9 ms·

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key lengt

Stenography is one of the NSA's worst nightmares. Encrypted strings sent over the Internet they know are encrypted, and often know what algorithm and key length. But the fact that any image can contain an encrypted message, and there's know way to know whether or not something exists within, scares the shit out of them. So, good work.

MichaelGG 13y ago
I was under the impression that undetectable steganography was extremely difficult. If commonplace steganography was widespread, no doubt they'd write analyzers to determine what things might be hiding data. On top of that, if steganography becomes widespread, it's likely the protocol will be a common one adopted by plenty of people. At that point, it reduces to encryption, does it not?
- tsaoutourpants 13y ago
  I don't see how it would be terribly difficult to undetectably (without key) hide a few bytes of data in the least significant bits of a .jpg. There are likely trillions of images available on the Internet. I would imagine less than 0.001% of them have a hidden message. This increases the "haystack" so drastically for the NSA that, even if 100x as many people started using it, it's still a big-ass haystack.
  - MichaelGG 13y ago
    At some ratio of hidden data to visible data, I'm sure it can be undetectable. But transmitting reasonable amounts of data leaves a trace using LSB algorithms. Here's one paper. It shows the LSB part of the image, which leaves an obvious looking impression. http://rahuldotgarg.appspot.com/data/steg.pdf http://rahuldotgarg.appspot.com/data/steg.pdf
    - chongli 13y ago
      This is just showing steganography with plaintext payloads. If you use only ciphertext payloads (with the keys exchanged out of band) you sidestep this problem.
      - danbruc 13y ago
        Not really. Encrypting the message will yield uniformly distributed noise and that is a very rare in nature. So if you attempt to hide an encrypted message in the least significant bits of images, audio recordings or video it is as easy to detect as plain text messages if not even easier.
        chongli 13y ago
        Then don't use every LSB in the image; use a low percentage. Just a guess, but I bet if you applied your stego detection algorithm to a large sampling of random images on the internet, you'd find a significant false positive rate. Just hide your messages in the false positives.
        danbruc 13y ago
        As already mentioned by others - hiding small amounts of data is easy, the challenge is to hide nontrivial amounts of data. There are algorithms that (try to) compensate statistical changes introduced by hiding data. One approach is to only use half of the available bit for hiding data and modifying the other half in a way to preserve a set of statistical properties. It is probably not a good idea to hide data in images available on the internet because this enables direct comparison of the same image with and without hidden data.
  - DanBC 13y ago
    This is one of the worst, easiest to detect, form of steganography. Publishers like Springer Verlag have many papers and books about detecting that type of steganography. While analysis (breaking) of steganography is long lived there hasn't been much work on creating new better forms. Just as things like PGP are still hard for regular people to use, and there's no real encrypted chat, there's not much in the way of strong stego. Obvious caveats apply here: How much does the text need to be hidden? Who does it need to be hidden from? Me hiding my angsty poetry from my sister doesn't need much and anything is going to be okay. But me hiding material that could get me killed, from a well funded government? I need something better than a reference github project.
    - Gnewt 13y ago
      > and there's no real encrypted chat What about OTP? One of the easiest things to set up and use imo, users just need to know to exchange key fingerprints over a third party medium (in person being the foolproof way).
- vezzy-fnord 13y ago
  It's true that many common forms of steganography (such as hiding information in the alpha channels of a given image) are easily detectable, and analyzers already exist, but in some aspects steganalysis is somewhat of an oxymoron, since the entire point of steganography is to conceal the fact that hidden information even exists in the first place. I'm not sure exactly how you'd define a steganographic protocol. It's not quite as straightforward as cryptography, in fact it's yet again oxymoronic. Steganography (at least ideally) works somewhat like an archetypal spy's codebook. It sounds like everyday conversation to you, unless you're meant to know it's not, and that there's a hidden meaning. If you catch something off-guard, then the stego has failed.
mcphilip 13y ago
Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law enforcement to detect, prevent and investigate illegal activities." So law enforcement is fine with encryption so long as it's crackable... [1]http://usatoday30.usatoday.com/tech/news/2001-02-05-binladen.htm http://usatoday30.usatoday.com/tech/news/2001-02-05-binladen...
- phil_2-0 13y ago
  > "Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion, You succeeded to put 3 different ethnic groups - I should say 2, the last one being an US product - in the same bag and doing then, a misleading association, fucking idiot!
  - DigitalJack 13y ago
    It was a quote.
  - dinkumthinkum 13y ago
    :( Are you one of those people that doesn't like to call things what they are? I have noticed many problems in life are due to people know wanting to call things what they are.
    - onetwofiveten 13y ago
      Are you one of those people who thinks he knows an obvious truth that everyone else ignores for some reason?
      - dinkumthinkum 13y ago
        No.
DanBC 13y ago
Most steganography is trivially easy to detect. Steganography that is implemented correctly then requires reasonable amounts of cover text, and small amounts of hidden text. NSA fucking loves steganography because most of it is a toy implementation where someone hides text in the LSB of the bytes of a gif or jpeg. The ratio of cover:hidden text is terrible. And the implementer forgot to mention that it's just a toy and not to be used seriously. The number of decently implemented steganography systems is small.
- dclusin 13y ago
  Perhaps the reason for creating this?
- chongli 13y ago
  Why use cover text? Why not just put ciphertext in a jpeg? Wouldn't that just show up as noise?
  - DanBC 13y ago
    Sorry, by cover text I mean anything that is used to hide the hidden text. Thus, the jpeg would be the cover text. Thanks for pointing that out. To answer the question: It shows up as a specific type of noise that's easy to detect. Some of the crypto / math people will be able to explain it much better than I can.
    - chongli 13y ago
      To answer the question: It shows up as a specific type of noise that's easy to detect. Some of the crypto / math people will be able to explain it much better than I can. Ahhh. What if you were to use a video instead of a still image and only use a handful of pixels (or macroblocks) in each frame, chosen randomly (the random seed exchanged out-of-band)? Seems like that would give you a very high cover:hidden text ratio.
      - jcarpio 13y ago
        I'd like to know if there's been an implementation of that. I remember reading about such a thing in William Gibson's Pattern Recognition.
dinkumthinkum 13y ago
I mean this in all seriousness ... Is there any evidence that anyone in the NSA is really that scared of stenography?
- dragonwriter 13y ago
  Stenography ≠ Steganography

MichaelGG 13y ago

I was under the impression that undetectable steganography was extremely difficult. If commonplace steganography was widespread, no doubt they'd write analyzers to determine what things might be hiding data. On top of that, if steganography becomes widespread, it's likely the protocol will be a common one adopted by plenty of people. At that point, it reduces to encryption, does it not?

tsaoutourpants 13y ago
I don't see how it would be terribly difficult to undetectably (without key) hide a few bytes of data in the least significant bits of a .jpg. There are likely trillions of images available on the Internet. I would imagine less than 0.001% of them have a hidden message. This increases the "haystack" so drastically for the NSA that, even if 100x as many people started using it, it's still a big-ass haystack.
- MichaelGG 13y ago
  At some ratio of hidden data to visible data, I'm sure it can be undetectable. But transmitting reasonable amounts of data leaves a trace using LSB algorithms. Here's one paper. It shows the LSB part of the image, which leaves an obvious looking impression. http://rahuldotgarg.appspot.com/data/steg.pdf http://rahuldotgarg.appspot.com/data/steg.pdf
  - chongli 13y ago
    This is just showing steganography with plaintext payloads. If you use only ciphertext payloads (with the keys exchanged out of band) you sidestep this problem.
    - danbruc 13y ago
      Not really. Encrypting the message will yield uniformly distributed noise and that is a very rare in nature. So if you attempt to hide an encrypted message in the least significant bits of images, audio recordings or video it is as easy to detect as plain text messages if not even easier.
      - chongli 13y ago
        Then don't use every LSB in the image; use a low percentage. Just a guess, but I bet if you applied your stego detection algorithm to a large sampling of random images on the internet, you'd find a significant false positive rate. Just hide your messages in the false positives.
        danbruc 13y ago
        As already mentioned by others - hiding small amounts of data is easy, the challenge is to hide nontrivial amounts of data. There are algorithms that (try to) compensate statistical changes introduced by hiding data. One approach is to only use half of the available bit for hiding data and modifying the other half in a way to preserve a set of statistical properties. It is probably not a good idea to hide data in images available on the internet because this enables direct comparison of the same image with and without hidden data.
- DanBC 13y ago
  This is one of the worst, easiest to detect, form of steganography. Publishers like Springer Verlag have many papers and books about detecting that type of steganography. While analysis (breaking) of steganography is long lived there hasn't been much work on creating new better forms. Just as things like PGP are still hard for regular people to use, and there's no real encrypted chat, there's not much in the way of strong stego. Obvious caveats apply here: How much does the text need to be hidden? Who does it need to be hidden from? Me hiding my angsty poetry from my sister doesn't need much and anything is going to be okay. But me hiding material that could get me killed, from a well funded government? I need something better than a reference github project.
  - Gnewt 13y ago
    > and there's no real encrypted chat What about OTP? One of the easiest things to set up and use imo, users just need to know to exchange key fingerprints over a third party medium (in person being the foolproof way).
vezzy-fnord 13y ago
It's true that many common forms of steganography (such as hiding information in the alpha channels of a given image) are easily detectable, and analyzers already exist, but in some aspects steganalysis is somewhat of an oxymoron, since the entire point of steganography is to conceal the fact that hidden information even exists in the first place. I'm not sure exactly how you'd define a steganographic protocol. It's not quite as straightforward as cryptography, in fact it's yet again oxymoronic. Steganography (at least ideally) works somewhat like an archetypal spy's codebook. It sounds like everyday conversation to you, unless you're meant to know it's not, and that there's a hidden meaning. If you catch something off-guard, then the stego has failed.

mcphilip 13y ago

Interestingly enough, stenography was already being decried pre 9/11 as a tool used by terrorists [1]: >"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law enforcement to detect, prevent and investigate illegal activities." So law enforcement is fine with encryption so long as it's crackable... [1]http://usatoday30.usatoday.com/tech/news/2001-02-05-binladen.htm http://usatoday30.usatoday.com/tech/news/2001-02-05-binladen...

phil_2-0 13y ago
> "Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion, You succeeded to put 3 different ethnic groups - I should say 2, the last one being an US product - in the same bag and doing then, a misleading association, fucking idiot!
- DigitalJack 13y ago
  It was a quote.
- dinkumthinkum 13y ago
  :( Are you one of those people that doesn't like to call things what they are? I have noticed many problems in life are due to people know wanting to call things what they are.
  - onetwofiveten 13y ago
    Are you one of those people who thinks he knows an obvious truth that everyone else ignores for some reason?
    - dinkumthinkum 13y ago
      No.

DanBC 13y ago

Most steganography is trivially easy to detect. Steganography that is implemented correctly then requires reasonable amounts of cover text, and small amounts of hidden text. NSA fucking loves steganography because most of it is a toy implementation where someone hides text in the LSB of the bytes of a gif or jpeg. The ratio of cover:hidden text is terrible. And the implementer forgot to mention that it's just a toy and not to be used seriously. The number of decently implemented steganography systems is small.

dclusin 13y ago
Perhaps the reason for creating this?
chongli 13y ago
Why use cover text? Why not just put ciphertext in a jpeg? Wouldn't that just show up as noise?
- DanBC 13y ago
  Sorry, by cover text I mean anything that is used to hide the hidden text. Thus, the jpeg would be the cover text. Thanks for pointing that out. To answer the question: It shows up as a specific type of noise that's easy to detect. Some of the crypto / math people will be able to explain it much better than I can.
  - chongli 13y ago
    To answer the question: It shows up as a specific type of noise that's easy to detect. Some of the crypto / math people will be able to explain it much better than I can. Ahhh. What if you were to use a video instead of a still image and only use a handful of pixels (or macroblocks) in each frame, chosen randomly (the random seed exchanged out-of-band)? Seems like that would give you a very high cover:hidden text ratio.
    - jcarpio 13y ago
      I'd like to know if there's been an implementation of that. I remember reading about such a thing in William Gibson's Pattern Recognition.

dinkumthinkum 13y ago

I mean this in all seriousness ... Is there any evidence that anyone in the NSA is really that scared of stenography?

dragonwriter 13y ago
Stenography ≠ Steganography