4 ms·

Since when is steganography hypothetical? Or rather, how does hypothetical mean "previously undocumented in the wild"? There have been practical tools for dig

by ynniv 16y ago

Since when is steganography hypothetical? Or rather, how does hypothetical mean "previously undocumented in the wild"? There have been practical tools for digital image steganography since at least the early '90s. Heck, it was on Law and Order last year: http://allthingslawandorder.blogspot.com/2009/10/law-order-svu-hardwires-recap-review.html http://allthingslawandorder.blogspot.com/2009/10/law-order-s...

statenjason 16y ago
Like the Windows copy command. copy /b IMG_0010.JPG + SecretCodes.rar PartysAreFunLOL.jpg
- m0nastic 16y ago
  When NTFS added in support for ADS (alternate data streams) I was doing forensics for corporate customers out in California. In 10 years I never did encounter a case where someone was using ADS to hide data, but I was always hoping to.
shaddi 16y ago
Seriously. I remember we had a stenography lesson at a summer program I participated in during high school, back in 2004. The software we used was pretty old, and the class was held at TN Tech and led by a guy from the Cooke Co. Sherrif's cybercrime division. Not exactly people on the front lines of internet security research.
CWuestefeld 16y ago
Of course steganography is old, both as a concept and as tools to accomplish it. The article says this is the first time it's actually known to have been used for nefarious purposes. That doesn't exclude prior usage for fun and experimentation, or even for practical purposes (say, wartime or corporate communications).
- Groxx 16y ago
  How is wartime != nefarious?
tptacek 16y ago
Neils Provos did a study of all of Usenet (I think?) as part of his PhD thesis, as an input data set for stegdetect, which used statistical (I think?) techniques to detect steganography. Long story short: nobody uses steganography. It's really not that much of a win.
- ComputerGuru 16y ago
  stegdetect isn't all that great. I've been working on an improved steganography technique (actually, an alteration to pretty much any existing methodology) for the past 6 months as a side project. stegdetect is jpeg-only (yes, LSB steganography on raw audio/video is really, really lame, but it's really easy, too) and it really depends on the input media. Using stegdetect itself on the sender's side with various source media makes it easy to avoid detection in-transit. Plus, any statistical analysis tool is only useful for long messages (higher signal:noise ratios). If you're sending one-liners in a 2MB photo, for all intents and purposes, the original photo hasn't been modified and is really difficult to catch.
  - tptacek 16y ago
    I'd sure hope you can do better than stegdetect, in that you've had over 10 years to improve on it! I was overly terse in dismissing steg; I didn't really provide a rationale for my comment. But I expect you'll agree with me anyways. Image steganography is a pet trick. Given the constraints of a meaningful image file, it's unlikely you're going to come up with a technique for encoding a covert channel that will be truly hard to spot. Meanwhile, it's a lot of added effort for a very minimal theoretical gain (and a very likely severe practical loss) in operational security.
    - ComputerGuru 16y ago
      Agreed. Perhaps with today's multi-GB media (video) files, steganography will see a new surge in popularity. But then again, we'd probably have already seen that by now. (and I'm working on a steganography technique, not steganalysis - if I can get my act together and focus some, I'll be submitting it to a security conference in next month... I hope :)

by ynniv 16y ago

statenjason 16y ago

Like the Windows copy command. copy /b IMG_0010.JPG + SecretCodes.rar PartysAreFunLOL.jpg

m0nastic 16y ago
When NTFS added in support for ADS (alternate data streams) I was doing forensics for corporate customers out in California. In 10 years I never did encounter a case where someone was using ADS to hide data, but I was always hoping to.

shaddi 16y ago

Seriously. I remember we had a stenography lesson at a summer program I participated in during high school, back in 2004. The software we used was pretty old, and the class was held at TN Tech and led by a guy from the Cooke Co. Sherrif's cybercrime division. Not exactly people on the front lines of internet security research.

CWuestefeld 16y ago

Of course steganography is old, both as a concept and as tools to accomplish it. The article says this is the first time it's actually known to have been used for nefarious purposes. That doesn't exclude prior usage for fun and experimentation, or even for practical purposes (say, wartime or corporate communications).

Groxx 16y ago
How is wartime != nefarious?

tptacek 16y ago

Neils Provos did a study of all of Usenet (I think?) as part of his PhD thesis, as an input data set for stegdetect, which used statistical (I think?) techniques to detect steganography. Long story short: nobody uses steganography. It's really not that much of a win.

ComputerGuru 16y ago
stegdetect isn't all that great. I've been working on an improved steganography technique (actually, an alteration to pretty much any existing methodology) for the past 6 months as a side project. stegdetect is jpeg-only (yes, LSB steganography on raw audio/video is really, really lame, but it's really easy, too) and it really depends on the input media. Using stegdetect itself on the sender's side with various source media makes it easy to avoid detection in-transit. Plus, any statistical analysis tool is only useful for long messages (higher signal:noise ratios). If you're sending one-liners in a 2MB photo, for all intents and purposes, the original photo hasn't been modified and is really difficult to catch.
- tptacek 16y ago
  I'd sure hope you can do better than stegdetect, in that you've had over 10 years to improve on it! I was overly terse in dismissing steg; I didn't really provide a rationale for my comment. But I expect you'll agree with me anyways. Image steganography is a pet trick. Given the constraints of a meaningful image file, it's unlikely you're going to come up with a technique for encoding a covert channel that will be truly hard to spot. Meanwhile, it's a lot of added effort for a very minimal theoretical gain (and a very likely severe practical loss) in operational security.
  - ComputerGuru 16y ago
    Agreed. Perhaps with today's multi-GB media (video) files, steganography will see a new surge in popularity. But then again, we'd probably have already seen that by now. (and I'm working on a steganography technique, not steganalysis - if I can get my act together and focus some, I'll be submitting it to a security conference in next month... I hope :)