Printable View
I have a problem regarding Steganographi.
When I have transfered a message hidden in a list, the message will not contain any small letters. What is the purpose to not code small and capital letters when I want to hide message in a list?
Is there any occasion when this method is not suitable?
:)
The title was a little misleading, I thought I would learn something about stenography. As for steno, look it up. I have never tried it, but it looks cool. However, in the end google knows all if someone here does not know :)
-Cheers-
So you actually mean stenography right? Stegonaraphy is basically hiding data in plain sight, like hidden data in a picture or something.
Steganography (I never could really spell it right I think so bear with me) is the art of hiding messages/files within images, movies, etc. As sysmin770 said they are hidden in plain sight but I believe you need a special key to view the hidden code or message. Correct me if I'm wrong here because I'm far from an expert on this topic.
I was looking on Google for a site that would give some good explanation to at least begin learning about Steganography. I liked this one the best: http://www.securityfocus.com/infocus/1684
I hoped this helped you out at least a little bit!
Steganography is hiding text or code within something else- usually a graphic image so that it is undetected. I recommend you read Hiding In Plain Sight by Eric Cole if you want to learn more about it. It also comes with some tools on the CD that you can play with. Files containing hidden steganography messages are virtually undetectable.
Here is a link to my review of Hiding In Plain Sight
Now I had thought that was true too.. until I read today groovicus's tut entitled "Windows Forensics-Where to look-What to use" found hereQuote:
Originally posted here by tonybradley
Files containing hidden steganography messages are virtually undetectable.
in that tut, groovicus mentions a tool called Stegdetect:
Capable of detecting several different steganographic methods to embed hidden information in JPEG images.
you can find more about Stegdetect here
Currently, the detectable schemes are
jsteg,
jphide (unix and windows),
invisible secrets,
outguess 01.3b,
F5 (header analysis),
appendX and camouflage.
heh.. not one month ago, I had told a friend about camouflage.. insisting it couldn't be detected.
WELL.. I guess I was wrong.. you learn something new everyday.. (thx, groovicus)
True. In fact, Hiding In Plain Sight also includes some of those tools. One "issue" though has been that you would first need to know what tool was used to hide the data in order to detect and unhide it.
So, I mis-spoke a little. There are tools that will detect hidden data, but only if you know what tool was used to hide the data in the first place. You could use a tool across a broad range of files and just randomly stumble onto hidden data. Or, if you had reason to believe a specific person may have hidden data you could just run every steg detection tool you can find in hopes that you stumble onto the one that detects whatever was used to hide the data.
Either event is sort of a shot in the dark though. The hidden data still remains "virtually" undetectable right now. As long as you have no reason to suspect I would embed data in a graphic, you wouldn't be scanning it with jsteg or any other tools to begin with.
An extra measure of security would be to also encrypt the file. If I first encrypt the file and then hide it with stego I have double protection. Even if someone accidentally stumbles onto the fact that there is embedded data they won't be able to open and view it.
But by encrypting the file, you're tipping me off that there is something unusual about that particular file that warrants attention. And if (when ) I decrypt the file, I'll definately know somethings up when it just turns out to be a picture of your dog, or something equally mundane.
Stego is by it's nature designed to hide stuff right in the open. Back in world war I or II, information used to be stored on microdots, and hidden on a period at the end of the sentence...
All software installed leaves traces, even applications that run from floppy sometimes "hook" into windows api calls and leave traces....
Even though stego detection is still in it's infancy , relativiely speaking, programmers are working hard to find common traits among stego tools, and they eventually will have apps to find it. I was reading an article (sorry, don't remember where) about using a variant of an electron scanner to look at files, and finding holes in it that could contain data. It did so by making sort of a 3-d "map"...hmmm...I'll have to see if I can remember where I read that....
I agree with you- but that isn't what I said....or at least not what I meant.
I am not saying to hide your embedded stego data in a JPG and then encrypt the JPG. As you suggest that would fairly nullify the biggest advantage of stego- secrecy. Someone would see an encrypted file and have a burning desire to crack into it and would assume stego when it turned out to be a JPG.
However, what I was suggesting is that you encrypt your data file first- then embed the encrypted file. The stego JPG would still be secret. Nobody would know just by looking that it contained data. However, if by chance someone used a tool and discovered that the JPG contained data they would still need to ALSO crack the encryption on the embedded file.
hmm..gotcha...I was looking at it in reverse.... :dunce:
I'll go drink my big cup of "shut the hell up and pay attention" ::coffee::
EDIT: Now I'm going have to take a peek at some stego tools. I'm thinking it would be useless to use a program that encrypts and hides your data, 'cause once you know the tool used, your screwed.
And I'm wondering if it scatters the data in random locations, or if it puts it in a string...Thanks Tony..got my brain all fired up already this morning!!
Okay, the thread wasn't about what stenograpy is, it was about a useage of it.
Lotta> The problem is whatever program you are using to do the code. You are most likely using some cheep program that is only used to demo what you can do with steno... A real program will not only allow both small and capital characters, it breaks up those characters so that they are stored in more then 1 spot.
Steganongraphy might not always be the most secure way to hide your data. It optimizes amount of embedded information while not particularly caring for security. So the stegdetect could identify an image which potentially contains your hidden data which is half the work to finding what is hidden.
If you have something that you want kept with even more secrecy, might want to try watermarking. Watermarking trades off amount of hidden data for secrecy and imperceptibility. So you cannot embedd as much but what you embedd is much(orders of magnitude) more secure. This is because data is embedded in a robust way and is more tightly coupled with content data (pixel information or audio samples). For instance steganography aproach might be to flip LSB of pixel data according to message to be hidden. Thats easy to analyze. Watermaking spreads bits of information across only significant pixel data in a more robust way. Significance of data is determined by watermark algorithm which can sometimes incorporate spread spectrum techniques, or perceptual entropy of pixels values or audio samples. This makes it hard to analyze.
There is a good discussion about both steganography and watermarking, which are sort of sister sciences, on watermarking forum.
http://www.watermarkingworld.org/WMM.../msg00018.html
You can imagine the million ways on how this can be used (good and bad).Quote:
Steganography is the art and science of hidden communication.
I first came across steganography by a newletter... i had never even heard about it, but anyways i'll provide you the links to Infopackets explanation on the subject. Very user friendly talk, easy to understand:
Part 1: http://www.infopackets.com/gazette/20031125.htm
Part 2: http://www.infopackets.com/gazette/20031127.htm
Part 3: http://www.infopackets.com/gazette/20031204.htm
Go ahead, give it a look.
Where is slarty? Reading his stuff, you can see some good ideas on stegnography.
(BTW, I'm no expert on this subject, but I try to study it in my free time) To truely hide your data, you need to have the only copy of the original file you are hiding the encrpyted data in. If anyone else has an original copy without anything hidden in it, sooner or later someone will realize that while a file they found somewhere looks similar, but it isn't 1:1...
The reason the original poster's program is converting it into single case is because it helps make it easier to "hide" the data, I assume. Although I'm not exactly sure how it would figure your message out from only lowercase characters without a key or anything that it generates for you, etc... Anyways, if you are reading someone's shopping list with randomly capitalized characters, it would seem odd... (Ok, the example below is a bit exagerrated)
What would you think the secret message is? MEET ME AT ONE!Quote:
Tim_axe's Shopping List:
1. one carton of Milk
2. five swEEt Tarts
3. sixteen ounces of MEat
4. ten heAlTh bars
5. sOme Natural pEas
Since you know that my shopping list should be all lower-case, because those words shouldn't be capitalized like they are, you know what the original data it, and you would be drawn to the things that don't belong. Same with cryptography in JPEG images, or anything else. A while back I took an image and played with the contrast and color balance to show that the "white" section of an image wasn't really white. Although I couldn't determine the message, I knew that something was up since it wasn't white when it should have been. (Search the Cryptography forums for that thread)
phorvati - I think water marking is a bit different since it is meant to be detected, or withstand torture of resizing, recompression, etc. A good watermark would be right through the middle of an image with your website name on it in bold black letters, although most people want ones that are more difficult to detect or not as unsightly. The watermark is designed to protect your work of art from being claimed by someone else (stealing your hard work). Not necessarially hide encrypted data, though it could hold it's ID number in a database of a company that manages such things I think. A tutorial on securing your images for websites was posted in tutorials or webdesign a while back, and even featured elsewhere on Internet.com. The author knows more about it than I do. (I forgot who wrote it though :( )
Hopefully this explains a little bit about stegnography or explains why your list is all lowercase...?
-Tim_axe
Yes comparing the two images 1:1 they look diferent. But the difference could have come from re-compression to a lower bitrate, printing/scanning or some other modification.
And if the difference came from stego or watermark type of information added to the image, then taking the difference would reveil hidden information in one of its forms. Even the cyphertext has a defined alphabet. So analyzing the hidden information will reviel steganographic information(encrypted or not) faster than a secret watermark information could be extracted.
So if I want to send you some important info, such as CC# or anything that I absolutely don't want revieled, I would rather go with a mp3 watermarking algorithm than the mp3-stego. Because mp3-stego alters LSB. And thats easy to analyze. Watermarking might put a bit in every frame of mp3 where stego puts in a lot more, but my priority is security, and not the amount of embedded data.
So although you hear about watermarking for preventing copyright violations, watermarking can also be utilized in many other applications. The important aspect is that its more secure, and survives intentional removal and discovery of information.
I was watching nbc news last night, and they had a report on this picture of niagara falls on an al qaeda website. The website showed all kinds of pictures of locations that were taken before a terrorist event happened. So like, the twin towers still standing was an example. Then at the end of the list, there was a picture of Niagara falls, and they said that there hasn't been a terrorist even there yet, and it could be some kind of signal. They also said that they had reason to believe that the picture had an encoded message on it. They didn't say steganography, but it sounded a whole lot like it. I havent been able to find the pic, I think its on some al qaeda website and im afraid to go looking through them, but if anybody knows what I'm talking about, or knows where that pic of niagara falls is, it would be pretty cool if someone could post it and we could try to crack it or something. It's a pretty good example of what stegangoagoagnraphy is for.
tonybradley's idea is the same as my project [well, an extended essay for which I will need to code some tools for]. basicaly, taking the data - string or whatever - and encrypting it using one of the strong algorithms out there, then hiding the block in a file. like this you have protection by crypto [passphrased and hard-crypted], by stegano [picture embedding] and by obscurity [which is the very principle of stegano anyway].
as for Lotta's question, if what you are saying is that you can only use capital letters for your string, I think that's a software issue rather then a limitation with steganography. of course, please correct me if I'm wrong, but otherwise you should ckeck-out other tools.