4 ms·

Nice of them to write a useful tool for doing it, and I have never implemented it, but having done stego detection as part of CTFs/creepypasta puzzles, if the s

Nice of them to write a useful tool for doing it, and I have never implemented it, but having done stego detection as part of CTFs/creepypasta puzzles, if the shannon entropy of the data in the LSB (extracted using cyberchef) is greater than that of the rest of the image, it probably has data encoded in it. Similarly, you can randomize the palette of an image to look for noise that would indicate encoded data.

hayst4ck 4y ago
You can also break an image down into layers based on bit position. Static is a clear sign of random and therefore likely encrypted or compressed data.
- GoblinSlayer 4y ago
  What if the image is a noisy photo?
  - d_tr 4y ago
    Maybe you could compute the spectrum or some other characteristic of the noise and compare it to the type of noise you would expect from a camera. I guess you can always mimic these things to some degree if you are determined enough though.
    - Kubuxu 4y ago
      Yeah, this is what you do, for example re-encode the image with Gray code (avoids the Hamming cliff), you split the bit-planes into 8x8 blocks, compute the entropy within them and encode the data for that block in such a way that it has same/very similar entropy, re-encode from Gray back into normal binary. See https://web.archive.org/web/20120905034757/http://www.eece.maine.edu/~eason/steg/SPIE98.pdf https://web.archive.org/web/20120905034757/http://www.eece.m...
    - GoblinSlayer 4y ago
      That too, say, 3-state modulation. Ethernet uses extra degree of freedom to increase entropy, but it can decrease entropy too, create a fake bias and approximate desired statistics. As a bonus stretch the key the second time and use it as a running bias for the modulation.
  - hayst4ck 4y ago
    The end result of encryption is a completely random string of bits. If you replaced an images raster with a properly sized blob of encrypted data (0 padding could be used pre-encryption to get the right size), you would get an image of pure static. So if you randomly generated a stream of bits and put that in a photo, that would not be differentiable from an encrypted blob inside of a photo data structure. That means the question is where do you hide a random string of 1's and 0's without it being obvious there is a string of 1's and 0's. The related question to a noisy photo is, is there structure to the noise? Random 1's and 0's is the opposite of structure. So trying to de-steganogra-fy a photo means looking for absence of structure. This leads to the observation you are making, which is that the photo you choose has a great effect on the effectiveness of the stenography. If you photo-shopped together an image of a TV displaying static, you could put an encrypted blob in the static with all bits and have a cohesive photo. If you were to hide a payload in a completely black (#000000) picture, any strategy used would likely be obvious. Stenography is very much "security through obscurity" compared to encryption which is security. The nature of encryption means that stenography is primarily about plausible deniability rather than being technically effective.
krick 4y ago
> CTFs/creepypasta puzzles Where can I find games like that?

hayst4ck 4y ago

You can also break an image down into layers based on bit position. Static is a clear sign of random and therefore likely encrypted or compressed data.

GoblinSlayer 4y ago
What if the image is a noisy photo?
- d_tr 4y ago
  Maybe you could compute the spectrum or some other characteristic of the noise and compare it to the type of noise you would expect from a camera. I guess you can always mimic these things to some degree if you are determined enough though.
  - Kubuxu 4y ago
    Yeah, this is what you do, for example re-encode the image with Gray code (avoids the Hamming cliff), you split the bit-planes into 8x8 blocks, compute the entropy within them and encode the data for that block in such a way that it has same/very similar entropy, re-encode from Gray back into normal binary. See https://web.archive.org/web/20120905034757/http://www.eece.maine.edu/~eason/steg/SPIE98.pdf https://web.archive.org/web/20120905034757/http://www.eece.m...
  - GoblinSlayer 4y ago
    That too, say, 3-state modulation. Ethernet uses extra degree of freedom to increase entropy, but it can decrease entropy too, create a fake bias and approximate desired statistics. As a bonus stretch the key the second time and use it as a running bias for the modulation.
- hayst4ck 4y ago
  The end result of encryption is a completely random string of bits. If you replaced an images raster with a properly sized blob of encrypted data (0 padding could be used pre-encryption to get the right size), you would get an image of pure static. So if you randomly generated a stream of bits and put that in a photo, that would not be differentiable from an encrypted blob inside of a photo data structure. That means the question is where do you hide a random string of 1's and 0's without it being obvious there is a string of 1's and 0's. The related question to a noisy photo is, is there structure to the noise? Random 1's and 0's is the opposite of structure. So trying to de-steganogra-fy a photo means looking for absence of structure. This leads to the observation you are making, which is that the photo you choose has a great effect on the effectiveness of the stenography. If you photo-shopped together an image of a TV displaying static, you could put an encrypted blob in the static with all bits and have a cohesive photo. If you were to hide a payload in a completely black (#000000) picture, any strategy used would likely be obvious. Stenography is very much "security through obscurity" compared to encryption which is security. The nature of encryption means that stenography is primarily about plausible deniability rather than being technically effective.

krick 4y ago

> CTFs/creepypasta puzzles Where can I find games like that?