1. Steganography Techniques and Countermeasures with Images, Text, and Audio  First speaker – Chris Kleeschulte  Second speaker – David Miller  Third speaker – Frederick Hendrix  Fourth speaker – Robert Flasher

2. Steganography Techniques 1. Null cipher 2. Invisible Ink 3. Least Significant Bit Insertion 4. Noise Manipulation

3. Null Cipher  Used to hide cipher text, as part of a more complex system  Example: News Eight Weather: Tonight increasing snow. Unexpected precipitation smothers eastern towns. Be extremely cautious and use snowtires especially heading east. The [highway is not] knowingly slippery. Highway evacuation is suspected. Police report emergency situations in downtown ending near Tuesday. Hidden message: Newt is upset because he thinks he is president

4. Invisible Ink  A substance used for writing, which is either invisible on application, which later on can be made visible by some means  Example inks:  milk, lemon, apple or orange juice, onion juice, sugar solution, diluted honey, diluted cola drink, vinegar /wine, or soap water (developed by heat)  phenolphthalein ink (developing by ultraviolet)

5. Least Significant Bit Insertion  Method of hiding data specifically in digital media that organizes data in the form of bytes and bits  “For example: a 24-bit bitmap will have 8 bits representing each of the three color values (red, green, and blue) at each pixel. The difference between say 11111111 and 11111110 in the value for blue intensity is likely to be undetectable by the human eye.” --Wikipedia  Real Example: the colors of these two boxes is #330099 and #330098, which one is which?

6. Noise Manipulation  Method of hiding a secret message in data that is considered noise or extraneous artifacts in cover information.  When dealing with audio, reproduction errors, sound equipment imperfections, distortions from echoes in the studio itself, can introduce tiny errors in the recording of audio

7. Implementation of LSB Insertion  This application can take any kind of digital data and embed it into a picture  Each LSB in each color in each pixel will be considered by the encoding program to be even or odd. Odd will become a ‘1’ and even will be a ‘0’

8. Steganographic Triad of Trade-offs

9. Where to Hide the Data?  In the Fringes of the Cover oBy definition Fringe data is less useful and lacks robustness to processes like compression. oUsually has a higher capacity. oPerceptibility is variable.  In the Significant Portions of the Cover oMore robust to processes like compression. oMay have lower capacity. oPerceptibility is variable.

10. Transform Domain Steganography  Seek to hide data in the significant portions of the Transform Space  Two Major Types in use  Discrete Cosine Transform  Subdivides cover into blocks  Transforms blocks to summation of cosine coefficients  Work with coefficients and perform a reverse transform.  Discrete Wavelet Transform  Kind of like DCT but block size and transform mechanism are variable. Pixel values DCT coefficients

11. How Does it Work with Steganography?  Subdivide cover into blocks.  Convert block to a series of frequency coefficients.  Select coefficients to work with.  Encode or Decode  Ignore, Modulate and/or Swap coefficients.  Compress or Perform reverse transform. DCT coefficients Quantization table Quantized DCT coefficients

12. Trade-offs Choice of Coefficients, Level of Modulation and Block Size all Impact  Perceptibility  Capacity  Robustness

13. Other Advantages and Disadvantages  High Entropy vs. Low Entropy Covers  Audio with talk and music intermixed  Images of a cloudless sky or other such scenes  Choice of DCT vs. DWT with regard to Entropy  Symmetric / Private Key Exchange  Match transform to cover choice

14. Digital Video  Can be treated as a stream of images  Same steganographic techniques can be used.  Potential Increase in capacity, perceptibility and/or robustness.  Additional Avenues of Attack  Frame Rate – Frames may be dropped.  Drift – Additional level of compression and error handling.

15. The Future of Steganography  New Technologies  Bioengineering  New Uses  Medical Records  Anti-counterfeiting  Tunable Authentication  Corporate Espionage  Copyright Enforcement

16. Detecting Steganography Main Approaches  Automated Detection  Visual Inspection  Hand Crafted Statistical Analysis

17. Automated Detection  What is Automated Detection?  Automated detection involves using software or a system to read a file and determine if it contains steganography.  How does it work?  Using an algorithm written in the software or system, the file is analyzed for the presence of steganography and the results of the test are given to the user.  Tools  Software: StegDetect  Machine Learning System  Method Comparisons  Benefits and Limitations +Fast +Low Cost - High Error Rate - Defeated by Newer Steganography Algorithms

18. Automated Detection Cont.

19. Visual Inspection  What is Visual Inspection?  This involves using the aided or unaided human eye to determine if a picture contains steganography  How does it work?  Unaided: Look at the image for signs of tampering  Aided: Map the bit planes and examine them  Benefits and Limitations + Low Cost + Good for LSB insertions on GIFs -Unreliable -Requires skill/experience

20. Visual Inspection Example Original: Enhanced LSB Map Bit Plane Mapping Unaided (Note Artifacts)->

21. More Visual Inspection Examples Clean Steganography Clean Steganography

22. Statistical Analysis  What is Statistical Analysis?  Statistical Analysis involves analyzing patterns in image to determine if it contains a stego payload.  How does it work?  Using properties of the stego image, steganalysis in done using a hand crafted algorithm.  Approaches  Pairs of Values Analysis  Dual Statistics Analysis  JPEG Compatibility  Benefits and Limitations +Flexible +Reliable -Costly -Time Consuming

23. Summary of Detection  There is no “end all” method  Steganography is always trying to defeat steganalysis, and vice versa  The cost, benefits and limitations of each method must be weighed

24. Steganalysis Destruction Attack  Purpose oReplace stego-message data oRender message inextricable oBackup for detection attacks  Steganogram? oImage files (gif, jpeg, bmp, etc…) oText oVideo (mpeg, wav, etc) oAudio (mp3, CD, tape, etc…) oVirtually any digital media or file

25. Desired Attack Characteristics  Removes hidden data  Stealth oImperceptible (human senses) oI = v + t  Low resource use oHuman oComputing

26. Image Domain Destruction Attack  File Compression oEncode  Outputs compact file  Removes unnecessary data bits oDecode  Generates data bit values  Not the same bit values  Stealth – Does not affect v + t  Resource use oEasily automated process oLittle human interaction

27. File Compression Attack - Sample  Before File Compression Attack  After File Compression Attack

28. Image Transform Destruction Attack  Manipulates essential bits of perceptible media properties  Attack types oContrast oBlur oRotate oSharpen oEtc…

29. Image Transform Attack (cont.)  Remove Stego-Message? Stealth? oSteganographer hides message in t’ such that t’ is a subset of t oSteganalyst must insert t’’ such that t’’ is a subset of t and t’ is a subset of t’’  Resource use – Significant human interaction

30. Image Transform Attack - Sample  Before Contrast Attack  After Contrast Attack

31. Conclusions  There is no “end all” method  Steganography is always trying to defeat steganalysis, and vice versa  The benefits and limitations of each method must be weighed

32. Questions?