Steganography and Steganalysis

1. Steganographyand Steganalysis Merrill Warkentin, Mark B. Schmidt and Ernst Bekkering Long Presentation by Subhash Uppalapati.

2. Outline • Steganography (ste-g&n-o´gr&-fē) • Steganography Techniques • Steganalysis

3. Steganography • Steganography is the science of hiding information. • Process cover_medium + hidden_data + stego_key = stego_medium Cover Medium: Cover in which we will hide the hidden data, which may also be encrypted using stego key. Hidden Data: Data which needs to be concealed while sharing Stego Key: Encryption key of the hidden data Stego Medium: Resultant file

4. Ways to hide information • Tattoo on shaved head of slave’s and allow the hair to grow • World War II saw new ways like using milk, fruit juice or even urine. • Heating the source document • Water marking • Al Qaeda hiding maps and photographs • It is believed(not proved) that terrorists used steganography for 09/11 attacks.

5. Steganography Today • Not necessary to encrypt message like Cryptography • Conceal the fact of message existence • Using audio visuals

6. Technique 1 R G B • Least Significant bit insertion • Suppose want to hide 101101101

7. Technique 2 • http://www.spammimic.com/ • Spam • Pretty Good Privacy(PGP)

8. Technique 3 • S-Tools • Story from the book: Guy from Bull Run Investment and his Girl Friend • http://www.cs.vu.nl/~ast/books/mos2/zebras.html

9. Steganography Tools

10. Steganalysis • “Steganalysis is the art and science of detecting messages hidden using steganography; this is analogous to cryptanalysis applied to cryptography”. (wikipedia)

11. Challenges of Steganalysis • The suspect information exchange medium like audiovisuals may or may not have hidden data encoded in them. • The concealed data might be encrypted before hiding into the audiovisual. • The suspect signal can contain noise or irrelevant data to make the process time consuming • Without full recover, decrypt and inspection of the concealed data, one cannot be sure of the existence of secret information

12. Types of Attacks Categorized based on the information available to Steganalysts. • Steganography-only attack: If only the medium of steganography is available (eg. Audio, video). • Known-carrier attack: Both media and the cover are available. • Known-message attack: If you know the hidden message. • Chosen-steganography attack: Bothe medium and tool are known.

13. Where information can be hidden? • Text: Same color for background and font, shift in word and line spacing, and general context of a page. Control+A, viewing in word processor and watch out for awkward sentence structures. • Non-Text: Graphics or media clips can contain hidden messages and links. • Links: Not underlined, change color on mouseover use tab, view source and search for HREF.

14. Contd… • Comments: Only can be viewed from the source • Structure: Browsers ignores code that is not interpretable.

15. Steganalysis Techniques • Hiding information inside electronic medium causes change of medium properties which results in some form of degradation or unusual characteristics. • Unusual Patterns: TCP/IP packets, partitions in storage devices • Visual Detection: Analyzing repetitive patterns. Comparing the original with cover image • Tools to detect Steganography: EnCase, ILook Investigator • http://www.forensics.nl/tools. for steganography resources

16. References • Enterprise Information Systems Assurance and System Security by Merrill Warkentin and Rayford Vaughn • http://www.spammimic.com/encode.cgi • http://en.wikipedia.org/wiki/Steganography • http://www.garykessler.net/library/steganography.html • http://www.jjtc.com/Steganalysis/ • http://www.infosyssec.com/infosyssec/Steganography/steganalysis.htm

17. Thank you