and info: This is Neil Johnson’s page This is Ross Anderson’s page

–Univ. of Michigan tech reports including searching the internet for steganography (Niels Provos - Outguess): reports/ hp –Reverse engineering and Hacking: Search internet for: [“sudden discharge” tutorials] and for “YOU have found mammon” -UNICODE