4 ms·

Secret messages on the web: How to do steganography in JavaScript

38 points by gw 14y ago

theallan 14y ago
Great method! I had ideas about doing something similar (although this technique is rather more advanced than mine) a while back, about being able to show messages based on character read from an HTML page. I wrote a little script for it: http://sprymedia.co.uk/article/Secret http://sprymedia.co.uk/article/Secret .
darronz 14y ago
I wonder if a similar technique could be used to detect if a user has stylesheets enabled.
dchest 14y ago
For extra security, it's good to provide the option of encrypting the message before hiding it in the image. Doesn't encryption make it easier to detect hidden messages, because it generates a uniform pseudorandom output, something that an image without the hidden message doesn't have?
- gw 14y ago
  I haven't done much steganalysis so don't know what difference it will make for an attacker searching over large numbers of images, but it's at least useful if you're more worried of attackers who already suspect there is a hidden message.
- harshpotatoes 14y ago
  All images have some amount of random noise in them due to the thermal fluctuations of the sensor. With some clever techniques, I wonder if it could be possible to hide the pseudorandom encrypted message in the image to make it appear slightly noisier? Or maybe hide the message in images with already low SNR?
- thalur 14y ago
  I would have guessed the opposite - I would expect the least significant bits to have a random distribution (if the image is a photo from a camera, that is) so if the least significant bits of the image have a non random distribution that might be a hint that there is something hidden there. Of course, all of this is moot if the image is lossily compressed.
- peterwwillis 14y ago
  This paper recommends embedding AES using a thresholding algorithm: http://www.scribd.com/doc/62034623/A-Multi-Layered-Secure-Robust-and-High-Capacity-Image-Steganographic-Algorithm http://www.scribd.com/doc/62034623/A-Multi-Layered-Secure-Ro... This paper is really good at explaining image steganography from a beginner's standpoint: https://docs.google.com/viewer?a=v&q=cache:kWVnLQVjyR0J:martinolivier.com/open/stegoverview.pdf+&hl=en&gl=us&pid=bl&srcid=ADGEEShqeA3VSpam5rS7capPIrbzk22kTtJBMEBWVtXQ-jSrv6GAT4IX1L0KIzbA_PvhL8_IvJhyLk8LWn3IMK-VZO5Rb-8yMPYEIZa71yZ7HaXsPTdXF69vF6mUS5aE6lJA_YXFYxQO&sig=AHIEtbQg9VAMBeSntkcN-_WClletsaZMpQ&pli=1 https://docs.google.com/viewer?a=v&q=cache:kWVnLQVjyR0J:... In my opinion, the whole point of embedding a "secret" message in an object is defeated if there's the possibility that the "secret" may be revealed. The math involved in cryptography is much harder to defeat than the art of detecting a structured message layered into an object, so I prefer to just pass a plain-old encrypted message. But if you want to prevent someone even thinking you're passing an encrypted message, embedding that encrypted message in an image or audio can be beneficial. And risking someone finding out the actual secret just because you thought they might be able to tell you're sending one is not worth it.
  - dchest 14y ago
    Thank you for the links! Indeed, I was thinking about applying some form of encryption that is harder to distinguish from image data than just AES in standard modes.
bsaunder 14y ago
Pretty cool, but I wonder if the author realizes that you can steganographically encode data in any format including HTML and even JS itself. Bonus points if you can split the steganographic data into multiple domains, where building the original message requires finding and assembling the pieces in the canvas, HTML and JS sections. Also, I believe there may be blurring techniques you can use to smooth out the dense randomness that is a signature of encryption.
- gw 14y ago
  Good point regarding text-based steganography. I've had a greater interest in hiding within binary files, though, because they tend to be larger and have highly varied contents. Also, it's very common to share images over email and other means, so doing so wouldn't inherently raise suspicion.
lucian1900 14y ago
Interesting, but the obvious weak point is the browser environment itself. How can the code doing the steganography be sure it hasn't been interfered with?
- gw 14y ago
  Being client side JavaScript, you could save it locally and run it as a file:// URL if that is a concern.
ssdsa 14y ago
Hm, I thought this was about hiding data in JavaScript source code!
meriksson 14y ago
Here is a newly launched service for steganography in images, primarily lolcats: http://lolsecurity.se http://lolsecurity.se
- Jach 14y ago
  I love how someone actually did this. drostie replied to my comment several months ago with some great analysis on my off-hand remark about potentially hiding your web traffic through sending lots of steg'd cat pictures: https://news.ycombinator.com/item?id=3575232 https://news.ycombinator.com/item?id=3575232

38 points by gw 14y ago

Great method! I had ideas about doing something similar (although this technique is rather more advanced than mine) a while back, about being able to show messages based on character read from an HTML page. I wrote a little script for it: http://sprymedia.co.uk/article/Secret http://sprymedia.co.uk/article/Secret .

darronz 14y ago

I wonder if a similar technique could be used to detect if a user has stylesheets enabled.

dchest 14y ago

For extra security, it's good to provide the option of encrypting the message before hiding it in the image. Doesn't encryption make it easier to detect hidden messages, because it generates a uniform pseudorandom output, something that an image without the hidden message doesn't have?

gw 14y ago
I haven't done much steganalysis so don't know what difference it will make for an attacker searching over large numbers of images, but it's at least useful if you're more worried of attackers who already suspect there is a hidden message.
harshpotatoes 14y ago
All images have some amount of random noise in them due to the thermal fluctuations of the sensor. With some clever techniques, I wonder if it could be possible to hide the pseudorandom encrypted message in the image to make it appear slightly noisier? Or maybe hide the message in images with already low SNR?
thalur 14y ago
I would have guessed the opposite - I would expect the least significant bits to have a random distribution (if the image is a photo from a camera, that is) so if the least significant bits of the image have a non random distribution that might be a hint that there is something hidden there. Of course, all of this is moot if the image is lossily compressed.
peterwwillis 14y ago
This paper recommends embedding AES using a thresholding algorithm: http://www.scribd.com/doc/62034623/A-Multi-Layered-Secure-Robust-and-High-Capacity-Image-Steganographic-Algorithm http://www.scribd.com/doc/62034623/A-Multi-Layered-Secure-Ro... This paper is really good at explaining image steganography from a beginner's standpoint: https://docs.google.com/viewer?a=v&q=cache:kWVnLQVjyR0J:martinolivier.com/open/stegoverview.pdf+&hl=en&gl=us&pid=bl&srcid=ADGEEShqeA3VSpam5rS7capPIrbzk22kTtJBMEBWVtXQ-jSrv6GAT4IX1L0KIzbA_PvhL8_IvJhyLk8LWn3IMK-VZO5Rb-8yMPYEIZa71yZ7HaXsPTdXF69vF6mUS5aE6lJA_YXFYxQO&sig=AHIEtbQg9VAMBeSntkcN-_WClletsaZMpQ&pli=1 https://docs.google.com/viewer?a=v&q=cache:kWVnLQVjyR0J:... In my opinion, the whole point of embedding a "secret" message in an object is defeated if there's the possibility that the "secret" may be revealed. The math involved in cryptography is much harder to defeat than the art of detecting a structured message layered into an object, so I prefer to just pass a plain-old encrypted message. But if you want to prevent someone even thinking you're passing an encrypted message, embedding that encrypted message in an image or audio can be beneficial. And risking someone finding out the actual secret just because you thought they might be able to tell you're sending one is not worth it.
- dchest 14y ago
  Thank you for the links! Indeed, I was thinking about applying some form of encryption that is harder to distinguish from image data than just AES in standard modes.

bsaunder 14y ago

Pretty cool, but I wonder if the author realizes that you can steganographically encode data in any format including HTML and even JS itself. Bonus points if you can split the steganographic data into multiple domains, where building the original message requires finding and assembling the pieces in the canvas, HTML and JS sections. Also, I believe there may be blurring techniques you can use to smooth out the dense randomness that is a signature of encryption.

gw 14y ago
Good point regarding text-based steganography. I've had a greater interest in hiding within binary files, though, because they tend to be larger and have highly varied contents. Also, it's very common to share images over email and other means, so doing so wouldn't inherently raise suspicion.

lucian1900 14y ago

Interesting, but the obvious weak point is the browser environment itself. How can the code doing the steganography be sure it hasn't been interfered with?

gw 14y ago
Being client side JavaScript, you could save it locally and run it as a file:// URL if that is a concern.

ssdsa 14y ago

Hm, I thought this was about hiding data in JavaScript source code!

meriksson 14y ago

Here is a newly launched service for steganography in images, primarily lolcats: http://lolsecurity.se http://lolsecurity.se

Jach 14y ago
I love how someone actually did this. drostie replied to my comment several months ago with some great analysis on my off-hand remark about potentially hiding your web traffic through sending lots of steg'd cat pictures: https://news.ycombinator.com/item?id=3575232 https://news.ycombinator.com/item?id=3575232