Steganography tools

Last updated
Steganography architecture example - OpenPuff OpenPuff arch1.jpg
Steganography architecture example - OpenPuff

A steganography software tool allows a user to embed hidden data inside a carrier file, such as an image or video, and later extract that data.

Contents

It is not necessary to conceal the message in the original file at all. Thus, it is not necessary to modify the original file and thus, it is difficult to detect anything. If a given section is subjected to successive bitwise manipulation to generate the cyphertext, then there is no evidence in the original file to show that it is being used to encrypt a file.

Architecture

Obfuscation layer1 - cryptography OpenPuff arch10.jpg
Obfuscation layer1 - cryptography

Carrier

The carrier is the signal, stream, or data file into which the hidden data is hidden by making subtle modifications. Examples include audio files, image files, documents, and executable files. In practice, the carrier should look and work the same as the original unmodified carrier, and should appear benign to anyone inspecting it.

Certain properties can raise suspicion that a file is carrying hidden data:

Obfuscation layer3 - whitening OpenPuff arch12.jpg
Obfuscation layer3 - whitening

It is a cryptographic requirement that the carrier (e.g. photo) is original, not a copy of something publicly available (e.g., downloaded). This is because the publicly available source data could be compared against the version with a hidden message embedded.

There is a weaker requirement that the embedded message not change the carrier's statistics (or other metrics) such that the presence of a message is detectable. For instance, if the least-significant-bits of the red camera-pixel channel of an image has a Gaussian distribution given a constant colored field, simple image steganography which produces a random distribution of these bits could allow discrimination of stego images from unchanged ones.

The sheer volume of modern (ca 2014) and inane high-bandwidth media (e.g., youtube.com, bittorrent sources. eBay, Facebook, spam, etc.) provides ample opportunity for covert information±.

Chain

Hidden data may be split among a set of files, producing a carrier chain, which has the property that all the carriers must be available, unmodified, and processed in the correct order in order to retrieve the hidden data. This additional security feature usually is achieved by:

Obfuscation layer4 - encoding OpenPuff arch13.jpg
Obfuscation layer4 - encoding

Robustness and cryptography

Steganography tools aim to ensure robustness against modern forensic methods, such as statistical steganalysis. Such robustness may be achieved by a balanced mix of:

If the data is detected, cryptography also helps to minimize the resulting damage, since the data is not exposed, only the fact that a secret was transmitted. The sender may be forced to decrypt the data once it is discovered, but deniable encryption can be leveraged to make the decrypted data appear benign.

Strong steganography software relies on a multi-layered architecture with a deep, documented obfuscation process.

Chi-square image steganalysis Steganalysis.jpg
Chi-square image steganalysis

Carrier engine

The carrier engine is the core of any steganography tool. Different file formats are modified in different ways, in order to covertly insert hidden data inside them. Processing algorithms include:

See also

Articles

Related Research Articles

Steganography is the practice of representing information within another message or physical object, in such a manner that the presence of the information is not evident to human inspection. In computing/electronic contexts, a computer file, message, image, or video is concealed within another file, message, image, or video. The word steganography comes from Greek steganographia, which combines the words steganós, meaning "covered or concealed", and -graphia meaning "writing".

In computer security, a covert channel is a type of attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy. The term, originated in 1973 by Butler Lampson, is defined as channels "not intended for information transfer at all, such as the service program's effect on system load," to distinguish it from legitimate channels that are subjected to access controls by COMPUSEC.

Articles related to cryptography include:

Steganalysis is the study of detecting messages hidden using steganography; this is analogous to cryptanalysis applied to cryptography.

In cryptography and steganography, plausibly deniable encryption describes encryption techniques where the existence of an encrypted file or message is deniable in the sense that an adversary cannot prove that the plaintext data exists.

A digital watermark is a kind of marker covertly embedded in a noise-tolerant signal such as audio, video or image data. It is typically used to identify ownership of the copyright of such signal. "Watermarking" is the process of hiding digital information in a carrier signal; the hidden information should, but does not need to, contain a relation to the carrier signal. Digital watermarks may be used to verify the authenticity or integrity of the carrier signal or to show the identity of its owners. It is prominently used for tracing copyright infringements and for banknote authentication.

Disk encryption software is computer security software that protects the confidentiality of data stored on computer media by using disk encryption.

<span class="mw-page-title-main">Tradecraft</span> Espionage techniques

Tradecraft, within the intelligence community, refers to the techniques, methods and technologies used in modern espionage (spying) and generally, as part of the activity of intelligence assessment. This includes general topics or techniques, or the specific techniques of a nation or organization.

The OpenBSD operating system focuses on security and the development of security features. According to author Michael W. Lucas, OpenBSD "is widely regarded as the most secure operating system available anywhere, under any licensing terms."

Anti-computer forensics or counter-forensics are techniques used to obstruct forensic analysis.

StegoShare is a steganography tool that allows embedding of large files into multiple images. It may be used for anonymous file sharing.

There are various implementations of the Advanced Encryption Standard, also known as Rijndael.

<span class="mw-page-title-main">OpenPuff</span>

OpenPuff Steganography and Watermarking, sometimes abbreviated OpenPuff or Puff, is a free steganography tool for Microsoft Windows created by Cosimo Oliboni and still maintained as independent software. The program is notable for being the first steganography tool that:

BPCS-steganography is a type of digital steganography.

<span class="mw-page-title-main">Niels Provos</span> German-American computer scientist and software engineer

Niels Provos is a German-American researcher in security engineering, malware, and cryptography. He received a PhD in computer science from the University of Michigan. From 2003 to 2018, he worked at Google as a Distinguished Engineer on security for Google Cloud Platform. In 2018, he left Google to join Stripe as its new head of security.

crypt is a POSIX C library function. It is typically used to compute the hash of user account passwords. The function outputs a text string which also encodes the salt, and identifies the hash algorithm used. This output string forms a password record, which is usually stored in a text file.

This is a list of cybersecurity information technology. Cybersecurity is security as it is applied to information technology. This includes all technology that stores, manipulates, or moves data, such as computers, data networks, and all devices connected to or included in networks, such as routers and switches. All information technology devices and facilities need to be secured against intrusion, unauthorized use, and vandalism. Additionally, the users of information technology should be protected from theft of assets, extortion, identity theft, loss of privacy and confidentiality of personal information, malicious mischief, damage to equipment, business process compromise, and the general activity of cybercriminals. The public should be protected against acts of cyberterrorism, such as the compromise or loss of the electric power grid.

OutGuess is a steganographic software for hiding data in the most redundant content data bits of existing (media) files. It has handlers for image files in the common Netpbm and JPEG formats, so it can, for example, specifically alter the frequency coefficients of JPEG files. It is written in C and published as Free Software under the terms of the old BSD license. It has been tested on a variety of Unix-like operating systems and is included in the standard software repositories of the popular Linux distributions Debian and Arch Linux and their derivatives.

References