Steganography Part 2 – Detection and Research

Introduction to Steganalysis What is steganalysis?  The art of detecting messages hidden by steganography  Alternatively, detection of Steganography by a third party  Research and analysis of steganography tools to develop detection methods

Introduction to Steganalysis Why is it important to Computer Forensics?  Steganography allows a person to hide information in a non-obvious way, so potentially tough to find evidence. Harder to spot steganography than encryption.  Steganography is tough to detect. You need a tool to help you.  Time intensive to check images etc for steganography. Need help to narrow down the search

Detection Methods Human Methods  Manually look at the file Extremely hard to detect steg with sight or hearing Looking for anomalies in image or with sound  Only possible when the hidden message is large compared to the carrier.  Look for anomalies in file size etc  All human methods are very time intensive and not reliable.

Detection Methods Computer Forensic Methods  We can use CF techniques to help find evidence of steg usage  Search for evidence of steganography tools Use a tool like EnCase to look for deleted programs Look in start menu's Look for remnants of steg tools in registry  If we can find a tool then we know what steganalysis to run Detection is typically different for each steg tool so we want to reduce the number of steg tools we scan for in our images, mp3s, etc.

Detection Programs Use a specialized tool  Much like a virus scanner Scans disk looking at files for steg “signatures” Can search based on for a specific tool's signature Freeware/Opensource tool  Stegdetect Can detect and crack various JPEG based steg tools  Such as JPHide, Outguess, F5, etc Commerical Products  StegoSuite by Wetstone  StegAnalyzer by SARC

Demo of Stegdetect Command line tool  Usage: stegdetect  Options -q only report images that have steg content -s change the sensitivity of detection -t select which tools to search for  Any combination of j, o, p, i.  j = JSteg, o = OutGuess, p = JPHide, i = Invisible Secrets  Example: stegdetect -q -t jp *.jpg Search all jpeg's in current directory for usage of Jsteg and JPHide and report only those that do have steg.

Detection Tools Blind Steganography Detection  When you don't know the steg tool used. Might even be a steg tool thats not widely known about  Involves statistical techniques Expected values of image compared to actual  File size, noise levels  Chi-Square tests on distribution of DCT values DCT values in a non-steg match a distribution curve Modified DCT values don't fit this curve May give false positives, or false negatives Some steg tools purposely avoid these statistical detection techniques by adjusting other values to fool the Chi-Square test.

Detection Tools Blind Steganography Detection Con't  Once a file is flagged as being steg'd we need to extract the hidden message.  May need to break a password or encryption JPHide uses a password to control how it modifies the JPEG, therefore we need to know the password in order to extract the image. Contained message may be encrypted.  Might have to use brute force to break Can be extremely time consuming for complex passwords.

Steganography Research Finding new ways of detecting steg  Improving blind detection methods Genetic algorithms  Self modifying algorithm  Adapts to find optimal solution In this case, optimal detection of steg Artificial intelligence  Support Vector Machines Consists of classifying an image, steg or non-steg Composed of a feature vector Specific sections or statistics of an image to look at SVM is trained on a series of steg and non-steg images along with its feature vector and learns how to detect steg to a high percentage.

Steganography Research Also finding new ways of steg'ing files MPEG, PNG, etc Tells us if we need to be concerned with steg in certain files Important in order to adapt our practices of what or what not to search for in an investigation.

Steganography Research URI Steganography Research Group  Received a NIJ grant to create a steg detection tool  Combines own SVM along with commercial detection software  Provides a single toolchain to analyze, break, and report. Gives a single interface to forensic examiners Easily extendable to new tools, new file formats without examiner having to learn new tool/technique. Allows examiner to submit files to be checked and allows them to continue their examination.