Department of Computer and Information Sciences STEGANOGRAPHY by Vibha Chhatwal 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Steganography is the art of hiding information in ways that prevent the detection of hidden messages -Neil F.Johnson Cryptography is “secret writing” and steganography is “cover writing” Cryptography makes the plaintext unintelligible and so the existence of some secret plaintext is evident Steganography is hiding the message in innocent-looking “containers” or “covers” such as another text file, digital images, audio and video files. Encrypting information using cryptography and concealing information using steganography is the best combination Requirements of Hiding Information Digitally The integrity of the hidden information after it has been embedded must be correct The stego object must remain unchanged to the naked eye. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences History Herodotus tells how Histiaeus shaved the head of his most trusted slave and tattooed it with a message which disappeared after the hair had regrown. The purpose of this message was to instigate a revolt against the Persians. During the American Revolution, invisible ink which would glow over a flame was used by both the British and Americans to communicate secretly Steganography was also used in both World Wars. German spies hid text by using invisible ink to print small dots above or below letters and by changing the heights of letter-strokes in cover texts In World War I, prisoners of war would hide Morse code messages in letters home by using the dots and dashes on i, j, t and f. During World War II, the Germans would hide data as microdots. A message sent by a German spy during World War II read: “Apparently neutral’s protest is thoroughly discounted and ignored. Isman hard hit. Blockade issue affects for pretext embargo on by-products, ejecting suets and vegetable oils.” By taking the second letter of every word the hidden message “Pershing sails for NY June 1” can be retrieved 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Application of Steganography To hide a message intended for later retrieval Copyright marking-digital watermarking and fingerprinting Steganography (covered writing, covert channels) Protection Against detection Protection Against removal Watermarking (all objects are marked in the same way) Fingerprinting (identify all objects, every object is marked specific) 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Types of Steganography carriers Image files as carriers using 24-bit images: too large to pass over the network using 8-bit images: prone to modification/ lossy compression Audio files as carriers Exploits imperfection of human auditory system called audio masking. In this case, weak signal is generally inaudible in loud signal. Video files as carriers A combination of sound and image techniques can be used Text files as carriers Uses open space in text files to encode the secret information. It works on the fact that to a casual reader an extra space anywhere does not prompt abnormality. Disadvantage is that it requires large amount of data to conceal little information DNA strands as carriers 9/20/2018 Department of Computer and Information Sciences

Steganography using image files Common approaches to image steganography is: Least significant bit insertion Masking and filtering Algorithms and transformation LSB Technique Based on three factors: - large file size - presence of ‘noise’ - the frailties of human perception 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Disadvantages/attacks on LSB Vulnerable to slight image manipulation: converting an image from a format like GIF/BMP which reconstructs the original image exactly (lossless compression) to a JPEG, which does not (lossy compression), and then back could destroy the data hidden in the LSBs Sequential LSB is highly detectible because it creates a statistical pattern that differs from the unaltered portion of the image. Advancements in LSB Modified LSB Hide8 algorithm in which we replace the operation of flipping the LSBs by randomly adding +1 or -1 to pixels and extracting the message bits from LSBs as in classical technique Selective Insertion Only the selected bytes of the container file are modified as per the key entered. Amount of data hidden is decreased but security enhances High level LSB Insertion Hides the data in more than 1 bit of the a byte maintaining no distortion 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Digital Watermarking/ Masking Primarily used for copyright marking as a solution against piracy The mark can be embedded in any legal versions and will therefore be present in any copy made. This helps the copyright owner to identify who has an illegal copy. changes in the stego-object must have no effect on the watermark In general the embedding process inserts a mark, M, in an object, I. A key, K, usually produced by a random number generator is used in the embedding process and the resulting marked object, Ĩ, is generated by the mapping: I x K x M → Ĩ. Having passed through the encoder, a stego object will be produced. Having produced the stego object, it will then be sent off via some communications channel, such as email, to the intended recipient for decoding. The recipient must decode the stego object in order for them to view the secret information. The decoding process is simply the reverse of the encoding process. It is the extraction of secret data from a stego object. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Visible watermarking/ masking Usually restricted to 24-bit and gray-scale images Steganography conceals information; watermarks extend information and become an attribute of the cover image Images not prone to destruction due to lossy compression as they are more integrated into the image as it hides data in more integral area than just hiding in “noise” level. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Algorithms and frequency transformations Fourier transform - Stores message in image using 2D-FFT of the image - Rings closest to the axis represent low frequencies of the image and those furthest represent high frequencies. - Message is converted into bits which are overlaid in a ring shape in the desired frequency band on the 2D-FFT. - Image encoded by this method can better withstand noise, compression, translation and rotation than images encoded by LSB method Discrete Cosine Transformation - LSB cannot be used with JPEG compression or any image transformation - DCT algorithm is one of the main components of Jpeg compression - Technique in which data is hidden in the image according to the local characteristics of the image. - Hides more data in the high frequency image components 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences DCT Algorithm First the image is split up into 8 x 8 squares.   2. Next each of these squares is transformed via a DCT, which outputs a multi dimensional array of 63 coefficients. 3. A quantizer rounds each of these coefficients, which essentially is the compression stage as this is where data is lost. 4. Small unimportant coefficients are rounded to 0 while larger ones lose some of their precision. 5. At this stage you should have an array of streamlined coefficients, which are further compressed via a Huffman encoding scheme or similar. 6. Decompression is done via an inverse DCT. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences DCT - One technique that uses DCT hides data in the quantizer stage - If you wish to encode the bit value 0 in a specific 8 x 8 square of pixels, you can do this by making sure all the coefficients are even - Bit value 1 can be stored by tweaking the coefficients to make them odd. In this way a large image can store some data that is quite difficult to detect in comparison to the LSB method. Evaluation of DCT -Flexible as the amount of data to be embedded need not be fixed There is greater undetectibility as the hidden data is distributed more evenly over the whole image to make it more robust. It is vulnerable to noise. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Audio Steganography -Human Auditory system operates over wide range of dynamic frequencies but is poor with regards to its differential range. -loud sound masks the softer one. Ways to hide data in audio Low bit encoding replaces LSB of data in each sampling point with a coded binary string Phase encoding substitutes the phase of an initial audio segment with a reference to the phase that represents the data. -the phase of subsequent segments is adjusted in order to preserve the relative phase between segments -more complicated than low-bit 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Ways to hide data in audio Spread spectrum spreads the encoded data across as much of the frequency spectrum as possible. - Data is encoded as a binary sequence which sounds like noise but which can be recognised by a receiver with the correct key. - Spread spectrum techniques can be used for watermarking by matching the narrow bandwidth of the embedded data to the large bandwidth of the medium. - Makes it difficult for an adversary to reconstruct the pseudo random signal used to spread data across freq range 4. Echo data hiding embeds data into a host signal by introducing an echo. The data are hidden by varying 3 parameters of echo: initial amplitude Decay rate offset - The echo blends as the echo between the original and the echo decreases. The echo is perceived as the original sound. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences MP3stego -Principle: audio signal contains significant redundant info that can be discarded without average listener noticing the change -This technique is similar to frequency transformation but the data is stored as the MP3 file is created, that is during compression -ISO MPEG layer 3 standard uses 2 nested iteration loops -Inner loop is a rate loop and outer loop is a noise control/distortion loop -As the sound file is being compressed during the Layer 3 encoding process, data is selectively lost depending on the bit rate the user has specified. -The hidden data is encoded in the parity bit of this information. -As MP3 files are split up into a number of frames each with their own parity bit, a reasonable amount of information can be stored. -To retrieve the data all you need to do is uncompress the MP3 file and read the parity bits as this process is done. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Attacks Basic attacks They take advantage of limitations in the design of the embedding techniques. Simple spread spectrum techniques, for example, are able to survive amplitude distortion and noise addition but are vulnerable to timing errors. Synchronisation of the chip signal is required in order for the technique to work so adjusting the synchronisation can cause the embedded data to be lost. It is possible to alter the length of a piece of audio without changing the pitch and this can also be an effective attack on audio files. Robustness attacks - Robustness attacks attempt to diminish or remove the presence of a watermark - Although most techniques can survive a variety of transformations, they do not cope so easily with combinations of them or with random geometric distortions. - If a series of minor distortions are applied the watermark can be lost while the image remains largely unchanged.   - Protecting against these attacks can be done by anticipating which transformations pirates are likely to use. Embedding multiple copies of the mark using inverse transformations can increase the resistance to these attacks.    9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences More Attacks…. Interpretation attack - Interpretation attacks involve finding a situation in which the assertion of ownership is prevented If the owner publishes a document, d + w (where d is the original and w is the watermark) a pirate can add a second watermark w’ and claim that the document is his and that the original was d + w - w’. Implementation attack Implementation of a marking system can provide more opportunities for attack than the marking technique itself. If the mark detection software is vulnerable it may be possible for attackers to deceive it. Digimarc, one of the most widely used picture marking schemes was attacked using a weakness in the implementation. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences More Attacks… Presentation attacks Presentation attacks modify the content of the file in order to prevent the detection of the watermark. The mosaic attack takes advantage of size requirements for embedding a watermark. By splitting the marked file into small sections the mark detection can be confused. If the minimum size for embedding the mark is small enough the mosaic attack is not practical. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Limitations of Steganography With encryption, Bob is sure that he received a secret encrypted data. But with hidden data, Bob somehow needs to know that in the image received is the concealed message Undetectability: message embedded must not modify the container object. This gets tough in compressed files where many of the obvious candidates for embedding data are lost. 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences Conclusion As steganography becomes more widely used in computing there are issues that need to be resolved. Many currently used techniques are not robust enough to prevent detection and removal of embedded data. For a system to be considered robust, it should have the following properties: The quality of the media should not noticeably degrade upon addition of a mark. Marks should be undetectable without secret knowledge, typically the key If multiple marks are present they should not interfere with each other 9/20/2018 Department of Computer and Information Sciences

Department of Computer and Information Sciences References “ Exploring Steganography: Seeing the Unseen”, technical paper by Neil F. Johnson and Sushil Jajodia www.cs.bham.ac.uk/~mdr/teaching/ modules03/security/students/SS5/Steganography.htm S. Katzenbeisser and F. A. P. Petitcolas, editors. Information Hiding Techniques for Steganography and Digital Watermarking. Artech House, 2000. Hiding Secrets with Steganography by Dru Lavigne http://www.wired.com/news/politics/0,1283,41658,00.html Image Steganography for Hidden Communication Lisa M. Marvel; ARMY RESEARCH LAB ABERDEEN http://www.stormingmedia.us/77/7727/A772773.html Hiding Text in MP3 Files Mark Noto http://www.sans.org/rr/whitepapers/stenganography/550.php 9/20/2018 Department of Computer and Information Sciences