1 June 6, 2003 Steganography & Steganalysis SpyHunter www.spy-hunter.com spyhunter@spy-hunter.com
1
June
6, 2
003
Steg
anog
raph
y &
Ste
gan
alys
is
SpyH
un
ter
ww
w.s
py-
hu
nte
r.co
msp
yhu
nte
r@sp
y-h
un
ter.
com
2
Age
nda
Age
nda
Steg
anog
raph
y–
Wh
at is
Ste
gan
ogra
phy?
–H
isto
ry–
Steg
anog
raph
y to
day
–St
egan
ogra
phy
tool
s
Steg
anal
ysis
–W
hat
is S
tega
nal
ysis
?–
Iden
tifi
cati
on o
f St
egan
ogra
phic
file
s–
Cra
ckin
g St
egan
ogra
phic
file
s–
Wh
at’s
in t
he
futu
re?
3
Steg
anog
raph
y
4
Steg
anog
raph
y St
egan
ogra
phy
--D
efin
itio
nD
efin
itio
n
Steg
anog
raph
y–
from
th
e G
reek
wor
dst
egan
osm
ean
ing
“cov
ered
”–
and
the
Gre
ek w
ord
grap
hie
mea
nin
g “w
riti
ng”
Steg
anog
raph
yis
th
e pr
oces
s of
hid
ing
of a
se
cret
mes
sage
wit
hin
an
ord
inar
y m
essa
ge
and
extr
acti
ng
it a
t it
s de
stin
atio
n
An
yon
e el
se v
iew
ing
the
mes
sage
will
fai
l to
know
it c
onta
ins
hid
den
/en
cryp
ted
data
5
Steg
anog
raph
y St
egan
ogra
phy
--H
isto
ryH
isto
ry
Gre
ek h
isto
ry –
warn
ing
of
invasi
on
by
scra
wli
ng
it
on
th
e w
oo
d u
nd
ern
eath
a
wax t
ab
let.
To
casu
al
ob
serv
ers
, th
e t
ab
let
ap
peare
d b
lan
k.
Pir
ate
leg
en
ds
tell
of
the p
ract
ice o
f ta
tto
oin
g s
ecr
et
info
rmati
on
, su
ch a
s a
map
, o
n t
he h
ead
of
som
eo
ne,
so t
hat
the
hair
wo
uld
co
nce
al
it.
6
Steg
anog
raph
ySt
egan
ogra
phy
Bot
h A
xis
and
Alli
ed s
pies
du
rin
g W
orld
War
II
use
d su
ch m
easu
res
as in
visi
ble
inks
--
usi
ng
milk
, fru
it j
uic
e or
uri
ne
wh
ich
dar
ken
wh
en
hea
ted.
Invi
sibl
e In
k is
als
o a
form
of
steg
anog
raph
y
7
Steg
anog
raph
ySt
egan
ogra
phy
The
U.S
. gov
ern
men
t is
con
cern
ed a
bou
t th
e u
se o
f St
egan
ogra
phy.
Com
mon
use
s in
incl
ude
th
e di
sgu
isin
g of
co
rpor
ate
espi
onag
e.
It’s
pos
sibl
e th
at t
erro
rist
cel
ls m
ay u
se it
to
secr
etly
com
mu
nic
ate
info
rmat
ion
It’s
als
o a
very
goo
d A
nti
-for
ensi
cs m
ech
anis
m
to m
itig
ate
the
effe
ctiv
enes
s of
a f
oren
sics
in
vest
igat
ion
8
Steg
anog
raph
ySt
egan
ogra
phy
Terr
or g
roup
s hid
e be
hind
Web
enc
rypt
ion
By
Jack
Kel
ley,
USA
TO
DA
Y AP
WA
SHIN
GT
ON
—H
idd
en in
th
e X
-rat
ed p
ictu
res
on s
ever
al p
orn
ogra
ph
ic W
eb
site
s an
d t
he
pos
ted
com
men
ts o
n s
por
ts c
hat
roo
ms
may
lie
the
encr
ypte
d
blu
epri
nts
of
the
nex
t te
rror
ist
atta
ck a
gain
st t
he
Un
ited
Sta
tes
or it
s al
lies.
It
sou
nd
s fa
rfet
ched
, bu
t U
.S. o
ffic
ials
an
d e
xper
ts s
ay it
's t
he
late
st m
eth
od o
f co
mm
un
icat
ion
bei
ng
use
d b
yO
sam
ab
in L
aden
an
d h
is a
ssoc
iate
s to
ou
tfox
law
en
forc
emen
t. B
in L
aden
, in
dic
ted
in t
he
bom
bin
g in
199
8 of
tw
o U
.S. e
mb
assi
es in
E
ast
Afr
ica,
an
d o
ther
s ar
e h
idin
g m
aps
and
ph
otog
rap
hs
of t
erro
rist
tar
gets
an
d
pos
tin
g in
stru
ctio
ns
for
terr
oris
t ac
tivi
ties
on
sp
orts
ch
at r
oom
s, p
orn
ogra
ph
ic
bu
lleti
n b
oard
s an
d o
ther
Web
sit
es, U
.S. a
nd
for
eign
off
icia
ls s
ay.
9
Steg
anog
raph
ySt
egan
ogra
phy
Steg
anog
raph
yh
as a
lso
been
pop
ula
rize
d in
m
ovie
s
–Th
e Sa
int,
Val
Kilm
er
–A
lon
g C
ame
a Sp
ider
, Mor
gan
Fre
eman
10
Steg
anog
raph
ySt
egan
ogra
phy
Mod
ern
dig
ital
ste
gan
ogra
phy
–da
ta is
en
cryp
ted
–th
en in
sert
ed, u
sin
g a
spec
ial a
lgor
ith
mw
hic
h
may
add
an
d/or
mod
ify
the
con
ten
ts o
f th
e fi
le
–C
aref
ully
cra
fted
pro
gram
s ap
ply
the
encr
ypte
d da
ta s
uch
th
at p
atte
rns
appe
ar n
orm
al.
11
Steg
anog
raph
y St
egan
ogra
phy
––M
oder
n D
ayM
oder
n D
ay
Car
rier F
ileC
arrie
r File
with
Hid
den
Mes
sage
12
Steg
anog
raph
y St
egan
ogra
phy
––C
arri
er F
iles
Car
rier
File
s
Steg
anog
raph
y C
arri
er F
iles
bmp
jpeg
gif
wav
mp3
Am
ongs
t ot
her
s…
13
Steg
anog
raph
y St
egan
ogra
phy
--To
ols
Tool
s
Steg
anog
raph
y To
ols
Steg
anos
S-To
ols
(GIF
, JP
EG)
Steg
Hid
e (W
AV
, BM
P)
Invi
sibl
e Se
cret
s (J
PEG
)
JPH
ide
Cam
oufl
age
Hid
erm
an
Man
y ot
her
s…
14
Steg
anog
raph
ySt
egan
ogra
phy
Pop
ula
r si
tes
for
Steg
anog
raph
y in
form
atio
n–
htt
p://
ww
w.is
e.gm
u.e
du/~
njo
hn
son
/Ste
gan
ogra
phy
–h
ttp:
//w
ww
.rh
etor
ic.u
mn
.edu
/Rh
etor
ic/m
isc/
dfra
nk/
steg
soft
.htm
l
–h
ttp:
//w
ww
.top
olog
y.or
g/cr
ypto
.htm
l
15
Steg
anal
ysis
Iden
tifi
cati
on o
f h
idd
en f
iles
16
Steg
anal
ysis
St
egan
alys
is --
Def
init
ion
Def
init
ion
Def
init
ion
–Id
entif
ying
the
exi
sten
ce o
f a
mes
sage
–N
otex
trac
ting
the
mes
sage
–N
ote:
Tec
hnic
ally
, Ste
gano
grap
hyde
als
with
the
co
ncea
lmen
t of
a m
essa
ge, n
ot t
he e
ncry
ptio
n of
it
How
is t
his
mea
nin
gfu
l???
17
Steg
anal
ysis
Steg
anal
ysis
By
iden
tify
ing
the
exis
ten
ce o
f a
hid
den
m
essa
ge, p
erh
aps
we
can
iden
tify
th
e to
ols
use
d to
hid
e it
.
If w
e id
enti
fy t
he
tool
, per
hap
s w
e ca
n u
se
that
too
l to
extr
act
the
orig
inal
mes
sage
.
18
Steg
anal
ysis
St
egan
alys
is ––
Met
hod
s of
Det
ecti
onM
eth
ods
of D
etec
tion
Met
hod
s of
det
ecti
ng
the
use
of
Steg
anog
raph
y–
View
it (
JPEG
, BM
P, G
IF, e
tc.)
–Li
sten
to
it (W
AV, M
PEG
, etc
.)–
Stat
istic
al A
ttac
k (c
hang
es in
pat
tern
s of
the
pix
els
or
LSB
–Le
ast
Sign
ifica
nt B
it) o
r H
isto
gram
Ana
lysi
s–
View
file
pro
pert
ies/
cont
ents
size
diff
eren
ceda
te/t
ime
diff
eren
ceco
nten
ts –
mod
ifica
tions
chec
ksum
19
Steg
anal
ysis
St
egan
alys
is ––
Met
hod
s of
An
alys
isM
eth
ods
of A
nal
ysis
Det
ecti
ng
Steg
anog
raph
y by
vie
win
g it
Can
you
see
a d
iffe
ren
ce in
th
ese
two
pict
ure
s?
(I c
an’t
!)
20
Steg
anal
ysis
St
egan
alys
is ––
His
togr
am A
nal
ysis
His
togr
am A
nal
ysis
His
togr
am a
nal
ysis
can
be
use
d to
pos
sibl
y id
enti
fy a
file
wit
h a
hid
den
mes
sage
21
Steg
anal
ysis
St
egan
alys
is ––
His
togr
am A
nal
ysis
His
togr
am A
nal
ysis
By
com
pari
ng
his
togr
ams,
we
can
see
th
is
his
togr
am h
as a
ver
y n
otic
eabl
e re
peti
tive
tr
end.
22
Steg
anal
ysis
St
egan
alys
is ––
Com
pare
pro
pert
ies
Com
pare
pro
pert
ies
Com
pare
th
e pr
oper
ties
of
the
file
s
Pro
pert
ies
–0
4/0
4/2
00
3 0
5:2
5p
24
0,7
59
hel
met
prot
otyp
e.jp
g–
04
/04
/20
03
05
:26
p 2
35
,75
0h
elm
etpr
otot
ype.
jpg
Ch
ecks
um
–C
:\G
NU
To
ols
>ck
sum
a:\
helm
etp
roto
typ
e.j
pg
37
49
29
06
33
23
57
50
a:\
helm
etp
roto
typ
e.j
pg
–C
:\G
NU
To
ols
>ck
sum
a:\
befo
re\
helm
etp
roto
typ
e.j
pg
32
41
69
04
97
24
07
59
a:\
befo
re\
helm
etp
roto
typ
e.j
pg
23
Steg
anal
ysis
St
egan
alys
is ––
An
alyz
ing
con
ten
ts o
f fi
leA
nal
yzin
g co
nte
nts
of
file
Vie
win
g th
e co
nte
nts
of
the
file
–If
you
hav
e th
e co
py o
f th
e or
igin
al p
ictu
re,
it c
an b
e co
mpa
red
to t
he
mod
ifie
d su
spec
t fi
le
–Id
enti
fy in
con
sist
enci
es
–Id
enti
fy a
sig
nat
ure
pat
tern
ass
ocia
ted
wit
h
a sp
ecif
ic s
tega
nog
raph
icto
ol
24
Steg
anal
ysis
St
egan
alys
is ––
An
alyz
ing
con
ten
ts o
f fi
leA
nal
yzin
g co
nte
nts
of
file
Iden
tify
ing
the
pres
ence
of
a h
idde
n m
essa
ge
Man
y to
ols
can
be
use
d fo
r vi
ewin
g an
d co
mpa
rin
g th
e co
nte
nts
of
a h
idde
n f
ile.
Ever
yth
ing
from
Not
epad
to
a H
ex E
dito
r ca
n
be u
sed
Rev
iew
ing
mu
tipl
e fi
les
gen
erat
ed f
rom
th
e sa
me
prog
ram
may
rev
eal a
sig
nat
ure
!
25
Steg
anal
ysis
St
egan
alys
is ––
An
alyz
ing
con
ten
ts o
f fi
leA
nal
yzin
g co
nte
nts
of
file
Win
Hex
An
alys
is
26
Steg
anal
ysis
St
egan
alys
is ––
Iden
tify
ing
a si
gnat
ure
Iden
tify
ing
a si
gnat
ure
Iden
tify
ing
the
sign
atu
re–
Win
Hex
is v
ery
help
ful f
or id
entif
ying
the
diff
eren
ces
betw
een
two
files
to
dete
rmin
e w
hat
was
mod
ified
and
/or
adde
d.–
Not
epad
can
the
n ut
ilize
d to
rev
eal t
he s
igna
ture
str
ing
adde
d to
th
e fil
e
27
Steg
anal
ysis
St
egan
alys
is ––
Iden
tify
ing
a si
gnat
ure
Iden
tify
ing
a si
gnat
ure
Sign
atu
re f
oun
d!
Sign
atu
re-b
ased
ste
gan
alys
is w
as u
sed
to
iden
tify
sig
nat
ure
s in
man
y pr
ogra
ms
incl
udi
ng
Invi
sibl
e Se
cret
s, J
PH
ide,
Hid
erm
an, e
tc.
28
Steg
anal
ysis
St
egan
alys
is --
Steg
spy
Steg
spy
Sign
atu
re f
oun
d!–
Steg
spy.
pl s
earc
hes
for
steg
o si
gnat
ures
and
det
erm
ines
the
pr
ogra
m u
sed
to h
ide
the
mes
sage
–W
ill b
e av
aila
ble
for
dow
nloa
d fr
om m
y si
te–
Exam
ple:
29
Steg
anal
ysis
St
egan
alys
is ––
Iden
tify
ing
a si
gnat
ure
Iden
tify
ing
a si
gnat
ure
How
is t
his
han
dy?
No
orig
inal
file
to
com
pare
it t
o
Sear
ch f
or t
he
sign
atu
re p
atte
rn t
o de
term
ine
a pr
esen
ce o
f a
hid
den
mes
sage
Sign
atu
re r
evea
ls p
rogr
am u
sed
to h
ide
the
mes
sage
!
30
Steg
anal
ysis
St
egan
alys
is m
eets
Cry
ptan
alys
ism
eets
Cry
ptan
alys
is
Cry
ptan
alys
is
As
stat
ed p
revi
ousl
y, in
Steg
anog
raph
yth
e go
al is
to
hid
e th
e m
essa
ge, N
OT
encr
ypt
it
Cry
ptog
raph
y pr
ovid
es t
he
mea
ns
to e
ncr
ypt
the
mes
sage
.
How
do
we
reve
al t
he
hid
den
mes
sage
?
31
Steg
anal
ysis
St
egan
alys
is m
eets
Cry
ptan
alys
ism
eets
Cry
ptan
alys
is
Kn
owin
g th
e st
egan
ogra
phy
prog
ram
use
d to
h
ide
the
mes
sage
can
be
extr
emel
y h
andy
w
hen
att
empt
ing
to r
evea
l th
e ac
tual
hid
den
m
essa
ge
Un
fort
un
atel
y, s
ome
of t
hes
e pr
ogra
ms
use
st
ron
g en
cryp
tion
12
8-b
it o
r st
ron
ger
–G
OO
D
LUC
K!
The
only
th
ing
we
nee
d is
th
e P
ASS
WO
RD
!
32
Steg
anal
ysis
St
egan
alys
is m
eets
Cry
ptan
alys
ism
eets
Cry
ptan
alys
is
A f
ew B
rute
For
ce p
assw
ord
grin
din
g pr
ogra
ms
hav
e be
en c
reat
ed.
Steg
brea
k by
Nie
ls P
rovo
s, w
ww
.ou
tgu
ess.
org
–J-
Steg
33
Cam
oufl
age
Cam
oufl
age
––C
ase
Stu
dyC
ase
Stu
dy
Det
erm
inin
g th
e pa
ssw
ord
use
d w
ith
C
amou
flag
e
The
loca
tion
of
the
pass
wor
d w
as d
eter
min
ed
by u
sin
g M
ult
iHex
wh
ich
allo
ws
sear
ches
for
H
ex s
trin
gs
34
Cam
oufl
age
Cam
oufl
age
The
stri
ng
was
fou
nd
to b
e “7
6 F
0 0
9 5
6”
The
pass
wor
d is
kn
ow t
o be
“te
st”
wh
ich
is “
74
65
73
74”
in H
ex
35
BD
HTo
olB
DH
Tool
Usi
ng
BD
HTo
olw
e ca
n X
OR
th
e tw
o to
rev
eal
the
key
36
Cam
oufl
age
Cam
oufl
age
76 X
OR
74
= 0
2
F0 X
OR
65=
95
09 X
OR
73
= 7
A
56 X
OR
74
= 2
2
The
1st
4 d
igit
s of
th
e ke
y ar
e “0
2 9
5 7
A 2
2”
So le
t’s
test
ou
r th
eory
…
37
Cam
oufl
age
Cam
oufl
age
We
stor
e an
oth
er m
essa
ge u
sin
g a
diff
eren
t pa
ssw
ord
The
file
rev
eals
a H
ex c
ode
of “
63
F4
1B
43
”
We
XO
R t
his
wit
h t
he
know
n k
ey “
02
95
7A
22
”
The
resu
lt is
“6
1 6
1 6
1 6
1”
wh
ich
is a
pa
ssw
ord
of “
aaaa
” in
ASC
II
We’
ve r
evea
led
the
hid
den
pas
swor
d to
hid
e th
e m
essa
ge!
This
exp
loit
dis
cove
red
by G
uill
erm
ito
at
ww
w.g
uill
erm
ito2
.net
38
Hid
erm
an
Hid
erm
an ––
Cas
e St
udy
Cas
e St
udy
Let’
s ex
amin
e a
slig
htl
y m
ore
soph
isti
cate
d st
ego
prog
ram
–H
ider
man
39
Hid
erm
anH
ider
man
Aft
er h
idin
g a
mes
sage
wit
h H
ider
man
, we
can
re
view
th
e fi
le w
ith
ou
r fa
vori
te H
ex T
ool.
This
re
veal
s th
at t
he
mes
sage
is e
ncr
ypte
d an
d ap
pen
ded
to t
he
end
of t
he
file
.
40
Hid
erm
anH
ider
man
Extr
acti
ng
the
hid
den
mes
sage
we
hav
e
49 F
3 09
6B
65
E4 0
2 7A
7A
ED
5D
74
78 F
A 3
8
20 6
C F
E 03
65
20 E
F 09
7A
7A
61
21
In A
SCII
we
hav
e: I
??ke
??zz
??tx
??l?
?e ?
?zza
!
Ever
do
a cr
ypto
gram
???
41
Hid
erm
anH
ider
man
Dec
iph
erin
g th
e co
de:
The
firs
t pa
rt is
th
e fi
le n
ame:
I??k
e??z
z??t
x? =
I??
ke??
zz?.
txt
The
seco
nd
part
is t
he
mes
sage
:
?l??
e ??
zza!
42
Hid
erm
anH
ider
man
Man
y ke
ys a
re b
ased
on
th
e pa
ssw
ord
Ass
um
ing
the
file
nam
e is
Ilik
epiz
za.t
xt a
nd
the
mes
sage
is “
I lik
e pi
zza!
”, w
e ca
n r
ever
se e
ngi
nee
r th
is
We
con
vert
eve
ryth
ing
to it
’s a
ctu
al A
SCII
equ
ival
ent:
49
6C
69
6B
65
70
69
7A
7A
61
2E
74
78
74
49
20
6C
69
6B
65
20
70
69
7A
7A
61
21
I l i
k e
p i
z z
a . t
x t
I
l i k
e
p i z
z a
!
43
Hid
erm
anH
ider
man
Ori
gin
al
49
F3
09
6B
65
E4
02
7A
7A
ED
5D
74
78
FA
38
20
6C
FE
03
65
20
EF
09
7A
7A
61
21
Dec
iph
ered
49
6C
69
6B
65
70
69
7A
7A
61
2E
74
78
74
49
20
6C
69
6B
65
20
70
69
7A
7A
61
21
If w
e ta
ke e
ach
cip
her
ed c
har
acte
r an
d X
OR
it w
ith
th
e ac
tual
res
ult
, we
can
rev
eal t
he k
ey w
hic
h in
th
is c
ase
is
the
pass
wor
d
F3 X
OR
6C
= 9
F
09
XO
R 6
9 =
69
An
d pe
rfor
m t
he
sam
e fo
r th
e re
mai
nin
g ch
arac
ters
44
Hid
erm
anH
ider
man
The
resu
ltan
t is
th
e ke
y
9F 6
0 9
4 6B
8C
73
8E
71 9
7 68
60 is
011
0000
0 in
bin
ary
Ru
nn
ing
that
th
rou
gh t
he
NO
T lo
gic
give
s u
s 1
00
11
11
1 w
hic
h is
9F
in H
EX
So 9
F N
OT
= 6
0, 9
4 N
OT
= 6
B, a
nd
so f
orth
Sam
e is
for
th
e re
mai
nin
g ch
arac
ters
45
Hid
erm
anH
ider
man
Toss
ing
asid
e th
e N
OT
tran
sfor
ms,
th
at le
aves
u
s w
ith
60
6B
73
71
68
Add
ing
1 t
o ea
ch w
e h
ave
61
6C
74
72
69
We
con
vert
th
is t
o A
SCII
=>
alt
ri
An
d ro
tate
th
e le
tter
s =
> t
rial
We
fou
nd
the
pass
wor
d!
Mor
e in
form
atio
n o
n m
y pe
rson
al s
ite
ww
w.s
py-h
un
ter.
com
46
Steg
anal
ysis
St
egan
alys
is ––
Futu
re?
Futu
re?
Wh
ere
do w
e go
fro
m h
ere?
My
prog
ram
Steg
spy
curr
entl
y id
enti
fies
JP
Hid
e,
Hid
erm
an, a
nd
Invi
sibl
e Se
cret
s. M
ore
to c
ome!
Wri
te a
pro
gram
to
crac
k w
eak
Steg
o pr
ogra
ms
Nee
d a
pass
wor
d gr
inde
r, m
ay v
ary
depe
ndi
ng
on t
he
Steg
o pr
ogra
m (
steg
brea
k al
read
y av
aila
ble)
Stat
isti
cal a
nal
ysis
has
bee
n p
erfo
rmed
an
d is
als
o ca
pabl
e of
det
ecti
ng
Steg
anog
raph
ic p
rogr
ams
(his
togr
am, L
SB, e
tc)
47
Steg
anal
ysis
St
egan
alys
is ––
Oth
er T
ools
Oth
er T
ools
Wet
ston
e Te
chn
olog
ies
offe
rs S
tego
Wat
chId
enti
fies
th
e pr
esen
ce o
f st
egan
ogra
phy
thro
ugh
sp
ecia
l sta
tist
ical
an
d an
alyt
ical
pro
gram
s.
Acc
ura
te a
nd
com
preh
ensi
ve t
ool,
also
ver
y ex
pen
sive
!
Doe
s n
ot a
ttem
pt t
o cr
ack
or r
evea
l th
e h
idde
n m
essa
ge,
mer
ely
iden
tifi
es it
Off
er a
Ste
gan
ogra
phy
Inve
stig
ator
Tra
inin
g C
ours
e
See
htt
p://
ww
w.w
etst
onet
ech
.com
48
Steg
anal
ysis
St
egan
alys
is ––
Oth
er T
ools
Oth
er T
ools
Steg
dete
ct b
y N
iels
Pro
vos
Ava
ilabl
e at
htt
p://
ww
w.o
utg
ues
s.or
g/de
tect
ion
.ph
p
Det
ects
–js
teg
–jp
hide
(uni
xan
d w
indo
ws)
–
invi
sibl
e se
cret
s–
outg
uess
01.
3b
–F5
(he
ader
ana
lysi
s)–
appe
ndX
and
cam
oufla
ge
Site
dow
n d
ue
to S
tate
of
Mic
hig
an la
w!
49
Ref
eren
ces
Ref
eren
ces
Steg
anog
raph
ica,
Gas
pari
Sch
otti
, 16
65
Dis
appe
arin
g C
rypt
ogra
phy,
Pet
er W
ayn
er,
2002
Hid
ing
in P
lain
Sig
ht,
Eri
c C
ole
20
03
Steg
anog
raph
y –
pres
enta
tion
Ch
et H
osm
er,
Wet
ston
e Te
chn
olog
ies,
Tec
hn
oSec
uri
ty2
00
3
50
Qu
esti
on a
nd
An
swer
wit
h S
pyH
un
ter
ww
w.s
py-
hu
nte
r.co
msp
yhu
nte
r@sp
y-h
un
ter.
com