Introduction to Modern Steganography

This article introduces steganography and explains some of its techniques and methods supported by examples. My objective was to make this post as short as possible while covering all important information. Your comments are welcome for any possible enhancements or for future articles about steganography by me or other people.

Steganography

Steganography is all the techniques used to exchange secret messages without drawing attention. It is the science of hiding information.

Some of the old school methods to hide information are: invisible ink, null ciphers, microdots or the use of pinpricks, deliberate misspelling or slightly different font to mark certain words in messages and maps.

Null cipher

It’s a normal text written in the clear, but includes a hidden message. For example:

"Fishing freshwater bends and saltwater coasts rewards anyone feeling stressed. Resourceful anglers usually find masterful leapers fun and admit swordfish rank overwhelming anyday." [2]

If we take out the third letter in each word, we get: Send Lawyers, Guns, and Money.


Modern steganography refers to hiding information in digital images, audio files or even video. There are many methods and tools to do that. Nevertheless, and to have double protection, secret messages are first encrypted and then hidden using a steganography tool.

The steganographic process can be described with the following formula:

Cover medium + Data to hide + Stego key* = Stego Medium

* Note that if no encryption is added, there is no need for a Stego key.


Hiding messages in pictures

This is usually done by:

1. LSB (Least Significant Bit insertion).
2. Masking & filtering.
3. Algorithms & transformations.

Using LSB is famous, so I will choose it to explain how data can be hidden in images.

LSB is always the last bit on the right-hand side of any binary number. Changing this bit causes the least possible effect to the original value.

In a 24-bit image, there are 3 bytes of data to represent RGB values for every pixel in that image. This implies that we can store/hide 3 bits in every pixel. For example, if the image

has the following bits:

10010101 00001101 11001001
10010110 00001111 11001010
10011111 00010000 11001011

To store 101101101. we replace with the original LSBs like this:

10010101 00001100 11001001
10010111 00001110 11001011
10011111 00010000 11001011

To reveal the stored message, the LSBs are extracted alone from the Stego Medium and combined together.


Hiding messages in audio files

Two known methods to store message in audio files are: Frequency Domain and Time Domain.

In Frequency Domain, a message can be stored in practically unused frequencies of audio files. For instance, In a CD where the sample rate is 44.1 kHz, the highest frequency without aliasing is 22.05 kHz.

Now, because the average peak frequency that an adult can hear is approximately 18 kHz, this leaves 4 kHz of frequency that is "practically unused". This space can then be used to hide a message (a copyright message for example).

In Time Domain, a message can be stored in the LSBs, something similar to what we saw with images. To maintain CD quality, it is important to encode at 16 bits per sample at a rate of 44.1kHz. However, we can also record at 8 bits per sample using the high significant bits (first bits on your left-hand side) and save the other 4 LSBs to hide our message without making any perceptible change to the audio quality.

In a comparison between the two, detecting messages hidden with time domain is harder because it requires more resources. [4]


Watermarking (digital watermarking)

Whenever there is a topic about steganography now a day, Digital Watermarking is also mentioned. It refers to embedding hidden messages as well, but not for the purpose of sending secret information. Instead, Watermarking is usually used for the following:

1. Copyright protection: include ownership information.
2. Copy protection: include instructions to stop data copying devices from making and distributing copies of the original.
3. Prove data authenticity.
4. Tracking: If copies of a file are distributed illegally, the source can be revealed if the master copies had unique watermarks included.


Stego Tools

The following freeware tools have been tested by me on Windows 7 and they work great:

1. 4t HIT Mail Privacy LITE 1.01
2. S-Tools 4.0

To find more tools (commercials and freeware) make use of the following lists as they are the best I found online or do your own googling:


1.http://home.comcast.net/~ebm.md/stego/software.html
2.http://www.jjtc.com/Security/stegtools.htm


Steganalyses and countermeasures

Steganalyses aim to investigate suspected information to determine whether they include any sealed data and reveal the hidden message if exist.

Any unusual patterns (visual or statistical) are usually analyzed to detect suspected information. Hence, any method can be useful, for instance, image editors and hex editors (e.g. HEX Workshop).

Some methods are designed and developed to detect and reveal information hidden by known steganography tools. There are also enhanced and powerful digital forensic analysis

tools such as StegAlyzerSS (Steganography Analyzer Signature Scanner) developed by the Steganography Analysis and Research Center [5].


Conclusion note

The references at the end of this article are quite informative, have a go on them in your free time if you are looking for more details.


References

[1] Introduction to Steganography. [cited 2010 Jan 08]; Available from: http://www.infosyssec.com/infosyssec/Steganography/menu.htm

[2] Johnson, N. F., Duric, Z., Jajodia, S. Information Hiding: Steganography and Watermarking - Attacks and Countermeasures. Kluwer Academic Press. Norwrll, MA, New York, The

Hague, London, 2000.

[3] Gary C. Kessler. Steganography: Hiding Data Within Data. 2001 [cited 2010 Jan 08]; Available from: http://www.garykessler.net/library/steganography.html

[4] Steganography in Signals. [cited 2010 Jan 09]; Available from: http://www.owlnet.rice.edu/~elec301/Projects01/smokey_steg/steg.html

[5] Steganography Analyzer Signature Scanner. [cited 2010 Jan 09]; Available from: http://www.sarc-wv.com/stegalyzerss.aspx

SSH Tunneling

This is a quick blog post to let my mate Ollie know about a few ways that I use SSH and how it is useful.

Firstly, a SSH client connects to a SSH server, logs in with either a password or certificate and communicates over an encrypted tunnel. The beauty of SSH is that it is also easy to tunnel other types of traffic such as HTTP or VNC over the tunnel. This is useful for the following:

> Secure Administration of a remote server.
> Secure File transfer.
> Securing web traffic over a non-secure wired or wireless network.
> Bypassing of restrictions and filtering imposed on the local network.


Tools

> Privoxy
> SSH
> Screen


Setup

At home I have installed SSH on a server and started the service (/etc/init.d/ssh start) listening on port 22 for SSH traffic. I have set port forwarding up on my firewall to allow traffic to hit the server on this port. Usually I will set up a non-standard port but for the sake of an easy explanation I'll leave it at port 22.

On that server I have also installed pivoxy (apt-get install privoxy), and started it (/etc/init.d/privoxy start). By default, Privoxy binds to 127.0.0.1:8118 , and I have also installed Screen. Screen is a program that allows you to have multiple terminal sessions open at once and leave them running after disconnecting from the SSH server.


Connecting To The Server

From my client I connect to the server by using the following command:

ssh synjunkie@ssh_server_ipaddress


After logging in I can issue commands as if I'm sitting at the server. After connecting I would start Screen by issuing the `screen` command. If I wanted to connect to a previous screen session I would use `screen -r`

You navigate through Screen by issuing commands through key-bindings. A few of the ones I find most useful are:

Ctrl+a c new window
Ctrl+a n next window
Ctrl+a p previous window
Ctrl+a " select window from list
Ctrl+a A set window title
Ctrl+a ? show key bindings/command names
Ctrl+a d detach screen from terminal

Screen is great because you can leave a scan going in one session, irc in another and say a traffic capture in another.


Tunneling Traffic

as well as connecting to the server I might want to tunnel some traffic over SSH to my home server and then back out.

For this I would issue the following command on my client and log in.

ssh -NL 8118:localhost:8118 synjunkie@ssh_server_ipaddress

After setting up the tunnel I would go into the proxy settings on my browser and point them to localhost port 8118.


I hope this illustrates a couple of good uses for SSH.