1. Digital Steganography
Jared Schmidt

2. In This Presentation… Digital Steganography Common Methods in Images
Network Steganography
Uses
Steganalysis
Detecting steganography
OpenPuff Demo
Conclusion / Questions

3. Digital Steganography
The art of hiding data in a file so that only the sender and intended recipient suspect the presence of hidden data
A form of security through obscurity
Very easy to accomplish
Harder to detect and decrypt
BMP, JPG, TXT, HTML/XML, PDF, PNG,
GIF, AU, WAV, MP3, AVI, TIF, TGA, DLL,
EXE

4. LSB Method Most common form of digital steganography
In a RGB image, Information is hidden in the LSB[s] of the RGB values of each pixel
In a 24-bit bitmap, each pixel represented by 3 bytes.
8 bits representing red value = 2^8 = 256 shades of RED
8 bits representing green value = 2^8 = 256 shades of GREEN
8 bits representing blue value = 2^8 = 256 shades of BLUE
16,777,216 possible colors
Effectively have 3-4 bits of data to hide
information in for every pixel
32bpp format contains an alpha channel
8 required for ASCII character

5. Color Perception
Changing the LSB of the Red value by 1 (in 24-bit color depth) is undetectable by the human eye.
Nokia 808 PureView:
41 megapixel camera phone.
41 megapixels / (3 pixels/byte) = 13.66MB of data can be hidden in a single image.

6. JPEG Steganography Most common image format Lossy compression
Uses type-II DCT to achieve compression.
Neighboring pixels typically have similar color values.
Information less important to human eye (sharp transitions in brightness, color hue) is discarded
Steganographic methods work by manipulating rounding in the DCT coefficient matrix of a JPEG file

7. JPEG Encoding/Decoding Process

8. Comparison of JPEG Compression
A blocking effect occurs with higher compression creating “artifacts”
Higher quality Lower Quality

9. Network Steganography
Modifying network packet’s header or payload
In TCP/IP networks, unused bits in the IP and TCP header may be used
Packet based length steganography
Manipulation of the MTU (Maximum Transmission Unit)
VoIP - Lost Audio Packets Steganographic Method (LACK)
Transmitter intentionally delays packets by an “excessive” amount of time.
Payload of these lost packets contains the secret information

10. Open Source Steganography Tools
Uses
Individuals or organizations storing sensitive information in steganographic carriers.
Layered encryption / decoy data
Digital watermarking to verify intellectual ownership or authenticity
Open Source Steganography Tools
OpenPuff, S-Tools

11. Illegitimate Uses Terrorist Organizations
Easy form of covert communication
May 16, 2012 – Over 100 Al-Qaeda training manuals and detailed future plots discovered in a porn video found on an operative’s flash drive.
Stealing/transmitting confidential data or corporate plans

12. Finding Steganography on the Web
Provos and Honeyman, researchers at the University of Michingan, conducted a scan of 2 million Ebay images and 1 million USENET images in 2001 and found no suspect images.
UN report title “Use of Internet for Terrorist Purposes”
Members of a Colombian guerilla group found communicating using steganographic spam s

13. Steganalysis Analyzing images for possible hidden data
Many algorithms perform a statistical analysis to detect anomalies in the cover object
E.g. repetitive patterns could indicate use of a steganography tool or hidden message
Investigating pixel “neighborhoods” to find inconsistencies with ways files are compressed.

14. Problems with Detecting Steganography
Impractical to actively scan all internet content for steganography
Data is likely encrypted
Data can be hidden in certain parts of image or scattered based on a random seed
Messages can be hidden in chains of files
Can be hidden in several files using different techniques for each
Time consuming

15. Cover and Stego Image Comparison
Original Image (cover)
Stego Image (with hidden data)

16. Conclusion How digital steganography is achieved Images, audio, video
Network methods (manipulation of packets)
Uses of Steganography
Legitimate / Illegitimate
How it can be detected
Challenges with detection
Questions?