USAF Wants To Find Steganographic Content 267
Bud Higgins writes "The U.S. Air Force has posted a Small Business Technology Transfer Program (STTR) solicitation in which they seek proposals for the automated detection of steganographic content. They seek an application that should run both unobtrusively in the background and in a manual mode, and provide the user the capability to scan all email attachments, downloaded materials and accessed files with an appropriate steganalysis algorithm, reporting any abnormal results (i.e. the presence of steganography). I personally don't think that is feasible, but maybe a good programmer can prove me wrong. A link to the solicitation AF04-T008 can be found here. For those who are not familiar with the SBIR/STTR program, it provides up to $850k for 3 years of research." This sounds very similar to what Niels Provos did over a several-year period at University of Michigan's CITI and released under a free license. I hope the USAF doesn't spend too much of my money without considering extending that research.
Feasible? (Score:5, Informative)
I think it probably depends on where you hide the data. For instance, it's probably harder to hide data in the LSBs of an image than, e.g. a file that's supposed to be white noise ("Hey, my mic doesn't work, it only records noise. See for yourself"). Of course, the less data you encode, the harder it is to detect it.
Re:Feasible? (Score:5, Insightful)
"The enemy is sending out an abnormally large amount of random noise data. Must just be having microphone trouble. Nothing to see here."
Roger that.
No +1, cause I've been drinking...
Re:Feasible? (Score:3, Informative)
Re:Feasible? (Score:4, Funny)
Why bother with cryptography/steganography/etc. when you can use slashdotography ?
You simply post your message in clear form in the comments of a "highly trollistic" news, and your message will automatically become hidden and indetectable with all the noise surrounding it.
In general it's feasable though (Score:5, Interesting)
Watch out for reuse or original source availabilit (Score:2, Informative)
Re:Watch out for reuse or original source availabi (Score:2)
Re:Watch out for reuse or original source availabi (Score:3, Insightful)
Not quite that easy (Score:4, Interesting)
The same holds with audio. For instance, crypted data is white noise, but concert noise is "pink noise" which has a characteristic spectrum. The noise produced by converters is closer to white, but it isn't quite either. People like Neils Provos have been studying this for a while, trying to find out which bits they can change without altering the statistics of the image or audio, but with limited success. As of last year (don't know how it is this year), all published steganography schemes at least a few months old had been broken.
Re:Not quite that easy (Score:3, Interesting)
Re:Feasible? (Score:2)
The other important issue is whether the "ennemy" knows what kind of steg you might use. That helps detection a lot.
Hrm (Score:5, Insightful)
I'm not sure what they're looking for here; perhaps a better steganography algorithm?
Re:Hrm (Score:2)
It's in the league of the millions of requests PGP gets to decrypt user data because they forgot the password.
Just asking the question implies a kind of ignorance that frankly I find worrisome given the responsibilities these guys have.
Re:Hrm (Score:5, Insightful)
I would expect such an argument to have specific knowledge of various file formats, since randomness in a jpeg is not quite the same as randomness in for example a .EXE file.
I would further expect that my approach would be soundly defeated by first encrypting the information to be hidden, since encrypted data looks a lot more random than normal data anyway.
Personally I doubt it can be done. You might be able to defeat specific steganographic algorithms, but the general case cannot be solved. It would be a bit like having a universal decryption algorithm...
Re:Hrm (Score:4, Insightful)
It would still be somewhat valuable to know that encrypted messages were being sent even if you do not know what the content is. If you know bad guy #1 is posting some steg encoded pictures on his porn site and bad guy #2 visits it on a regular basis (along with 1000's of other non-bad guys) you could at least get a clue that something is up if bad guy#1 changes the frequency or number of his updates. In short, traffic analysis.
If you cannot detect any kind of steg whatsoever, you can't even get this info.
Re:Hrm (Score:3, Interesting)
I'm not steg expert, but saying "as random as normal data" isn't of much help -- normal data is NOT random, statistically speaking. One of clues is that random data has highest theoretical amount of information that is, can not be compressed (as there's no redundancy to compress); thus, anything that compresses using som
Re:Hrm (Score:3, Interesting)
I have read a paper on this and they used the opposite method than what you propose. They assumed images have sections which are not very random. (most images contains some areas with uniform color) If the least significant byte of an image is very random compared to the other bytes it can indicate steganography.
Of course you have to ajust the thresholds to account fo the diff
Re:Hrm (Score:2, Funny)
No sweat. Didn't you see Sneakers?
Re:Hrm (Score:3, Interesting)
Actually, I would expect relatively little randomness in a compressed image, because removal of randomness (along with redundancy) is what compression is all about. And since well-encrypted data should appear random, you'd get further by testing for bits that are too random, rather than for hidden structure.
Re:Hrm (Score:3, Informative)
I am afraid you have it backwards. Compression is removal of repetitive, guessable parts. The better you compress, the more random the output becomes. Perfectly compressed data consists of bits where each bit has no relation whatsoever to any other bit in this data.
So it is perfectly possible to hide information in large data files. The original request is impossible, because you not just need to reliably extract the
Re:Hrm (Score:2)
Yes, but you'd be putting encrypted data into the LSBs. And encrypted data looks like random noise. So how could such an algorithm detect that? Maybe the answer is to use psychics [amazon.com].
Oh yeah? (Score:2, Interesting)
Suuuuure, Carnivore anyone?
Re:Oh yeah? (Score:5, Insightful)
They likley want this to scan documents leaving thier internal network in an attempt to catch people who are sending out sensitive or secret info. To me this looks like the USAF is plugging a leak, not going on the hunt.
Soko
Comment removed (Score:4, Interesting)
Re:Oh yeah? (Score:5, Insightful)
That's exactly one of the reasons for the technology. The DoD has an obligation to protect sensitive information. There are a crazy number of hoops that need to be gone through to get unclassified info off of a classified system. They can't have people encoding stuff in pictures of Barney then walking away with it.
I know the usual paranoids are up in arms about the AF doing this, but the same people would flood "The DoD is so stupid" if it were found out that people were abusing the technology to transport classified info.
Re:Oh yeah? (Score:3, Insightful)
Step number one is, even if it looks innoculous, don't let it through. Nobody is going to let you email or floppy a picture of Barney out of a classifed system, because there's no reason to, and it might contain classified information. It doesn't matter what the stegnography filter says, it won't go.
Re:Oh yeah? (Score:2)
You can send email from classified systems. It's only to other classified system though, because its a closed network. Hack the Pentagon website all you want. You'll never get the meat, because it's not on the
Re:Easier way... (Score:3, Informative)
SBIR/STTR program (Score:5, Informative)
It really is an interesting government program. All the IP we generate with the money stays with us. However in the interest of equitable return to the taxpayer, we have decided to release all of our core software components GPL. (Okay, okay this also helps when it comes time for our semi-annual review, to show that we aren't just soaking the taxpayers.) We hope to turn a profit partially by our user interface components (non-core code that we are not releasing) and also through support.
Trying to get one of these grants is highly competitive, but if you have a really good idea and don't want the vulture capitalists to "fund" you, this is a great program.
Re:SBIR/STTR program (Score:2)
We're staying clear of the dot com carcass: We're not going to make online advertising work; we're not going to make online transactions easier than ever; your web page will still be ridiculously expensive to build and it will still suck; our name doesn't end with "ient" or "networks"; offsite backups will still lose your data and we're not going to revolutionize the way people interact and communicate over
stego wrapped pgp (Score:3, Insightful)
Strong crypto should look not unlike random noise (Score:5, Informative)
If the steg'd data has obvious headers and block formatting, a weak algorithm could leave enough of a pattern in the output file to be detectable. And of course some applications of stego are used to embed cleartext data...
Proponents of stego sometimes suggest it's use in environments where even the suspicion of crypto is enough to risk persecution and/or prosecution.The other "trick" to detecting stego is that "normal" JPG/BMP/WAV/MP3/AVI/MPEG files tend to not actually show a high degree of random noise -- the seemingly random data in the LSB tends to have a pattern imposed by the encoder used and the input device.
I'd guess that this problem is more of an issue on highly-processed information from clean sources. You wouldn't expect random noise on an MP3 file ripped off the latest pop album release, but it wouldn't be out of place on a .SHN "bootleg" recording of a TMBG live concert from a handheld DAT recorder...
Re:stego wrapped pgp (Score:5, Interesting)
Statistical analysis can indeed detect where hidden information is placed into an image, usually by noticing that the balance of the image is off. In fact, using encrypted data is more likely to stand out because images are not usually populated with statistically random data.
Here's a piece on scanning Usenet [xtdnet.nl] for hidden images. As a broadcast medium you'd expect it to be most frequently used as you can anonymously post material and it is well-nigh impossible to locate the intended recipient.
Not too difiicult surely? (Score:2, Funny)
2. Base new software on Mr. Provos' work.
3. Profit!!
In an IT world where profit is linked to enterprise software, this will be a very interesting piece of work for somebody. Kudos to the winner. I would bid myself if I was a US citizen!
Well I hope it's better than stegdetect then... (Score:5, Informative)
Wonder why Air Force (Score:4, Interesting)
One thing that does surprise me is that they have allowed the Air Force guys to look at this at all, it seems much more like an Army or NSA thing.
Re:Wonder why Air Force (Score:2)
One thing that does surprise me is that they have allowed the Air Force guys to look at this at all, it seems much more like an Army or NSA thing.
The Air Force does quite a bit of intelligence work. They share some resources with the NSA, and give intel to the Army. Lately there's been a big push toward the idea of "information warriors," since we've proven that we can blow stuff up -- now we just need nerds that are bright enough to find the bad guys.
Yes, this primarily is the domain of the NSA, but
Re:Wonder why Air Force (Score:2)
No anonymous here.
I had a project meeting the other day with about a dozen different agency reps. There are thousands of cross agency projects. No big secrets. Well, not many at least
Jesus, everyone here is so hoping this is all one big secret agent movie. I think it's a combination of all those role-playing games and not getting outside much.
pattern deviance (Score:3, Informative)
Of course, if you were to steg with an OTP or some such (i.e. your steg is based on deviance from a known data set), you'd more easily escape such detection.
I can tell you right now it's still far off. (Score:4, Funny)
Re:I can tell you right now it's still far off. (Score:2)
Interesting (Score:5, Insightful)
But I had a this little idea. Suppose we "pollute" normal images with random data with say 1% redundancy. What I mean is, whenever you create an image you take some random data and steganographically embed it in the image. Write a gimp plugin or something so that the process is transparent and automatic. Your file only becomes 1% bigger, so its no big deal. Not everyone needs to do this, just sufficiently many people so that the vast majority of the positives of stego detection systems are going to be false positives. As long as the message is encrypted before embedding, it is provably impossible to tell a genuine stego image from a false positive, assuming that the underlying encryption isn't broken. So you get a secure stegosystem with 1% efficiency "for free".
[dons tinfoil hat]
We'd all better soon start doing something like this, given where governments are going.
Re:Interesting (Score:2)
these aren't fake positives they are show people who have used the defective encoder. You then take this portion of the images and look for deviation from the normal actions of this plugin. The remander have a good chance of containing stegographic content.
You haven't made it harder to find stegged images you have cut down on the work neede
Re:Interesting (Score:3, Insightful)
Re:Interesting (Score:2, Interesting)
Suppose you work inside the Air Force and want to blow the whistle on them for some illegal acts. So you gather the incriminating docu
Re:Interesting (Score:2)
You can at best detect a tiny subset of steganography algorithms, then along will come a smarter fish. Can you find the second hidden message in this post?
Re:Interesting (Score:4, Interesting)
I don't think you mean 'redundancy' here, since the added data is obviously not redundant. It can't be, since it has to encode the steganographic message.
I think you mean 'apparent redundancy', i.e. the container file would appear to be redundant to someone who doesn't know there's a secret message since it's larger than it needs to be.
However, this problem can be avoided if the encoder simply chooses a steganographic method which does not increase container size. As a trivial example of this idea, consider
this stegangraphic tool I wrote [forrest.cx] which is based on permuting HTML tag attributes.
Clearly, tag attributes must have some fixed order when written into a file. My program simply permutes them in a specific way within the file, thus encoding content without increasing container size.
The general idea is to make use of the existing redundancy of the container to encode data. The one caveat here is that the amount of container redundancy is bounded above by the size of the container, so there is a fixed maximum amount of data that can be encoded.
Re:Interesting (Score:2)
In short, rather than creating a smokescreen of false positives for their system, why not take it as an incentive to improve stenography.
Re:Interesting (Score:2)
Say your in prison and want to organize your evasion with some outsider. You know that ALL of your mail will be read by your guardians. So if you encrypt your message and send the cyphertext as is, your guardians will just keep it for themself and never let the mail go to the recipient.
However, if you hide the message in a letter that looks normal, then your pretty sure that your mail will not be cens
Re:Interesting (Score:3, Informative)
I wrote a program back in college that did better than that.
your "hidden data" must be 1/16th the size of the total image size. I used tga files as they were very common back then.
I simply encoded my data one bit at a time into the lsb of every other pixel. extremely small changes in the pixel color so it's undetectalbe by the human eye. and I'd bet that it's undetectable by every detection program out there. I even wrote in a function to specify the number of padding 0's
I'm gonna go ahead and disagree (Score:2)
then again most of /. is not the gen
Re:Interesting (Score:2)
Steganography hides *very small* messages in other *much larger* messages. By its definition it's impossible to detect. Here's why.
First of all, any terrorist worth his 76 virgins first encrypts the message to be sent. Good cyphers produce output that is statistically random so theres a good probability that the new message to be hidden is infact: random.
Now, you take a huge file, say a wav, or a bmp, and every f
Perfect Programming is not needed for it to work (Score:5, Insightful)
The "solution" can be implemented with the current laws and regulations, and I think the programmer is only a small part to make this system work. A lot of enforcement authorities have to come together and the current evidence suggests that they will come together. Of course, it is a moot point that by the time they figure this out, people would have learned to hide data in other creative ways - the eternal cat-and-rat game ...
Consider this
If Adobe (and others) could be forced to include in their code methods to detect currencies Slashdot | Photoshop CS Adds Banknote Image Detection, Blocking? [slashdot.org] and not disclose it till they were caught by some vigilant users, what makes us so smug that other major companies with "closed" software are not already in-bed-with-the-feds ? So, it is conceivable that the automatic detection may be going on and we wouldn't be any wiser.
See the Adobe example of how such "spyware" can be forced to run "unobtrusively."
Major Email providers like Yahoo and Hotmail already provide automatic scanning for virus, AOL is including automatic scanning for spyware, MicroTrend (?) already has Online Virus Scanning of your Hard Drive (!), and so under the threat of the Patriot Act (and it's ilk) many of these companies can be forced to scan everything that goes in and out of their systems.
This is the key. Now the threshold for "abnormal" has been reduced so much (almanac carriers as potential terrorists, CAPPS passenger detection based on names and 15 flights were cancelled last month based on this, anti-war protestors as possible terrorists and hence being tailed by the Feds etc.) that the problem of false alarms no longer dogs the current administration and law enforcement agencies.
This is the crux. When the error threshold is reduced so much that the high rates of error are no longer problematic, then any solution (whether efficient or not) can be implemented. Who cares whether it works well or not. Till now the false alarms were the things that stopped such 1984-ish like scenarios from unfolding. Once you accept high errors, and accept even high collatoral damage as the price of doing "business," you can have a solution to almost anything implemented - whether it deserves to be implemented or not is a whole different issue. But who cares? You got nothing to hide - Right?
Scary thought for Open Source Software (Score:2)
Finally... (Score:4, Funny)
Re:Finally... (Score:4, Funny)
Re:Finally... (Score:2, Interesting)
I wonder if anyone has done a statistical analysis of spelling errors in emails by American youth. Talk about undetectable ways to hide a message in plain text!
The end user doesn't need protection... (Score:3, Interesting)
Anyway the USAF initiative is more clever than it seems, because vital steganographic content (terrorist plans and so) must be hidden in "popular" files, to make it hard for the good guys to find out the intended audience of the message. So a user level scan might be somewhat helpful.
It will also give a good excuse to people caught surfing for porn ("I am just helping out the USAF, dear!").
steganography vs. compression (Score:5, Insightful)
It is easy to 'steganohide' content in uncompressed noisy files like tiff or wav. But that content gets destroyed by lossfull compression which is mainly used by multimedia formats (jpeg, mpeg, divx, mpg3, ...). If not, it's called a watermark, but (un)fortunately nobody found a watermark algorithm yet which is robust against lossfull codecs and adding some more noise.
So You have to steganohide Your content after compressing. But compressed files have much less noise, and that noise is not random noise but has statistical quirks. If You just hide Your content as white noise and add it to the file - thats detectable, because it changes the statistical behaviour of the file!
Instead You have to write an specific steganografic algorithm for each lossfull compression format You want to hide content in! It has to respect the 'format noise character'. That's what Niels Provos did for pnm and jpeg with outguess [google.com].
Re:steganography vs. compression (Score:5, Informative)
To be precise: they have much more noise, but You can only use a fraction of that noise for steganography. Otherwise You would destroy or significantly alter the original content of the compressed file.
Re:steganography vs. compression (Score:2)
Ok, got it. Now guess my mother tongue. Tip: we do so ;-)
Maybe possible for images (Score:2)
I wonder if they've talked to this guy [dartmouth.edu]
He claims to have a system which can detect modifications to photographic images.
Any tampering with a photographic image causes detectable statistical changes. These changes can indicate that the image may have been edited to change the content or possibly that steganographic data has been added.
Here's an ineresting little (Score:5, Informative)
this is am impossible task (Score:2)
It can be stowed as replaced low order bits where the address of the bit is generated via a hashing function.
Even IF ( a really big IF here) it is possible to determine which bits were flipped (XOR) or stowed, one is still faced with knowing the arbitrary hashing function that was used.
If one
Patterns In The Static (Score:5, Interesting)
Given enough processing power, even
Re:Patterns In The Static (Score:3, Interesting)
It would have to be an enormous amount of power. Consider we limit the possibilities merely to the alphabet.
/dev/urandom would give you that.
To come up with the word 'the' would be reasonably common place. The odds are 1 in 27*27*27 (26 letters plus space), or 1 in 19683, that any three outputs from a purely alphabetical
But the word 'the' is hardly a meaningful message. Let's consider 'The quick brown fox jumps over the lazy
Nope. (Score:2, Insightful)
Analyzing a jpg or png to staistically determine if it's "clean" or has a message in it is not all that difficult. Decoding that message is a totally unrelated feat.. more likely reserved for cryptographers.
Impossible. (Score:2)
Of course this is feasable! (Score:5, Interesting)
Of course this is feasable! At least with todays steganography software.
What the software does, is to overwrite appearently insignificant portions of the "container" data (the audio/picture/text/whatever file that transports the smaller hidden file). The steganographers say (rightfully) that, by encrypting the hidden data with a strong-enough algorithm, it is indistinguishable from random data. Ie, no one (without the key used for encryption) would be able to tell if it's encrypted data, or perfectly random data.
However, the programmers of steganographic software now go one step further and say (wrongly!) that images and audio files carry random noise in their least significant bits (LSB). Certainly, the lowest of those 16 bits of CD quality audio does not carry much data. And granted, 16 bits give 96dB of dynamic range while analog master tapes (studio quality) only have about 80dB, and microphone technology hardly touches 96dB. The LSB of an audio wave file definately is noisy, no doubt about that.
But (big "BUT"), it is far from being perfectly random. In the LSB you might find 50Hz/60Hz hiss from the buildings electric cabeling. You might find characteristic noise that's typical for your brand of microphone, or even a kind of "noise fingerprint" that could be used to distinguish your microphone from others of the same brand (much like crime investigators can distinguish typewriters by analyzing the blackmail letter). Actually, an experiment showed that when cutting all but the LSB of a music wave file, the tune remains still recognizable!
What the stego programmers do is to replace that LSB (or even 4 least significant bits) with perfectly (pseudo) random data. That's a difference! I can just cut all but the LSB and check if it statistically matches perfect random data (whitenoise) or if "some of" the music tune is "somehow" in there (eg by correlation, a DSP technique).
The same applies for pictures. If the pictures were scanned, the lower bits will contain artefacts characteristic to the particular scanner used. Digital photos exhibit "signatures" of the CCD/CMOS chip used in the digicam. Etc.
The steganographers know this, while the programmers of stegano software deliberately ignores it. It's a solvable problem, but infinitely difficult. If you know what the stegano-detection software is looking for, you can easily avoid it. Just encrypt your hidden data to "perfect random" and then transform it (by adding data, thus loosing efficiency) to exhibit almost the same "fingerprint" signature as the data you are going to overwrite. In case of an audio wave file, impress a bit of the tune on your data.
But obviously, you can't reach perfection, because a 100% match means that you overwrite the original data with a 100% copy of it (-> you have stored 0 bytes of hidden data). Or you know how the detector works, what tresholds it uses to bin the file as "steganographic", and stay a little below the treshold. But that puts you on the risky side.. Will they change the tresholds? Will they check for other characteristics as well, something that you didn't address in your steganographic software?
That's why the steganographic programmers (not researchers!) ignore this problem. It has no practical solution. It's so much easier to just ignore it, and offer you the choice between 4 and 8 bits of hidden data per 16 bits of wave data (like eg "Scramdisk" does, a recommendable harddisk encryption software). This is better than nothing, but it is far from "not feasable" to detect!
Marc
Re:Of course this is feasable! (Score:3, Interesting)
Many years ago (10+), just out of interest in crypto, I XOR'ed a raw audio file (my own speech) with pseudo random data (all bits, from LSB to MSB). The result, was one very noisy audio file with the speech still audible! I thought "WTF!?"
I figured that since, on average, 50% of bits would be toggled, some of the audio information would still be present in a form a human could recogn
Re:Of course this is feasable! (Score:2, Interesting)
Your thought ("WTF!?") was right on target. I don't know what you actually did, but it clearly wasn't XOR the audio file with anything resembling random bits. If you XOR a message with truly random bits, the result will consist of truly random bits
Re:Of course this is feasable! (Score:3, Interesting)
Do you think this system could be used (Score:2)
Or do you think all of the emails will just go somewhere else instead?
I don't think this can possibly work. (Score:4, Interesting)
Re:I don't think this can possibly work. (Score:4, Insightful)
Even random data has to fit in. For example, it used to be the case that the A/D stage of some cheap sound cards was so noisy that the recording from line-in gave you a 16 bit audio sample stream with the bottom 4 bits effectively random(like dithering but much much worse.) However, the noise (while random in nature) was shaped in a particular way, so if you just hide your encrypted secrets in those 4 bits it would be obvious that the "noise" wasn't appropriate.
Jon.
How about this... (Score:2)
I also read here that compressing the data and adding it, would still add redundancy. Is this correct?
What about compressing, then encrypting the data? I always thought that compression and encryption both attempt to minimise the entropy of a set of data. How can it be detected if it's random?
Compression (Score:2)
I have an anti-idea? (Score:2, Insightful)
impressive technology - who's using it? (Score:2)
So, why do we want to look for such messages? Are terrorists from the middle east supposed to be passing messages around with this technology that even the finest scientists at Slashdot's secret underground laboratory can't even seem to agree would be possible? Here I a
Re:impressive technology - who's using it? (Score:2)
World War II (Score:2)
Establishing innocence on false positives--how? (Score:4, Insightful)
How do you prove that you're innocent?
How do you prove that your image does NOT contain steganography?
Worse yet, suppose you are using steganography--say, a watermark to prevent people from stealing your image. Will the FBI believe what you tell them is the decoded content?
I mean, a few decades ago some nutcase analyzed Shakespeare's First Folio and decided that it was printed in a mixture of two slightly different fonts that constituted a binary code with a message proving that it had been written by Sir Francis Bacon. (No kidding). That proves that it's easy for someone who's looking for steganography to find it, whether it's there or not.
Impossible (Score:2)
Isn't this an NP Complete problem (Score:2)
Conceptually, the execution bounds for looking for these "hidden" messages seems not too different from trying to find factors of prime numbers. Take an image, and distill it into two parts, one of which is a hidden message you know nothing about, and the other is the final image with the hidden message removed.
Probably feasible because of STTR (Score:3, Interesting)
The original poster doesn't believe that it's possible to detect steganographic content. There have been lots of technical follow-ups that suggest it might be possible, but almost nobody has mentioned the funding issue. The task is most likely possible simply because there's been an STTR solicitation published. Many of the STTR and SBIR solicitations are designed by their authors to fund existing projects known to the authors. These "solicitations" provoke very few proposal submissions, occasionally even just the one from the expected recipient of the funds.
Don't get me wrong - this isn't a scam. The funding groups are usually genuinely interested in having what they specify developed, sometimes wind up buying lots of it once the development is complete, and in most cases all qualified bidders are truly considered. It's just that the solicitations are often written so narrowly that only a select few bidders can qualify.
But hey, at least the bidders are required to be small businesses, not like those Halliburton contracts for Iraq!
An Interesting but controversial solution (Score:2, Insightful)
This would involve a tremendous database on the part of the USAF. More importantly, if the people using the steganography had a similar database (and code that could encrypt their hidden text to match the properties of the "known good"s), then the messages would be undetectable.
A b
even if you are comparing with an original image (Score:2)
I don't think this will work at all: (Score:2, Insightful)
Re:It's not "your money" (Score:2)
You have the right to demand to know where every penny of you money goes.
"No, you can't build that road, I won't allow it since it's my money that you're using."
don't you have anti-road building protests? don't you get roads rerouted so they have minimum impact on the environment and population? or is this a european thing?
I would personally welcome a system wher
Re:It's not "your money" (Score:3, Insightful)
We do have protests over road building, but they are on an environmental or citizen advocacy basis and I do not recall seeing one using property rights as a basis for this.
Many moons ago in college, we were told about a guy who sued the government to find out what was in the DOD or CIA budget, which was presented as kind of a black box. He argued that as a
Re:It's not "your money" (Score:2)
Re:It's not "your money" (Score:2)
So although you don't have a 'pro rata' say on how you money is spent you still believe you can, and should, still have a say
Re:It's not "your money" (Score:2)
figure like 10 billion a little while ago. You
can do a lot with 10 bill, then again seeing as
its usage is hidden and not publicly auditted a lot of it is probably ripped off. Apart from the
hidden black budget, the rest of the your tax dollars are fully accountable and released under
the freedom of information act, aren't they?
I british, and envy america's freedom of information act, the UK govs documents are o
Re:It's not "your money" (Score:2)
If that were the case then nothing would ever get done, because projects are -always- beneficial to some people and worthless to others.
Actually, it's always possible to do projects that are worthless to everybody (perhaps excluding those getting a paycheck for it). I believe that was what the original comment was about. While we don't pick where the funding should go, their decisions should be under our scrut
Re:It's not "your money" (Score:2)
If enough people didn't want the school/road to be, then surely in a democracy/republic, the school/road shouldn't be built. It is, or at least should be, still "your money" - part of the implied social contrac
Re:how stegged is stegged? (Score:5, Interesting)
It's only trivial if they we using the most basic method possible and you had some idea what the data you were looking for was like.
If just I straight-up encode a bunch of dictionary words into the LSB's in a black and white bitmap, then you could easily find them.
If distort the image using a fractal pattern as my method of encoding and the original data source is compressed and encrypted as part of the operation, it's not trivial anymore, is it?
Rubbish (Score:5, Informative)
The point of steganography is to hide information so that its presence cannot be detected. This means hiding information below the noise floor of the media. Information hidden in this way cannot be practically detected, assuming the stego is halfway decent, and the message to be hidden appears random (easily accomplished by encrypting it first).
Sure, *if* you had access to the unaltered original, then you could detect that it had been altered, but any competent steganographer would encrypt the hidden information first.
This sentence demonstrates that you don't understand either /dev/urandom or steganography.
More mis-informed rubbish - kernel implementation and processor type have little to do with the algorithms underlying the /dev/urandom implementation. Furthermore, /dev/urandom is based on "natural type" entropy (i.e randomness derived from unpredicable physical processes).
So if you have to hide something from the feds then become a scientist and collect lots of data from nature. It should have an element of randomness that allows you to steg your secrets in the data.or, you could go and take a regular photo. Plenty of real, nature-derived randomess there.
Re:The Bible Code (Score:2)
Except if you find 3 messages in 3 different files coming from the same source, that make sense and are encoded using the same (give or take a parameter value) method, you have a valid reason to send guys in black suits to the sender.
Although, if the receiving end is, say, USENET reader, he's still uncatchable.
Re:Why is it so fashionable in the US (Score:2)
Look I realize you people hate bush, but not everything that happens in America is his fault.
Re:It may be possible (Score:2)