What is Steganography

Transcription

1 STEGANOGRAPHY

2 Outline Introduction Outline What is Steganography History Lesson Why is this important to Digital Forensics Steganography and Cryptography Variations Classifications of Steganography Inside Steganography How does suspects use steganography How does CF use knowledge of Steganography Detection programs and techniques Questions

3 What is Steganography What s Steganography? Steganography comes from the La>n & Greek Steganos (Greek) meaning Covered Graphy (La>n) meaning wri>ng or drawing Steganography is the science of hiding informa>on. (Kessler) Steganography is the art of concealing the existence of informa>on within seemingly innocuous carriers (Johnson) The Art & Science of using overt objects to create and exploit covert communica>ons. (Trawick)

4 History Lesson 1499 Trithemius-published Steganographia. Legendary tales of TaTooing WWI Use of invisible inks WWII Use of Micro dots

5 Why is this important to Digital Forensics Forensics Inves>gators looking for the Truth. Steganography gives users ability to hide the truth So its important to know Tac>cs, Techniques, and procedures suspects might use

6 Steganography and Cryptography Differences Cryptography hides the meaning of a message, the encrypted message is visible, you may know that communica>ons are taking place, but you can t read them without the proper key, BUT Steganography hides the fact that there is even a message being sent.

7 Steganography and Cryptography Similari>es Both provide confiden>al communica>ons between par>es Both require some prerequisite knowledge about the communica>ons What about message integrity?

8 Variations on Steganography

9 Variations Trojan Horses (yes or no)? Yes: uses covert channels Yes: hides one item inside another NO: Its not really communica>ons NO: Recipient not a willing party to the comms

10 Variations Covert Channels (yes or no)? Yes: Secret Communica>ons Yes: Hiding the signal in plain site or overtly Yes: Require pre-requisite knowledge NO: Normally not a message being sent, but a signal NO: Normally, message already conveyed, or is yet to be conveyed

11 Variations Easter Eggs (yes or no)? Yes: covert and overt channels Yes: Hiding the signal in plain site Yes: requires pre-requisite knowledge NO: Normally not a message, but a prize. NO: Intent & usage different, normally a program

12 Classifications of Steganography Inser>on Subs>tu>on Genera>on

13 Classifications of Steganography Inser>on Techniques Adds to beginning or ending of file In between BOF and EOF headers Prac>cally unlimited storage Does not affect the appearance of original File size changes propor>onately

14 Classifications of Steganography Subs>tu>on techniques Changes to Least Significant Bit (LSB) Limits to how much you can hide Can change the visual appearance

15 Classifications of Steganography Genera>on Techniques Uses Algorithm and Hidden file to generate new Unlimited storage Generates pictures such as fractals, sta>c or noise depending on algorithm used. Use may allow Steganography image to remain intact even aaer processing such as format change.

16 Inside Steganography Demonstrate Camouflage program Review MS PAINT Pro for pixel color changes Review MS Paint Pro for HISTOGRAM changes Example of impact of file size on image

17 Inside Steganography Demonstrate Camouflage program Inser>on based File size changes No apparent change to picture Any size into any size.

18 Inside Steganography Subs>tu>on Example Review MS PAINT pro for pixel color changes Review MS Paint pro for HISTOGRAM changes Example of impact of file size on image

19 How does suspects use steganography Terrorist are thought to use Web Images to transmit messages Commercial & Government users use it to communicate with employees and hide cri>cal data Use as a Dead-Drop so par>es don t know each other

20 How do we use knowledge of Steganography Know the capabili>es exist Know popular programs embed and detect Learn signs of possible use of Steganography

21 Detection programs and techniques X-steg- for JPG files windows GUI (OutGuess) Other tools for steg detec>on Current state of the art = $$$

22 Questions

23 References htp:// htp:// steganography htp:// Neil F. Johnson. Steganography. Technical Report. November IEEE Computer in 1998 Network based intrusion detec1on to detect steganographic communica1on channels - on the example of images, Hesse, D. DiTmann, J. Lang, A. AMSL Adv. Mul>media & Security Lab., OTo-von-Guericke Univ. of Magdeburg, Germany htp://