gManZboy writes "Two researchers in China has taken a look at the steganography vs. steganalysis arms race. Steganography (hiding data) has drawn more attention recently, as those concerned about information security have recognized that illicit use of the technique might become a threat (to companies or even states). Researchers have thus increased study of steganalysis, the detection of embedded information."
You can actually say a lot in plaintext without actually saying openly what you mean. Aleister Crowley was a master at this. The way this works is you talk directly to those who know the context in which you are speaking and it all just looks like mere verbiage to anyone not familiar with your topic. Or you refer to your predicates in such a way that the casual observer can't tell what your final conclusion refers to. This is not steganography per se, but goes to the origins of the concept. I have done this myself and it allows you to say things you wouldn't dare say outright for fear of retribution from certain third parties.
It's also security through misdirection. (Ie: If you find someone's secret porn collection, you'll think you know why he's kept it secret. In truth it contains plans for an atom bomb.)
But your point is really what the article is about. A serious Steganography method must be good enough to pass automated searches (steganalysis) because if the enemy knows where your data is, then you almost might as well have not bothered.
And of course, what the other post said is implied.
Cryptography is also security through obscurity in that case. The only thing protecting your information is the fact that you haven't properly documented your private key:-)
The problem with "Security Through Obscurity" is that the decryption algorithm is secret. Once the algorithm is known, any message can be decrypted. Both the sender, and the receiver need to know the secret algorithm, and need to trust each other to not reveal it.
In other encryption techniques, such as Public Key Encryption, the decryption algorithm is public. The algorithm works like a box with two keyholes. One keyhole locks the box, the other unlocks it. Each person selects two keys, one is public, the other is private. If the sender wants to send a message, she locks the box with the receiver's public key. Once locked, the box can only be opened with the receiver's private key. If the Larry decides to leak his private key, it doesn't compromise the security of messages sent to other people. Heather can still send messages to Jim, using his public key, confident that the messages will remain private because they are encrypted with Jim's public key, not Larry's.
Steganography is typically used within a closed group. It is typically not used between strangers. Therefore, you don't need to publicize your steganographic protocols beyond a small group of people. Furthermore, if you take the trouble to hide your data with steganography chances are that you will also encrypt it. In this scenario, the two accomplish different goals. Steganography ensures that no-one realizes that you have communicated at all and cryptography ensures that even if the steganography is compromised, they cannot tell what it was you were sending. Steganography is gold to any mole in need of transmitting information from inside a hostile organization to his people on the outside. So long as the hostile org cannot tell that he is communicating, he is safe. Once they figure out, he is busted. Or for anyone transmitting information across an untrusted medium for that matter. If you use PGP to protect your Internet mail, the Feds are going to know that you have _something_ going on and that they might want to keep extra tabs on you. If you also use steganographic techniques, you'll never show up on their radar in the first place.
For many employers, "you are an employee" is sufficient reason to monitor your communications. This surveillance is, however, very superficial in most cases. Superficial surveillance is unlikely to spot a half-decent steganographic effort and so such is likely to offer some protection. If ever they develop the notion that you require extra special treatment, they might catch on to your hidden messages, of course (or perhaps not). If they do, then I agree they have all the more reason to suspect you of foul p
Because an encrypted stream is obviously hiding, it gives the attacker something to focus on. What a person might do instead with Steganography is embed encrypted information, so that the set of information is not only hard to detect in a field of dummy files, but that once the encrypted data is found one still has to decode it.
IANBS (I Am Not Bruce Schneier), but Strong Encryption beats steg plus encryption, based on my (limited, but relevant) practical experience.
That runs counterintuitive, so let me scratch the why/how:
Steg: it's incredibly hard to really hide stuff. If you stick data into the unimportant pixelbits of A/V data, statistical analysis of the sort of data that is created by the source (camera, scanner, etc) makes it *trivial* to detect that stuff is being hidden. The better you hide it, the more you sacrifice
However, until everyone is using strong encryption to store and send all data, steganographed encrypted data is necessary. You see, often it is just as important to hide the fact that you've got something to hide as it is to secure the data. With steganographed encrypted data, you can plausibly deny that it was you who hid the data in the first place.
IANBS (I Am Not Bruce Schneier), but Strong Encryption beats steg plus encryption, based on my (limited, but relevant) practical experience.
They shouldn't be directly compared, because steganography and encryption reach towards different goals. One conceals the fact that you're hiding information, the other protects information from someone who already knows to look for it.
In limited circumstances, each can perform the other's effect: steganography makes encryption irrelevant if they can't find the mate
Suppose you == info security guy at $Company. When you see a string of seemingly random bits in a file marked crypto.txt leaving $Company, you may not be able to find out exactly what trade secret your local friendly spy was leaking, but you do know there was a leak and who sent it.
On the other hand, if you see a load of random pictures leaving $Company from lots of employees, then you have to find which picture has hidden data in it before you even know you have a problem.
The point of steganography isn't to pass a message that can't be read, it's to pass a message without alerting anyone to the fact that a message has been passed.
people making the point you made totally miss an important point. what if you don't want someone to know the data even exists?
for example, sending a message to someone your government doesn't like:
-you: "ha! it's encrypted really strongly! suck my balls!" -government: "we don't give a flying fuck - even talking to them is a crime. off to jail for you, numbnuts!"
Any sufficiently advanced neural net should be able to deterministically find changes in common data communication where information can be hidden. And do you truly think that your data is not being checked by big brother?
I doubt there's enough computational resources for a sufficiently advanced neural net.
If chunks of known ciphertext in something like AES-256 can't be broken in times measured in universe ages, then I can't foresee much success in wholesale scanning of all information, searching for embedded secret strings which, if properly encrypted, should be indistinguishable from random noise.
An old Slashdot story mentioned one of the most fertile fields for laying down stego messages: within spam [spammimic.com].
This came out a long time ago with the idea of hiding child pornography in files containing what appeared to be pictures of art, or other benign picture files.
There was even an episode of Law and Order about this. Its nothing new, but I agree it does pose many questions about security. (Security through obscurity is really good if the level of obscurity is paramount.)
Many posters have addressed the idea of child pornography, but it's not just a matter of images hidden inside of images. By going through the 1s and 0s that make up an image a written message can be composed.
Method:
An image is built of bytes representing shades of colors. If you go through and change the least significant bit of each byte you can encode a message. Note: this is achieved without substantially changing the image.
*reads the other responses* Child porn.. child porn.. child porn..
Heh, there's some fuckers with dirty minds posting today...
I'm going to guess they've just had this line beaten into their heads from the "think of the children" PR machine behind funding for things like steganalysis.
Honestly, how many pervs do you think are out there hiding their child porn with methods such as this? I'd guess very close to zero. I'm not saying there aren't weirdos out there who like to collect this sort of thing, I'
There's some truth to the idea of a hidden message in comic strips.
During the 50's and 60's the air force used a particular comic strip ("smokey stover" i think. http://www.toonopedia.com/smokey.htm [toonopedia.com], also the origin of "foo" and "foo fighter") to train recon. photo interpreters. The artist would hide his wife's name somewhere in every strip, and the new recruits would have to find it.
actually this is a really good thing. not just on slashdot, but on other sites where you can search the documents for key words.
Heck, post as ac with a unique subject and post encrypted (gpg) ascii in multiple parts. the data will be here still next year or five (plausible) and you can retrieve it, and decrypt (assuming you have the public key or password if it's symmetric
That doesn't serve the purpose of steganography, though. If someone is clued in to the possibility that you might be sending messages by posting them on Slashdot, it's fairly easy to check and find out that yes, in fact, you are sending messages. The idea behind steganography is not to make the message unrecoverable from the cover data, but to make it so that nobody detects that any communication is even going on.
I tinkered with this for a while. Start up gnucleus, do a search for *.jpg, and grab a bunch of files to scan. Not surprisingly, many of the images were porn (it's for research purposes, I swear!)
The biggest problems were 1. most (actually, all) of the images that came back as good candidates for having embedded images came back as false positives and 2. lack of a brute-force steg break utility.
number 2 is probably a result of poor searching on my part, but I honestly couldn't find a recent, (and free) tool that would do a brute force crack on embedded images. At the time (a few months back) I was using stegbreak and stegdetect.
So, is there anything better? anyone else have any luck?
Don't know what you're talking about, but I remember when graphics hardware used to suck, and the most common way to make something selected was to overlay it with a halftone of blue. So what you would do is, figure out where that halftone would go, and in the pixels that remain exposed, mix in your porn image, at say about 25% opacity. Now, on the pixels that are obscured by the halftone, mix in the inverse of your porn image at the same opacity. When the halftone is gone, it would be hard to notice the change - the most you would notice is a subtle checkerboard effect where the porn was contrasting with the flowers. But when the halftone obscured the negative that previously was balancing the positive porn image in adjacent pixels, you would see the porn in much higher contrast.
I played around with this for a time. Stored all my various passwords in one of my desktop pictures at work. In the end, while it was certainly interesting, I didn't see a personally practical use for it. Perhaps integration with a keyring type of application? A replacement for the DB file that is used to store the passwords? I send so few iamges to my friends that a sudden influx of images being sent back and forth with hidden communications would draw more attention to anyone seriously interested in my boring life. I feel secure because I am obscure.
I can certainly see the use in espionage, hiding the real message in the static, as it were (Didn't a Tom Clancy book use this plot device? I think the message was sent in the connect noises for the modem). And NS's Baroque Cycle had some interesting steganographic bits in it (excessively long and boring letters about the nobility's obsession with fashion hiding an encrypted message for all to see). But on a day to day basis, I doubt this will affect most people.
The suggestion is that if data is being hidden in the LSB of a photo then you can use statistical analysis to spot this anomoly.
The problem here seems to be that if you were to compress your hidden data prior to hiding it, then the data inserted would appear random and should thwart statistical analysis. You'd need some redundancy there if you intent to jpeg compress the image, but it might work.
I've toyed with the idea of hiding data in the vectors used in a mpeg file. Exploiting the nature of the compression algorithm rather than the source data.
There's a good story on something vaugely related that has to do with the frequency of digits in measured numbers. (That is, it isn't equally probable to see every digit -- earlier digits in a number favor lower digits, like "1".) People who were falsifying accounting records were caught because the numbers they used were "too random".
Actually, here the fault is that they didn't understood the target. Expenses have no "natural" size, they're likely to be scale invariant. Basicly, you're looking for a distribution where C*f(x) = f(x). If you took 1..9, try C=2: 2,4,6,8,10,12,14,16,18... suddenly you have 5 leading 1s.
Turns out the right distribution is following Benford's law:
30.1% 17.6% 12.5% 9.7% 7.9% 6.7% 5.8% 5.1% 4.6%
The second example you have is that the human "RNG" is flawed.
A computer doesn't really suffer from this problem. The stenagography problem is really this.
1. Find randomness in source data 2. Replace random data with pseudorandom data
Of course, if you overwrite non-random data, you're doing it wrong. If you're going to use the LSB, you need to verfiy that it is random, or find the portion of it that is random (which is kinda what you're doing when you pick the LSB from a pixel anyway).
The biggest problem is really to hide it in a "reasonable" way.
Perfect steganography should replace all randomness with noise.
Perfect compression should eliminate all randomness.
In other words, steganography operates on the thin slice between good compression (jpg, mp3, divx) and perfect compression. It's much easier to hide information in bmp, wav, uncompressed avi, but it also looks damn obvious.
I have done a small experiment in steganography using DCT coefficients and spread spectrum technique, spreading a 4 bit number in 4 high frequency coeficients in a DCT transformed image
It works pretty well.. but I did it in PHP+GD, so it's pretty slow...
if anyone is interested, I have a paper that describes the methods, the PSNR and everything else... you can reach me at my gmail server, under the dangil alias
The abstract from Fridrich et al. says "... we present a steganalytic method that can reliably detect messages... hidden in JPEG images using the steganographic algorithm F5".
So TFA article cites countermeasures from 2001, even though a method of defeating those countermeasures was published in 2002.
The above is just one example. Overall, TFA seems poor and out-of-date. This is a case where the F in "TFA" does not stand for "fine".
This reminds me of a concern that surfaced in the immediate wake of 9/11: that the bad guys were shunning traditional net-based communication (e-mail, forum/newsgroup postings, etc.) and might be using codes or signals embedded in images in common places (eBay, for example).
I seem to recall a distributed screen-saver type app that was being used to crunch through millions of hosted images. Not much to find online about this, but there are articles like this one [newscientist.com] at NewScientist.com suggesting that the effort was a washout. here [xtdnet.nl] are some more stats from a study that came up dry, but there always this reference [xtdnet.nl] to "first stenographic image in the wild" as reported by ABC back when.
The fact that this is happening in China suggests to me that this is being done on the behest of the socialist government, which is far more concerned about the threat of grass roots movements for freedom and democracy than anything else.
Make no mistake, the current chinese government may represent a "kindler, gentler" communist regime, but its mere existence is still a crime against humanity.
In the past I've focused my thoughts primarily on techniques, but reading this article, it occurred to me that the most important part of using steganography is using it the right way, and constructing the right cover -- not necessarily the technique itself.
Using statistical methods, most steganography can be broken either now or in the near future if the steganalyst can spend a lot of time and computing resources on each candidate bit collection, and if you're hiding a lot of bits in each collection. The consequence: don't hide very many bits, and widen the search space by hiding your trees in a forest of significant size, so that the amount of CPU the analyst can use on any particular tree is low.
Key exchange is a great candidate for steganography. And to make sure the population of innocuous bit collections around yours is high, find a place where a lot of people around you are dealing in large quantities of bits: music collections at a university, or spam messages on an e-mail relay.
What strikes me as most curious is that the current debate about steganography is in itself an exercise in steganography--at least, in the sense of hiding important information in plain sight. Through the use of technical-sounding words, concerned parties manage to conceal what seems to be a genuinely frightening disrespect of the freedom of information.
Simply take "steganography" out of the equation. It's easy to scare the masses by using intimidating neologisms. But steganography is simply a manner to transmit information privately. So let's recast the sentence, "...illicit use of the technique might become a threat to the security of the worldwide information infrastructure." Let's simply say, "Individuals attempting to keep their private information private might become a threat to the security of the worldwide information infrastructure."
What used to be a preferred method for sending private information to a friend? The mail? Didn't we used to have a respect for the privacy of letters we sent via post? So how come no one said, "Sealing envelopes might become a threat to the security of the worldwide information infrastructure"?
What's being steganographically hidden in this debate is the reality that these days, quite a few people--many of them in power--simply no longer believe that a person has any right to private or personal information. Why would a technology such as this arise in the first place? Because we know that the first anthrax envelope made the private post public for everyone? Because we know our e-mail can be read, our servers can be hacked, our telephone calls recorded and our houses ransacked simply because fear of terrorists convinced us to sign over our civil liberties as if we no longer desired them?
This technology arose because some people realized that they were losing any pretense at privacy they might have had, and so were motivated to develop tools to maintain it. And now, we take the new word "steganography" and talk about how dangerous it is... perhaps because we're trying to conceal inside the hidden message that all privacy is dangerous, that anything you do, say or think should always be subject to review by the appropriate authorities.
You'll have to forgive me, I'm not the greatest cryptographer in the world. But let's say that Joe Shmoe takes a picture with his cheap 8-megapixel camera, with a very high ISO setting for lots of noise. Now, that's roughly 192 megabits of information.
Suppose he needs to encode a 1 kilobit message. that means that there's going to be one bit of signal for every 192 kilobits of image. Now, say he does the encoding to merely appear like more noise in the already noisy image.
Given that low of a signal-to-noise ratio, I really don't see how you could detect the message unless you had prior knowledge of the algorithm or locations.
and I pass it through a plugboard that has trillions of different combinations, and then through a set of 4 rotors which can be started from trillions of starting points, have many different internal wiring patterns, move in different ways and can be started from different positions each time and light up a new letter each time.
Hmm (Score:5, Interesting)
Re:Hmm (Score:3, Interesting)
Or in the case of "The Bible Codes", you find what you want to find.
Re:Hmm (cracked) (Score:5, Funny)
with regardS To encryPtiOn.
You've got a nicely steganographed "first post" there.
Parent
Re:Hmm (Score:4, Insightful)
Parent
Re:Wasn't that his point? MOD PARENT DOWN (Score:5, Interesting)
Parent
Re:Wasn't that his point? MOD PARENT DOWN (Score:5, Funny)
Parent
Re:Hmm (Score:5, Insightful)
But your point is really what the article is about. A serious Steganography method must be good enough to pass automated searches (steganalysis) because if the enemy knows where your data is, then you almost might as well have not bothered.
And of course, what the other post said is implied.
Parent
Re:Hmm (Score:4, Insightful)
Parent
Re:Hmm (Score:4, Insightful)
In other encryption techniques, such as Public Key Encryption, the decryption algorithm is public. The algorithm works like a box with two keyholes. One keyhole locks the box, the other unlocks it. Each person selects two keys, one is public, the other is private. If the sender wants to send a message, she locks the box with the receiver's public key. Once locked, the box can only be opened with the receiver's private key. If the Larry decides to leak his private key, it doesn't compromise the security of messages sent to other people. Heather can still send messages to Jim, using his public key, confident that the messages will remain private because they are encrypted with Jim's public key, not Larry's.
Parent
Re:Hmm (Score:5, Informative)
Furthermore, if you take the trouble to hide your data with steganography chances are that you will also encrypt it. In this scenario, the two accomplish different goals. Steganography ensures that no-one realizes that you have communicated at all and cryptography ensures that even if the steganography is compromised, they cannot tell what it was you were sending.
Steganography is gold to any mole in need of transmitting information from inside a hostile organization to his people on the outside. So long as the hostile org cannot tell that he is communicating, he is safe. Once they figure out, he is busted.
Or for anyone transmitting information across an untrusted medium for that matter. If you use PGP to protect your Internet mail, the Feds are going to know that you have _something_ going on and that they might want to keep extra tabs on you. If you also use steganographic techniques, you'll never show up on their radar in the first place.
Parent
Re:Hmm (Score:3, Interesting)
If ever they develop the notion that you require extra special treatment, they might catch on to your hidden messages, of course (or perhaps not). If they do, then I agree they have all the more reason to suspect you of foul p
Layered Implementation (Score:3, Insightful)
Re:Layered Implementation (Score:3, Informative)
That runs counterintuitive, so let me scratch the why/how:
Steg: it's incredibly hard to really hide stuff. If you stick data into the unimportant pixelbits of A/V data, statistical analysis of the sort of data that is created by the source (camera, scanner, etc) makes it *trivial* to detect that stuff is being hidden. The better you hide it, the more you sacrifice
Re:Layered Implementation (Score:3, Interesting)
Re:Layered Implementation (Score:3, Informative)
They shouldn't be directly compared, because steganography and encryption reach towards different goals. One conceals the fact that you're hiding information, the other protects information from someone who already knows to look for it.
In limited circumstances, each can perform the other's effect: steganography makes encryption irrelevant if they can't find the mate
Re:Hmm (Score:5, Insightful)
On the other hand, if you see a load of random pictures leaving $Company from lots of employees, then you have to find which picture has hidden data in it before you even know you have a problem.
The point of steganography isn't to pass a message that can't be read, it's to pass a message without alerting anyone to the fact that a message has been passed.
Parent
Re:Hmm (Score:4, Insightful)
for example, sending a message to someone your government doesn't like:
-you: "ha! it's encrypted really strongly! suck my balls!"
-government: "we don't give a flying fuck - even talking to them is a crime. off to jail for you, numbnuts!"
Parent
Re:Hmm (Score:5, Interesting)
Any sufficiently advanced neural net should be able to deterministically find changes in common data communication where information can be hidden. And do you truly think that your data is not being checked by big brother?
I doubt there's enough computational resources for a sufficiently advanced neural net.
If chunks of known ciphertext in something like AES-256 can't be broken in times measured in universe ages, then I can't foresee much success in wholesale scanning of all information, searching for embedded secret strings which, if properly encrypted, should be indistinguishable from random noise.
An old Slashdot story mentioned one of the most fertile fields for laying down stego messages: within spam [spammimic.com].
Parent
Already was an issue (Score:4, Interesting)
There was even an episode of Law and Order about this. Its nothing new, but I agree it does pose many questions about security. (Security through obscurity is really good if the level of obscurity is paramount.)
Can someone explain to me what is meant by... (Score:5, Insightful)
Re:Can someone explain to me what is meant by... (Score:4, Insightful)
Parent
Re:Can someone explain to me what is meant by... (Score:4, Interesting)
Parent
Explanation: Espionage (Score:3, Insightful)
Method: An image is built of bytes representing shades of colors. If you go through and change the least significant bit of each byte you can encode a message. Note: this is achieved without substantially changing the image.
Example: 10001000 becomes 10001001
Significance: If two people were to s
Re:Can someone explain to me what is meant by... (Score:3, Insightful)
*reads the other responses* Child porn.. child porn.. child porn..
Heh, there's some fuckers with dirty minds posting today...
I'm going to guess they've just had this line beaten into their heads from the "think of the children" PR machine behind funding for things like steganalysis.
Honestly, how many pervs do you think are out there hiding their child porn with methods such as this? I'd guess very close to zero. I'm not saying there aren't weirdos out there who like to collect this sort of thing, I'
Great movie title! (Score:5, Funny)
Throw in a Stegosaurus [kdsi.net] and we've got a real Destroy All Monsters [imdb.com] vibe going.
Run! It's Steganalysis!
This reply is funny, inciteful and informative (Score:5, Funny)
Extinct? (Score:4, Funny)
Hiding data ...pfft (Score:5, Funny)
Re:Hiding data ...pfft (Score:5, Funny)
Parent
Re:Hiding data ...pfft (Score:5, Informative)
During the 50's and 60's the air force used a particular comic strip ("smokey stover" i think. http://www.toonopedia.com/smokey.htm [toonopedia.com], also the origin of "foo" and "foo fighter") to train recon. photo interpreters. The artist would hide his wife's name somewhere in every strip, and the new recruits would have to find it.
Parent
An easy way to hide information (Score:5, Funny)
Re:An easy way to hide information (PART 2) (Score:5, Interesting)
Heck, post as ac with a unique subject and post encrypted (gpg) ascii in multiple parts. the data will be here still next year or five (plausible) and you can retrieve it, and decrypt (assuming you have the public key or password if it's symmetric
Parent
Re:An easy way to hide information (PART 2) (Score:3, Insightful)
fun stuff (Score:5, Interesting)
The biggest problems were 1. most (actually, all) of the images that came back as good candidates for having embedded images came back as false positives and 2. lack of a brute-force steg break utility.
number 2 is probably a result of poor searching on my part, but I honestly couldn't find a recent, (and free) tool that would do a brute force crack on embedded images. At the time (a few months back) I was using stegbreak and stegdetect.
So, is there anything better? anyone else have any luck?
Re:fun stuff (Score:4, Interesting)
Parent
Passwords (Score:5, Interesting)
I can certainly see the use in espionage, hiding the real message in the static, as it were (Didn't a Tom Clancy book use this plot device? I think the message was sent in the connect noises for the modem). And NS's Baroque Cycle had some interesting steganographic bits in it (excessively long and boring letters about the nobility's obsession with fashion hiding an encrypted message for all to see). But on a day to day basis, I doubt this will affect most people.
Problem with statistical analysis (Score:5, Interesting)
The problem here seems to be that if you were to compress your hidden data prior to hiding it, then the data inserted would appear random and should thwart statistical analysis. You'd need some redundancy there if you intent to jpeg compress the image, but it might work.
I've toyed with the idea of hiding data in the vectors used in a mpeg file. Exploiting the nature of the compression algorithm rather than the source data.
Re:Problem with statistical analysis (Score:5, Informative)
Actually, here the fault is that they didn't understood the target. Expenses have no "natural" size, they're likely to be scale invariant. Basicly, you're looking for a distribution where C*f(x) = f(x). If you took 1..9, try C=2: 2,4,6,8,10,12,14,16,18... suddenly you have 5 leading 1s.
Turns out the right distribution is following Benford's law:
30.1% 17.6% 12.5% 9.7% 7.9% 6.7% 5.8% 5.1% 4.6%
The second example you have is that the human "RNG" is flawed.
A computer doesn't really suffer from this problem. The stenagography problem is really this.
1. Find randomness in source data
2. Replace random data with pseudorandom data
Of course, if you overwrite non-random data, you're doing it wrong. If you're going to use the LSB, you need to verfiy that it is random, or find the portion of it that is random (which is kinda what you're doing when you pick the LSB from a pixel anyway).
The biggest problem is really to hide it in a "reasonable" way.
Perfect steganography should replace all randomness with noise.
Perfect compression should eliminate all randomness.
In other words, steganography operates on the thin slice between good compression (jpg, mp3, divx) and perfect compression. It's much easier to hide information in bmp, wav, uncompressed avi, but it also looks damn obvious.
Kjella
Parent
DCT + spread spectrum (Score:3, Interesting)
It works pretty well.. but I did it in PHP+GD, so it's pretty slow...
if anyone is interested, I have a paper that describes the methods, the PSNR and everything else... you can reach me at my gmail server, under the dangil alias
Secret Stuff (Score:3, Funny)
Is this really a good article on steganalysis? (Score:3, Informative)
Reference [11] is for the F5 algorithm: Yet consider this paper: The abstract from Fridrich et al. says "... we present a steganalytic method that can reliably detect messages
So TFA article cites countermeasures from 2001, even though a method of defeating those countermeasures was published in 2002.
The above is just one example. Overall, TFA seems poor and out-of-date. This is a case where the F in "TFA" does not stand for "fine".
v Stegosaurus! (Score:4, Funny)
Googlefight (Score:3, Funny)
Steganography wins.
Remember the post 9/11 image-messaging concern? (Score:3, Interesting)
I seem to recall a distributed screen-saver type app that was being used to crunch through millions of hosted images. Not much to find online about this, but there are articles like this one [newscientist.com] at NewScientist.com suggesting that the effort was a washout. here [xtdnet.nl] are some more stats from a study that came up dry, but there always this reference [xtdnet.nl] to "first stenographic image in the wild" as reported by ABC back when.
Remember Tiananmen Square (Score:3, Insightful)
Make no mistake, the current chinese government may represent a "kindler, gentler" communist regime, but its mere existence is still a crime against humanity.
Lee
I have used this technique for decades! (Score:3, Funny)
Application more important than Technique? (Score:3, Interesting)
Using statistical methods, most steganography can be broken either now or in the near future if the steganalyst can spend a lot of time and computing resources on each candidate bit collection, and if you're hiding a lot of bits in each collection. The consequence: don't hide very many bits, and widen the search space by hiding your trees in a forest of significant size, so that the amount of CPU the analyst can use on any particular tree is low.
Key exchange is a great candidate for steganography. And to make sure the population of innocuous bit collections around yours is high, find a place where a lot of people around you are dealing in large quantities of bits: music collections at a university, or spam messages on an e-mail relay.
Metasteganography (Score:5, Insightful)
What strikes me as most curious is that the current debate about steganography is in itself an exercise in steganography--at least, in the sense of hiding important information in plain sight. Through the use of technical-sounding words, concerned parties manage to conceal what seems to be a genuinely frightening disrespect of the freedom of information.
Simply take "steganography" out of the equation. It's easy to scare the masses by using intimidating neologisms. But steganography is simply a manner to transmit information privately. So let's recast the sentence, "...illicit use of the technique might become a threat to the security of the worldwide information infrastructure." Let's simply say, "Individuals attempting to keep their private information private might become a threat to the security of the worldwide information infrastructure."
What used to be a preferred method for sending private information to a friend? The mail? Didn't we used to have a respect for the privacy of letters we sent via post? So how come no one said, "Sealing envelopes might become a threat to the security of the worldwide information infrastructure"?
What's being steganographically hidden in this debate is the reality that these days, quite a few people--many of them in power--simply no longer believe that a person has any right to private or personal information. Why would a technology such as this arise in the first place? Because we know that the first anthrax envelope made the private post public for everyone? Because we know our e-mail can be read, our servers can be hacked, our telephone calls recorded and our houses ransacked simply because fear of terrorists convinced us to sign over our civil liberties as if we no longer desired them?
This technology arose because some people realized that they were losing any pretense at privacy they might have had, and so were motivated to develop tools to maintain it. And now, we take the new word "steganography" and talk about how dangerous it is... perhaps because we're trying to conceal inside the hidden message that all privacy is dangerous, that anything you do, say or think should always be subject to review by the appropriate authorities.
Detection? (Score:3, Informative)
You'll have to forgive me, I'm not the greatest cryptographer in the world. But let's say that Joe Shmoe takes a picture with his cheap 8-megapixel camera, with a very high ISO setting for lots of noise. Now, that's roughly 192 megabits of information.
Suppose he needs to encode a 1 kilobit message. that means that there's going to be one bit of signal for every 192 kilobits of image. Now, say he does the encoding to merely appear like more noise in the already noisy image.
Given that low of a signal-to-noise ratio, I really don't see how you could detect the message unless you had prior knowledge of the algorithm or locations.
steve
Re:how is this possible? (Score:3, Insightful)
['h', 'e', 'l', 'l', 'o', 'w', 'o', 'r', 'l', 'd']
and I pass it through a plugboard that has trillions of different combinations, and then through a set of 4 rotors which can be started from trillions of starting points, have many different internal wiring patterns, move in different ways and can be started from different positions each time and light up a new letter each time.
How do I decode