5 ms·

Show HN: I made a steganography program

56 points by VenomSwitch 6y ago

VenomSwitch 6y ago
This is different to the other stego programs out there in that it allows the user to choose how many LSB (Least significant bits) they want to use. This is important because if you use 4LSB an image can store more data but it is more obvious in the output, with 1LSB it is less obvious but you can store 1/4 as much data. My program also allows you to input text OR image into a cover image. If you are unfamiliar with steganography - I have tried to explain it simply on the github readme. ANY feedback on the program or the repo would be greatly appreciated! -J
- lun4r 6y ago
  I made one years ago (https://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=28747&lngWId=1 https://www.planet-source-code.com/vb/scripts/ShowCode.asp?t...). Had a quick look at your code and I could be mistaken, but it looks like you modify the pixels from top left to bottom right. You can make it harder to detect by selecting the pixels pseudorandomly, seeding your prng with the encryption key.
  - VenomSwitch 6y ago
    Ah nice, I'll check it out! Yeah, at the minute they're from left to right but I've been doing some research into a graph-theoretic approach which looks pretty interesting.
  - auxym 6y ago
    If the hidden data is encrypted anyways, then wouldn't it be indistinguishable from truely random data? What would then be the point of distributing it randomly or in order?
    - deleted 6y ago
      [deleted]
    - jstanley 6y ago
      If the cover image is a solid block of colour, you can detect the presence of the steganography by noting that the first N pixels vary slightly, and the rest are solid. Similarly, if you have a clean reference of the source image, you could observe that the first N pixels are modified and the rest are not, and conclude that something is hidden in them. If the pixels are selected at random, this analysis is less conclusive. Ideally you'd hide a random value in every pixel so that all pixels are manipulated equally.
    - betterunix2 6y ago
      Actually, the thermal noise of a camera is biased so a uniform random distribution of low-order bits will be easy to detect. You need to preserve as much of the thermal noise as possible and try to choose pixels from high frequency regions of the image (where the thermal noise is harder to separate from the image itself).
      - berdon 6y ago
        So maybe the best approach would be to use a filter/transformation to exclude hard-lined regions (edges) and only embed data within variations/gradations?
        betterunix2 6y ago
        Other way around: edges are a good place to try to hide stegotext because of the high frequency components (the edge effect, which is also why JPEG artifacts are worse along sharp edges).
- betterunix2 6y ago
  Modern steganography does more than just use the LSBs of the image. For example, the watermarks used for SDMI (audio, not image data, but same logic applies) used techniques from communications systems like spread spectrum carriers (similar to what you might see with a digital radio system). For images you can also try to place the stegotext along edges and other high-frequency regions where there is more "noise" available to hide what you are doing. If you need to maintain secrecy, you can combine steganography with cryptography e.g. use a PRNG to select carrier frequencies (IANAL but you probably should beware of ITAR issues if you distribute such a thing). You should also give thought to how robust you want the stegosystem to be to image filtering, downsampling, etc. The MPAA uses watermarks on movies to determine which theaters are the source of camrips, and those watermarks have to be as robust as possible (they must survive both the camera's inherent reduction in quality and possible transcoding/editing by the pirates). Not all stegosystems need to be robust, for example SDMI used one robust and one weak in an effort to identify downsampled copies of the audio (the RIAA assumed that downloaded music would always be significantly downsampled).
peterburkimsher 6y ago
Do you have an algorithm that will work with recompressed lossy images? I experimented with steganography before, but simply sending a picture via Facebook and clicking Save To Camera Roll on an iPhone causes serious data loss pretty quickly, so I couldn't get meaningful data out. In the end I found that PDF attachments worked for my use case, but I'd still rather have an image-based steganography program if possible.
- jonatron 6y ago
  If you want watermarks to survive jpeg compression, you have to do DCT block manipulation, not just individual pixel values.
  - betterunix2 6y ago
    Or you can work in the frequency domain of the entire image instead of DCT blocks, which gives you a lot more room to work around various compression issues. I would also suggest that an error correcting code is helpful.
  - im3w1l 6y ago
    Does this survive cropping by not-multiple-of-8?
    - jonatron 6y ago
      When you decode, you can start from offsets (eg 4,4) rather than 0,0.
- tyingq 6y ago
  You used to be able to stick info in the ICC profile area of a jpeg, and it would survive Twitter's compression and thumbnailing. Not sure if that still works: https://www.theverge.com/2018/11/1/18051514/twitter-image-steganography-shakespeare-unzip-me https://www.theverge.com/2018/11/1/18051514/twitter-image-st... Discussed at the time: https://news.ycombinator.com/item?id=18342042 https://news.ycombinator.com/item?id=18342042
speps 6y ago
Decrypted text from image: > Not going to lie I'm surprised anyone can figure out how to decrypt this in the current state of the program, well done! P.S. star my repo plz I'm trying to look employable! :) Project wasn't building correctly to start with, UI is bit clunky (missing window frames!?).
nullc 6y ago
As far as I know the state of the art in image stego is perturbed quantization with wet paper codes. The essential idea with wet paper codes is that you can use error correcting codes so that even the recipient need not know which bits contain the data. A simple analogy is that if you wanted to communicate only a single bit you could decide that the xor of all the data in the image decides the bit. Then the encoder can flip the single least distinguishable bit to encode their message. The idea behind perturbed quantization is that when you quantize the data (e.g. while jpeg compressing it) some values will be maximally close to tied between rounding up and rounding down. If you embed your data in those values you'll minimize the embedding noise. Unfortunately most of the work on approaches based on these ideas is academic and has no public implementation, but there is one that I'm aware of https://sourceforge.net/projects/pqstego/ https://sourceforge.net/projects/pqstego/ There is a lot that could be done both with respect to security (e.g. using better models to predict the image to hide the stego noise better, better error correcting codes, and list decoding) and basic engineering, e.g. handling content length encoding better.
- jkhdigital 6y ago
  Image steganography techniques have indeed reached a level of sophistication that requires significant expertise to implement correctly. A good parallel is compression--most CS undergrads can figure out how to implement Huffman or even LZW compression, but state-of-the-art ANS (asymmetric numeral systems) is pretty dense. I believe a special type of wet paper code called a syndrome-trellis code is at the forefront of image steganography: http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf. Good luck parsing that without a solid foundation in information theory. Steganography is the current focus of my PhD research, and from my perspective the greatest security challenges are in systems engineering. Embedding secret messages into your vacation photos is one thing, but who are you sending these messages to? And why? How will they know when and where to go looking for the secret message? Encryption entered its golden age with the advent of public-key cryptography and Diffie-Hellman key exchange, allowing two parties to share the secrets required for secure communication knowing only public information about one another. However, steganographic systems are still dependent upon lots of out-of-band secret sharing, since attempting to share the necessary secrets over public channels tends to reveal the existence of the system and opens up DoS attacks (e.g. Tor and the identity of relays). IMHO, figuring out better solutions to the system security of particular steganographic applications is a much more pressing research problem than improving statistical embedding profiles for image steganography.
thomasqbrady 6y ago
As a developer of 20 years who has avoided .Net, some build instructions and/or some releases would be nice, but looks like a fun project!
- speps 6y ago
  Open it in a recent VS (2017 worked), fix the compile error and run it.
  - thomasqbrady 6y ago
    We don't all use (or even have) Visual Studio.
    - thomasqbrady 6y ago
      Also, that assumes a platform, no? This wouldn't build on Mac/Linux/Unix machines, without a Mono setup, would it?

56 points by VenomSwitch 6y ago

This is different to the other stego programs out there in that it allows the user to choose how many LSB (Least significant bits) they want to use. This is important because if you use 4LSB an image can store more data but it is more obvious in the output, with 1LSB it is less obvious but you can store 1/4 as much data. My program also allows you to input text OR image into a cover image. If you are unfamiliar with steganography - I have tried to explain it simply on the github readme. ANY feedback on the program or the repo would be greatly appreciated! -J

lun4r 6y ago
I made one years ago (https://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=28747&lngWId=1 https://www.planet-source-code.com/vb/scripts/ShowCode.asp?t...). Had a quick look at your code and I could be mistaken, but it looks like you modify the pixels from top left to bottom right. You can make it harder to detect by selecting the pixels pseudorandomly, seeding your prng with the encryption key.
- VenomSwitch 6y ago
  Ah nice, I'll check it out! Yeah, at the minute they're from left to right but I've been doing some research into a graph-theoretic approach which looks pretty interesting.
- auxym 6y ago
  If the hidden data is encrypted anyways, then wouldn't it be indistinguishable from truely random data? What would then be the point of distributing it randomly or in order?
  - deleted 6y ago
    [deleted]
  - jstanley 6y ago
    If the cover image is a solid block of colour, you can detect the presence of the steganography by noting that the first N pixels vary slightly, and the rest are solid. Similarly, if you have a clean reference of the source image, you could observe that the first N pixels are modified and the rest are not, and conclude that something is hidden in them. If the pixels are selected at random, this analysis is less conclusive. Ideally you'd hide a random value in every pixel so that all pixels are manipulated equally.
  - betterunix2 6y ago
    Actually, the thermal noise of a camera is biased so a uniform random distribution of low-order bits will be easy to detect. You need to preserve as much of the thermal noise as possible and try to choose pixels from high frequency regions of the image (where the thermal noise is harder to separate from the image itself).
    - berdon 6y ago
      So maybe the best approach would be to use a filter/transformation to exclude hard-lined regions (edges) and only embed data within variations/gradations?
      - betterunix2 6y ago
        Other way around: edges are a good place to try to hide stegotext because of the high frequency components (the edge effect, which is also why JPEG artifacts are worse along sharp edges).
betterunix2 6y ago
Modern steganography does more than just use the LSBs of the image. For example, the watermarks used for SDMI (audio, not image data, but same logic applies) used techniques from communications systems like spread spectrum carriers (similar to what you might see with a digital radio system). For images you can also try to place the stegotext along edges and other high-frequency regions where there is more "noise" available to hide what you are doing. If you need to maintain secrecy, you can combine steganography with cryptography e.g. use a PRNG to select carrier frequencies (IANAL but you probably should beware of ITAR issues if you distribute such a thing). You should also give thought to how robust you want the stegosystem to be to image filtering, downsampling, etc. The MPAA uses watermarks on movies to determine which theaters are the source of camrips, and those watermarks have to be as robust as possible (they must survive both the camera's inherent reduction in quality and possible transcoding/editing by the pirates). Not all stegosystems need to be robust, for example SDMI used one robust and one weak in an effort to identify downsampled copies of the audio (the RIAA assumed that downloaded music would always be significantly downsampled).

peterburkimsher 6y ago

Do you have an algorithm that will work with recompressed lossy images? I experimented with steganography before, but simply sending a picture via Facebook and clicking Save To Camera Roll on an iPhone causes serious data loss pretty quickly, so I couldn't get meaningful data out. In the end I found that PDF attachments worked for my use case, but I'd still rather have an image-based steganography program if possible.

jonatron 6y ago
If you want watermarks to survive jpeg compression, you have to do DCT block manipulation, not just individual pixel values.
- betterunix2 6y ago
  Or you can work in the frequency domain of the entire image instead of DCT blocks, which gives you a lot more room to work around various compression issues. I would also suggest that an error correcting code is helpful.
- im3w1l 6y ago
  Does this survive cropping by not-multiple-of-8?
  - jonatron 6y ago
    When you decode, you can start from offsets (eg 4,4) rather than 0,0.
tyingq 6y ago
You used to be able to stick info in the ICC profile area of a jpeg, and it would survive Twitter's compression and thumbnailing. Not sure if that still works: https://www.theverge.com/2018/11/1/18051514/twitter-image-steganography-shakespeare-unzip-me https://www.theverge.com/2018/11/1/18051514/twitter-image-st... Discussed at the time: https://news.ycombinator.com/item?id=18342042 https://news.ycombinator.com/item?id=18342042

speps 6y ago

Decrypted text from image: > Not going to lie I'm surprised anyone can figure out how to decrypt this in the current state of the program, well done! P.S. star my repo plz I'm trying to look employable! :) Project wasn't building correctly to start with, UI is bit clunky (missing window frames!?).

nullc 6y ago

As far as I know the state of the art in image stego is perturbed quantization with wet paper codes. The essential idea with wet paper codes is that you can use error correcting codes so that even the recipient need not know which bits contain the data. A simple analogy is that if you wanted to communicate only a single bit you could decide that the xor of all the data in the image decides the bit. Then the encoder can flip the single least distinguishable bit to encode their message. The idea behind perturbed quantization is that when you quantize the data (e.g. while jpeg compressing it) some values will be maximally close to tied between rounding up and rounding down. If you embed your data in those values you'll minimize the embedding noise. Unfortunately most of the work on approaches based on these ideas is academic and has no public implementation, but there is one that I'm aware of https://sourceforge.net/projects/pqstego/ https://sourceforge.net/projects/pqstego/ There is a lot that could be done both with respect to security (e.g. using better models to predict the image to hide the stego noise better, better error correcting codes, and list decoding) and basic engineering, e.g. handling content length encoding better.

jkhdigital 6y ago
Image steganography techniques have indeed reached a level of sophistication that requires significant expertise to implement correctly. A good parallel is compression--most CS undergrads can figure out how to implement Huffman or even LZW compression, but state-of-the-art ANS (asymmetric numeral systems) is pretty dense. I believe a special type of wet paper code called a syndrome-trellis code is at the forefront of image steganography: http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf. Good luck parsing that without a solid foundation in information theory. Steganography is the current focus of my PhD research, and from my perspective the greatest security challenges are in systems engineering. Embedding secret messages into your vacation photos is one thing, but who are you sending these messages to? And why? How will they know when and where to go looking for the secret message? Encryption entered its golden age with the advent of public-key cryptography and Diffie-Hellman key exchange, allowing two parties to share the secrets required for secure communication knowing only public information about one another. However, steganographic systems are still dependent upon lots of out-of-band secret sharing, since attempting to share the necessary secrets over public channels tends to reveal the existence of the system and opens up DoS attacks (e.g. Tor and the identity of relays). IMHO, figuring out better solutions to the system security of particular steganographic applications is a much more pressing research problem than improving statistical embedding profiles for image steganography.

thomasqbrady 6y ago

As a developer of 20 years who has avoided .Net, some build instructions and/or some releases would be nice, but looks like a fun project!

speps 6y ago
Open it in a recent VS (2017 worked), fix the compile error and run it.
- thomasqbrady 6y ago
  We don't all use (or even have) Visual Studio.
  - thomasqbrady 6y ago
    Also, that assumes a platform, no? This wouldn't build on Mac/Linux/Unix machines, without a Mono setup, would it?