Steganography Ed Norris ECE /4/03

Introduction  Undetectable information hiding  Why undetectable?  The message and the communication itself must remain secret  Low-tech examples  Roman tattooing  Lemon juice

Typical Method 1. Alice and Bob agree on a secret key 2. The key uniquely determines how the message is hidden in an image 3. Alice sends the image to Bob 4. Bob, using the shared key, reveals the hidden content They must be using the same steganographic system and most likely have another shared key for the message itself

Passive Eavesdroppers  (by definition)  The stenographic system must evade detection from passive eavesdropping  Routines analyze the image / sound / data file for statistical anomalies that indicate the presence of hidden messages  This will be explored in detail

JPEGs  JPEG images are useful for steganographic systems for several reasons  Common picture encoding  Relatively simple file format  Resistant to visual attacks (unlike palette based encoding, like BMP)

JPEG Encoding 1. Transform to a luminance / chrominance color space 2. Group pixels into 8x8 blocks and transform each block with the discrete cosine transform (DCT) 3. Divide each of the 64 values by a different quantization coefficient 4. Losslessly encode and package JPEG

Visual Attack  The simplest attack; relies on a noticeable visual distortion of the image

Which one contains the first chapter of The Hunting of the Snark? Each image was 640x480 with 24-bit color. The JPEG compressed size of each is 300K and the hidden information is 15K

JSTEG  Replaces the LSB of the DCT coefficients with the message data  Does not require a shared key The nature of JPEG encoding causes modification of a single coefficient to affect all 64 values in each block. The result is not visible to the eye.

Statistical Methods  The encoded message has a random bit distribution from encryption and compression or both  Addition of the data causes changes in the inherent statistical properties of the image  Using a chi-square (Χ²) test:

JSTEG Effect on Coefficient Distribution

JSTEG Detection Since JSTEG adds information starting at the beginning of the image data file, it is straightforward to discover the message length

OutGuess  Replaces random LSBs with stego image data  Randomizer is seeded with the shared key  Previous chi-square test does not detect OutGuess images

OutGuess Detection  Modified chi-square  Sliding sample of coefficients  Sample size determined by image analysis  Nearly 100% true-positive detection rate if 25% or more of the available LSBs in the image have been used

Trained Detectors  System contains known stego and non- stego images  Nonlinear support vector machine  Can also analyze images based on similarity to groups (outdoor, people, etc)  Class discrimination

Detection Summary  The previous steganalysis methods demonstrate that simple LSB replacement can be detected  Class discrimination  Inherent statistical properties

F5  Matrix encoding of DCT coefficients  Uses a Hamming code to recover from a single bit error (per block)

K5 Pseudocode

Statistics-Aware Steganography  If the statistical stego-detection methods are known, the unused LSBs can be modified to retain the original coefficient statistics of the image  In addition, the message could be encoded as the parity of groups of DCT coefficients

Real World Detection  Media reports assert that steganography is prevalent on the Internet  JSteg  JSteg-Shell is a Windows GUI  RC4 (40-bit) encryption  JPHide  Blowfish encryption  OutGuess

Image Sources  World Wide Web – Ebay auction pictures  More than two million images  Usenet groups  One million images  Approximately two percent of images appeared to contain steganographic content using Stegbreak

Data is Detected, Now What?  Dictionary Attack  850,000 words for WWW images  1.8 million words for Usenet images  Application header information can help

Find Anything?  No

Why Not?  Passwords were all robust  All positives were false positives  The steganographic systems used were not the ones looked for  Messages were too small for detection (Stegbreak has a 50 byte minimum)

Future Steps?  Look elsewhere for candidate images  Use more hardware for password cracking  Research new information hiding and detection algorithms  (give up – no one uses steganography)

Further Study  PPM – portable pixel maps  BMP – Microsoft bitmap  WAV – Windows sound file  Matlab – Available on school computers, has built-in importers for BMP and WAV (PPM is trivial)

References  Hide and Seek: An Introduction to Steganography, IEEE Security & Privacy, May/June 2003

Questions  What is a visual attack?  The presence of steganographic content is indicated by visual distortion of an image  When / why use steganography?  When the presence of communication is a secret