1. Steganography and Data Hiding Presented for CRIME by Steven Russelle Detective (retired) Forensic Computer Analysis Police Bureau Portland, OR Box 277 Gaston, OR 97119 email:RUSSELLE HEVANET.COM

2. Steganography is data hiding Don’t think it’s just for hiding stuff in pictures Steg has dozens of “commercial” uses: –Watermarking of: photographs chemical structure sets GIS data sets printed documents audio and video files/streams television (authorized viewer) firmware

3. –Data Protection in pictures can be used to add labels, GPS coordinates, inset magnification, and set resolution, all independently according to clearance level of the viewer Tamper-proofing of texts

4. Unlimited “non-commercial” uses: –Hidden messages or data in files pictures –bitwise –transform movies sound –echo –spread spectrum –codec Acrobat (.pdf) fake spam mail text document files HTML Most any file by appending (PGEnvelope) or DOS MP3 - just type data in

5. –Hiding data in “structures” other than files Fonts TCP/IP headers flash memory Hard Drives/Floppies/media –Steg FS –unused or ignored areas Other Covert Channels

6. Detecting Steganography –Know the available applications and their hiding methods –File name and Hash value database of known Steg applications,.dll’s, and associated files but study reverse engineering/software hacking sites –.EXE encryptors/compressors –patchers, etc. –disassemblers/debuggers

7. –Steg detection software There are some commercial applications –KNOW its limitations and capabilities, and –LEARN data hiding techniques –else you’re toast

8. –Steg detection by other means recognition of known steg “signature” –e.g. F5’s header or the color palette or color space characteristics caused by some of the other tools statistical analysis look for appended data –know your file headers and structure –search tools Network data analysis –TCP headers, etc.

9. Hardware/Software dependencies Data Streams (Keep your eyes peeled HERE) Examples of actual use, and who’s talking about steg? University of Michigan Studies –Study 1 - ebay –Study 2 - usenet

10. Links to info: –Steg generally: www.sans.org/rr/steg/steganog raphy4.php http://www.sans.org/rr/papers/index. php?id=552 –Steg tools archives and info: This is Neil Johnson’s page www.jjtc.com/Steganography/ This is Ross Anderson’s page www.cl.cam.ac.uk/users/rja14/

11. –Univ. of Michigan tech reports including searching the internet for steganography (Niels Provos - Outguess): http://www.citi.umich.edu/tech reports/ www.outguess.org/detection.p hp –Reverse engineering and Hacking: Search internet for: [“sudden discharge” tutorials] and for “YOU have found mammon” -UNICODE