Top Banner
1 June 6, 2003 Steganography & Steganalysis SpyHunter www.spy-hunter.com [email protected]
50

Steganography & Steganalysis - · PDF fileSteganography & Steganalysis SpyHunter [email protected]. 2 ... word steganos meaning ... appeared blank. X

Mar 27, 2018

Download

Documents

phamdan
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

1

June

6, 2

003

Steg

anog

raph

y &

Ste

gan

alys

is

SpyH

un

ter

ww

w.s

py-

hu

nte

r.co

msp

yhu

nte

r@sp

y-h

un

ter.

com

Page 2: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

2

Age

nda

Age

nda

Steg

anog

raph

y–

Wh

at is

Ste

gan

ogra

phy?

–H

isto

ry–

Steg

anog

raph

y to

day

–St

egan

ogra

phy

tool

s

Steg

anal

ysis

–W

hat

is S

tega

nal

ysis

?–

Iden

tifi

cati

on o

f St

egan

ogra

phic

file

s–

Cra

ckin

g St

egan

ogra

phic

file

s–

Wh

at’s

in t

he

futu

re?

Page 3: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

3

Steg

anog

raph

y

Page 4: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

4

Steg

anog

raph

y St

egan

ogra

phy

--D

efin

itio

nD

efin

itio

n

Steg

anog

raph

y–

from

th

e G

reek

wor

dst

egan

osm

ean

ing

“cov

ered

”–

and

the

Gre

ek w

ord

grap

hie

mea

nin

g “w

riti

ng”

Steg

anog

raph

yis

th

e pr

oces

s of

hid

ing

of a

se

cret

mes

sage

wit

hin

an

ord

inar

y m

essa

ge

and

extr

acti

ng

it a

t it

s de

stin

atio

n

An

yon

e el

se v

iew

ing

the

mes

sage

will

fai

l to

know

it c

onta

ins

hid

den

/en

cryp

ted

data

Page 5: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

5

Steg

anog

raph

y St

egan

ogra

phy

--H

isto

ryH

isto

ry

Gre

ek h

isto

ry –

warn

ing

of

invasi

on

by

scra

wli

ng

it

on

th

e w

oo

d u

nd

ern

eath

a

wax t

ab

let.

To

casu

al

ob

serv

ers

, th

e t

ab

let

ap

peare

d b

lan

k.

Pir

ate

leg

en

ds

tell

of

the p

ract

ice o

f ta

tto

oin

g s

ecr

et

info

rmati

on

, su

ch a

s a

map

, o

n t

he h

ead

of

som

eo

ne,

so t

hat

the

hair

wo

uld

co

nce

al

it.

Page 6: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

6

Steg

anog

raph

ySt

egan

ogra

phy

Bot

h A

xis

and

Alli

ed s

pies

du

rin

g W

orld

War

II

use

d su

ch m

easu

res

as in

visi

ble

inks

--

usi

ng

milk

, fru

it j

uic

e or

uri

ne

wh

ich

dar

ken

wh

en

hea

ted.

Invi

sibl

e In

k is

als

o a

form

of

steg

anog

raph

y

Page 7: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

7

Steg

anog

raph

ySt

egan

ogra

phy

The

U.S

. gov

ern

men

t is

con

cern

ed a

bou

t th

e u

se o

f St

egan

ogra

phy.

Com

mon

use

s in

incl

ude

th

e di

sgu

isin

g of

co

rpor

ate

espi

onag

e.

It’s

pos

sibl

e th

at t

erro

rist

cel

ls m

ay u

se it

to

secr

etly

com

mu

nic

ate

info

rmat

ion

It’s

als

o a

very

goo

d A

nti

-for

ensi

cs m

ech

anis

m

to m

itig

ate

the

effe

ctiv

enes

s of

a f

oren

sics

in

vest

igat

ion

Page 8: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

8

Steg

anog

raph

ySt

egan

ogra

phy

Terr

or g

roup

s hid

e be

hind

Web

enc

rypt

ion

By

Jack

Kel

ley,

USA

TO

DA

Y AP

WA

SHIN

GT

ON

—H

idd

en in

th

e X

-rat

ed p

ictu

res

on s

ever

al p

orn

ogra

ph

ic W

eb

site

s an

d t

he

pos

ted

com

men

ts o

n s

por

ts c

hat

roo

ms

may

lie

the

encr

ypte

d

blu

epri

nts

of

the

nex

t te

rror

ist

atta

ck a

gain

st t

he

Un

ited

Sta

tes

or it

s al

lies.

It

sou

nd

s fa

rfet

ched

, bu

t U

.S. o

ffic

ials

an

d e

xper

ts s

ay it

's t

he

late

st m

eth

od o

f co

mm

un

icat

ion

bei

ng

use

d b

yO

sam

ab

in L

aden

an

d h

is a

ssoc

iate

s to

ou

tfox

law

en

forc

emen

t. B

in L

aden

, in

dic

ted

in t

he

bom

bin

g in

199

8 of

tw

o U

.S. e

mb

assi

es in

E

ast

Afr

ica,

an

d o

ther

s ar

e h

idin

g m

aps

and

ph

otog

rap

hs

of t

erro

rist

tar

gets

an

d

pos

tin

g in

stru

ctio

ns

for

terr

oris

t ac

tivi

ties

on

sp

orts

ch

at r

oom

s, p

orn

ogra

ph

ic

bu

lleti

n b

oard

s an

d o

ther

Web

sit

es, U

.S. a

nd

for

eign

off

icia

ls s

ay.

Page 9: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

9

Steg

anog

raph

ySt

egan

ogra

phy

Steg

anog

raph

yh

as a

lso

been

pop

ula

rize

d in

m

ovie

s

–Th

e Sa

int,

Val

Kilm

er

–A

lon

g C

ame

a Sp

ider

, Mor

gan

Fre

eman

Page 10: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

10

Steg

anog

raph

ySt

egan

ogra

phy

Mod

ern

dig

ital

ste

gan

ogra

phy

–da

ta is

en

cryp

ted

–th

en in

sert

ed, u

sin

g a

spec

ial a

lgor

ith

mw

hic

h

may

add

an

d/or

mod

ify

the

con

ten

ts o

f th

e fi

le

–C

aref

ully

cra

fted

pro

gram

s ap

ply

the

encr

ypte

d da

ta s

uch

th

at p

atte

rns

appe

ar n

orm

al.

Page 11: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

11

Steg

anog

raph

y St

egan

ogra

phy

––M

oder

n D

ayM

oder

n D

ay

Car

rier F

ileC

arrie

r File

with

Hid

den

Mes

sage

Page 12: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

12

Steg

anog

raph

y St

egan

ogra

phy

––C

arri

er F

iles

Car

rier

File

s

Steg

anog

raph

y C

arri

er F

iles

bmp

jpeg

gif

wav

mp3

Am

ongs

t ot

her

s…

Page 13: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

13

Steg

anog

raph

y St

egan

ogra

phy

--To

ols

Tool

s

Steg

anog

raph

y To

ols

Steg

anos

S-To

ols

(GIF

, JP

EG)

Steg

Hid

e (W

AV

, BM

P)

Invi

sibl

e Se

cret

s (J

PEG

)

JPH

ide

Cam

oufl

age

Hid

erm

an

Man

y ot

her

s…

Page 14: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

14

Steg

anog

raph

ySt

egan

ogra

phy

Pop

ula

r si

tes

for

Steg

anog

raph

y in

form

atio

n–

htt

p://

ww

w.is

e.gm

u.e

du/~

njo

hn

son

/Ste

gan

ogra

phy

–h

ttp:

//w

ww

.rh

etor

ic.u

mn

.edu

/Rh

etor

ic/m

isc/

dfra

nk/

steg

soft

.htm

l

–h

ttp:

//w

ww

.top

olog

y.or

g/cr

ypto

.htm

l

Page 15: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

15

Steg

anal

ysis

Iden

tifi

cati

on o

f h

idd

en f

iles

Page 16: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

16

Steg

anal

ysis

St

egan

alys

is --

Def

init

ion

Def

init

ion

Def

init

ion

–Id

entif

ying

the

exi

sten

ce o

f a

mes

sage

–N

otex

trac

ting

the

mes

sage

–N

ote:

Tec

hnic

ally

, Ste

gano

grap

hyde

als

with

the

co

ncea

lmen

t of

a m

essa

ge, n

ot t

he e

ncry

ptio

n of

it

How

is t

his

mea

nin

gfu

l???

Page 17: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

17

Steg

anal

ysis

Steg

anal

ysis

By

iden

tify

ing

the

exis

ten

ce o

f a

hid

den

m

essa

ge, p

erh

aps

we

can

iden

tify

th

e to

ols

use

d to

hid

e it

.

If w

e id

enti

fy t

he

tool

, per

hap

s w

e ca

n u

se

that

too

l to

extr

act

the

orig

inal

mes

sage

.

Page 18: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

18

Steg

anal

ysis

St

egan

alys

is ––

Met

hod

s of

Det

ecti

onM

eth

ods

of D

etec

tion

Met

hod

s of

det

ecti

ng

the

use

of

Steg

anog

raph

y–

View

it (

JPEG

, BM

P, G

IF, e

tc.)

–Li

sten

to

it (W

AV, M

PEG

, etc

.)–

Stat

istic

al A

ttac

k (c

hang

es in

pat

tern

s of

the

pix

els

or

LSB

–Le

ast

Sign

ifica

nt B

it) o

r H

isto

gram

Ana

lysi

s–

View

file

pro

pert

ies/

cont

ents

size

diff

eren

ceda

te/t

ime

diff

eren

ceco

nten

ts –

mod

ifica

tions

chec

ksum

Page 19: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

19

Steg

anal

ysis

St

egan

alys

is ––

Met

hod

s of

An

alys

isM

eth

ods

of A

nal

ysis

Det

ecti

ng

Steg

anog

raph

y by

vie

win

g it

Can

you

see

a d

iffe

ren

ce in

th

ese

two

pict

ure

s?

(I c

an’t

!)

Page 20: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

20

Steg

anal

ysis

St

egan

alys

is ––

His

togr

am A

nal

ysis

His

togr

am A

nal

ysis

His

togr

am a

nal

ysis

can

be

use

d to

pos

sibl

y id

enti

fy a

file

wit

h a

hid

den

mes

sage

Page 21: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

21

Steg

anal

ysis

St

egan

alys

is ––

His

togr

am A

nal

ysis

His

togr

am A

nal

ysis

By

com

pari

ng

his

togr

ams,

we

can

see

th

is

his

togr

am h

as a

ver

y n

otic

eabl

e re

peti

tive

tr

end.

Page 22: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

22

Steg

anal

ysis

St

egan

alys

is ––

Com

pare

pro

pert

ies

Com

pare

pro

pert

ies

Com

pare

th

e pr

oper

ties

of

the

file

s

Pro

pert

ies

–0

4/0

4/2

00

3 0

5:2

5p

24

0,7

59

hel

met

prot

otyp

e.jp

g–

04

/04

/20

03

05

:26

p 2

35

,75

0h

elm

etpr

otot

ype.

jpg

Ch

ecks

um

–C

:\G

NU

To

ols

>ck

sum

a:\

helm

etp

roto

typ

e.j

pg

37

49

29

06

33

23

57

50

a:\

helm

etp

roto

typ

e.j

pg

–C

:\G

NU

To

ols

>ck

sum

a:\

befo

re\

helm

etp

roto

typ

e.j

pg

32

41

69

04

97

24

07

59

a:\

befo

re\

helm

etp

roto

typ

e.j

pg

Page 23: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

23

Steg

anal

ysis

St

egan

alys

is ––

An

alyz

ing

con

ten

ts o

f fi

leA

nal

yzin

g co

nte

nts

of

file

Vie

win

g th

e co

nte

nts

of

the

file

–If

you

hav

e th

e co

py o

f th

e or

igin

al p

ictu

re,

it c

an b

e co

mpa

red

to t

he

mod

ifie

d su

spec

t fi

le

–Id

enti

fy in

con

sist

enci

es

–Id

enti

fy a

sig

nat

ure

pat

tern

ass

ocia

ted

wit

h

a sp

ecif

ic s

tega

nog

raph

icto

ol

Page 24: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

24

Steg

anal

ysis

St

egan

alys

is ––

An

alyz

ing

con

ten

ts o

f fi

leA

nal

yzin

g co

nte

nts

of

file

Iden

tify

ing

the

pres

ence

of

a h

idde

n m

essa

ge

Man

y to

ols

can

be

use

d fo

r vi

ewin

g an

d co

mpa

rin

g th

e co

nte

nts

of

a h

idde

n f

ile.

Ever

yth

ing

from

Not

epad

to

a H

ex E

dito

r ca

n

be u

sed

Rev

iew

ing

mu

tipl

e fi

les

gen

erat

ed f

rom

th

e sa

me

prog

ram

may

rev

eal a

sig

nat

ure

!

Page 25: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

25

Steg

anal

ysis

St

egan

alys

is ––

An

alyz

ing

con

ten

ts o

f fi

leA

nal

yzin

g co

nte

nts

of

file

Win

Hex

An

alys

is

Page 26: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

26

Steg

anal

ysis

St

egan

alys

is ––

Iden

tify

ing

a si

gnat

ure

Iden

tify

ing

a si

gnat

ure

Iden

tify

ing

the

sign

atu

re–

Win

Hex

is v

ery

help

ful f

or id

entif

ying

the

diff

eren

ces

betw

een

two

files

to

dete

rmin

e w

hat

was

mod

ified

and

/or

adde

d.–

Not

epad

can

the

n ut

ilize

d to

rev

eal t

he s

igna

ture

str

ing

adde

d to

th

e fil

e

Page 27: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

27

Steg

anal

ysis

St

egan

alys

is ––

Iden

tify

ing

a si

gnat

ure

Iden

tify

ing

a si

gnat

ure

Sign

atu

re f

oun

d!

Sign

atu

re-b

ased

ste

gan

alys

is w

as u

sed

to

iden

tify

sig

nat

ure

s in

man

y pr

ogra

ms

incl

udi

ng

Invi

sibl

e Se

cret

s, J

PH

ide,

Hid

erm

an, e

tc.

Page 28: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

28

Steg

anal

ysis

St

egan

alys

is --

Steg

spy

Steg

spy

Sign

atu

re f

oun

d!–

Steg

spy.

pl s

earc

hes

for

steg

o si

gnat

ures

and

det

erm

ines

the

pr

ogra

m u

sed

to h

ide

the

mes

sage

–W

ill b

e av

aila

ble

for

dow

nloa

d fr

om m

y si

te–

Exam

ple:

Page 29: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

29

Steg

anal

ysis

St

egan

alys

is ––

Iden

tify

ing

a si

gnat

ure

Iden

tify

ing

a si

gnat

ure

How

is t

his

han

dy?

No

orig

inal

file

to

com

pare

it t

o

Sear

ch f

or t

he

sign

atu

re p

atte

rn t

o de

term

ine

a pr

esen

ce o

f a

hid

den

mes

sage

Sign

atu

re r

evea

ls p

rogr

am u

sed

to h

ide

the

mes

sage

!

Page 30: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

30

Steg

anal

ysis

St

egan

alys

is m

eets

Cry

ptan

alys

ism

eets

Cry

ptan

alys

is

Cry

ptan

alys

is

As

stat

ed p

revi

ousl

y, in

Steg

anog

raph

yth

e go

al is

to

hid

e th

e m

essa

ge, N

OT

encr

ypt

it

Cry

ptog

raph

y pr

ovid

es t

he

mea

ns

to e

ncr

ypt

the

mes

sage

.

How

do

we

reve

al t

he

hid

den

mes

sage

?

Page 31: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

31

Steg

anal

ysis

St

egan

alys

is m

eets

Cry

ptan

alys

ism

eets

Cry

ptan

alys

is

Kn

owin

g th

e st

egan

ogra

phy

prog

ram

use

d to

h

ide

the

mes

sage

can

be

extr

emel

y h

andy

w

hen

att

empt

ing

to r

evea

l th

e ac

tual

hid

den

m

essa

ge

Un

fort

un

atel

y, s

ome

of t

hes

e pr

ogra

ms

use

st

ron

g en

cryp

tion

12

8-b

it o

r st

ron

ger

–G

OO

D

LUC

K!

The

only

th

ing

we

nee

d is

th

e P

ASS

WO

RD

!

Page 32: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

32

Steg

anal

ysis

St

egan

alys

is m

eets

Cry

ptan

alys

ism

eets

Cry

ptan

alys

is

A f

ew B

rute

For

ce p

assw

ord

grin

din

g pr

ogra

ms

hav

e be

en c

reat

ed.

Steg

brea

k by

Nie

ls P

rovo

s, w

ww

.ou

tgu

ess.

org

–J-

Steg

Page 33: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

33

Cam

oufl

age

Cam

oufl

age

––C

ase

Stu

dyC

ase

Stu

dy

Det

erm

inin

g th

e pa

ssw

ord

use

d w

ith

C

amou

flag

e

The

loca

tion

of

the

pass

wor

d w

as d

eter

min

ed

by u

sin

g M

ult

iHex

wh

ich

allo

ws

sear

ches

for

H

ex s

trin

gs

Page 34: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

34

Cam

oufl

age

Cam

oufl

age

The

stri

ng

was

fou

nd

to b

e “7

6 F

0 0

9 5

6”

The

pass

wor

d is

kn

ow t

o be

“te

st”

wh

ich

is “

74

65

73

74”

in H

ex

Page 35: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

35

BD

HTo

olB

DH

Tool

Usi

ng

BD

HTo

olw

e ca

n X

OR

th

e tw

o to

rev

eal

the

key

Page 36: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

36

Cam

oufl

age

Cam

oufl

age

76 X

OR

74

= 0

2

F0 X

OR

65=

95

09 X

OR

73

= 7

A

56 X

OR

74

= 2

2

The

1st

4 d

igit

s of

th

e ke

y ar

e “0

2 9

5 7

A 2

2”

So le

t’s

test

ou

r th

eory

Page 37: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

37

Cam

oufl

age

Cam

oufl

age

We

stor

e an

oth

er m

essa

ge u

sin

g a

diff

eren

t pa

ssw

ord

The

file

rev

eals

a H

ex c

ode

of “

63

F4

1B

43

We

XO

R t

his

wit

h t

he

know

n k

ey “

02

95

7A

22

The

resu

lt is

“6

1 6

1 6

1 6

1”

wh

ich

is a

pa

ssw

ord

of “

aaaa

” in

ASC

II

We’

ve r

evea

led

the

hid

den

pas

swor

d to

hid

e th

e m

essa

ge!

This

exp

loit

dis

cove

red

by G

uill

erm

ito

at

ww

w.g

uill

erm

ito2

.net

Page 38: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

38

Hid

erm

an

Hid

erm

an ––

Cas

e St

udy

Cas

e St

udy

Let’

s ex

amin

e a

slig

htl

y m

ore

soph

isti

cate

d st

ego

prog

ram

–H

ider

man

Page 39: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

39

Hid

erm

anH

ider

man

Aft

er h

idin

g a

mes

sage

wit

h H

ider

man

, we

can

re

view

th

e fi

le w

ith

ou

r fa

vori

te H

ex T

ool.

This

re

veal

s th

at t

he

mes

sage

is e

ncr

ypte

d an

d ap

pen

ded

to t

he

end

of t

he

file

.

Page 40: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

40

Hid

erm

anH

ider

man

Extr

acti

ng

the

hid

den

mes

sage

we

hav

e

49 F

3 09

6B

65

E4 0

2 7A

7A

ED

5D

74

78 F

A 3

8

20 6

C F

E 03

65

20 E

F 09

7A

7A

61

21

In A

SCII

we

hav

e: I

??ke

??zz

??tx

??l?

?e ?

?zza

!

Ever

do

a cr

ypto

gram

???

Page 41: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

41

Hid

erm

anH

ider

man

Dec

iph

erin

g th

e co

de:

The

firs

t pa

rt is

th

e fi

le n

ame:

I??k

e??z

z??t

x? =

I??

ke??

zz?.

txt

The

seco

nd

part

is t

he

mes

sage

:

?l??

e ??

zza!

Page 42: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

42

Hid

erm

anH

ider

man

Man

y ke

ys a

re b

ased

on

th

e pa

ssw

ord

Ass

um

ing

the

file

nam

e is

Ilik

epiz

za.t

xt a

nd

the

mes

sage

is “

I lik

e pi

zza!

”, w

e ca

n r

ever

se e

ngi

nee

r th

is

We

con

vert

eve

ryth

ing

to it

’s a

ctu

al A

SCII

equ

ival

ent:

49

6C

69

6B

65

70

69

7A

7A

61

2E

74

78

74

49

20

6C

69

6B

65

20

70

69

7A

7A

61

21

I l i

k e

p i

z z

a . t

x t

I

l i k

e

p i z

z a

!

Page 43: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

43

Hid

erm

anH

ider

man

Ori

gin

al

49

F3

09

6B

65

E4

02

7A

7A

ED

5D

74

78

FA

38

20

6C

FE

03

65

20

EF

09

7A

7A

61

21

Dec

iph

ered

49

6C

69

6B

65

70

69

7A

7A

61

2E

74

78

74

49

20

6C

69

6B

65

20

70

69

7A

7A

61

21

If w

e ta

ke e

ach

cip

her

ed c

har

acte

r an

d X

OR

it w

ith

th

e ac

tual

res

ult

, we

can

rev

eal t

he k

ey w

hic

h in

th

is c

ase

is

the

pass

wor

d

F3 X

OR

6C

= 9

F

09

XO

R 6

9 =

69

An

d pe

rfor

m t

he

sam

e fo

r th

e re

mai

nin

g ch

arac

ters

Page 44: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

44

Hid

erm

anH

ider

man

The

resu

ltan

t is

th

e ke

y

9F 6

0 9

4 6B

8C

73

8E

71 9

7 68

60 is

011

0000

0 in

bin

ary

Ru

nn

ing

that

th

rou

gh t

he

NO

T lo

gic

give

s u

s 1

00

11

11

1 w

hic

h is

9F

in H

EX

So 9

F N

OT

= 6

0, 9

4 N

OT

= 6

B, a

nd

so f

orth

Sam

e is

for

th

e re

mai

nin

g ch

arac

ters

Page 45: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

45

Hid

erm

anH

ider

man

Toss

ing

asid

e th

e N

OT

tran

sfor

ms,

th

at le

aves

u

s w

ith

60

6B

73

71

68

Add

ing

1 t

o ea

ch w

e h

ave

61

6C

74

72

69

We

con

vert

th

is t

o A

SCII

=>

alt

ri

An

d ro

tate

th

e le

tter

s =

> t

rial

We

fou

nd

the

pass

wor

d!

Mor

e in

form

atio

n o

n m

y pe

rson

al s

ite

ww

w.s

py-h

un

ter.

com

Page 46: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

46

Steg

anal

ysis

St

egan

alys

is ––

Futu

re?

Futu

re?

Wh

ere

do w

e go

fro

m h

ere?

My

prog

ram

Steg

spy

curr

entl

y id

enti

fies

JP

Hid

e,

Hid

erm

an, a

nd

Invi

sibl

e Se

cret

s. M

ore

to c

ome!

Wri

te a

pro

gram

to

crac

k w

eak

Steg

o pr

ogra

ms

Nee

d a

pass

wor

d gr

inde

r, m

ay v

ary

depe

ndi

ng

on t

he

Steg

o pr

ogra

m (

steg

brea

k al

read

y av

aila

ble)

Stat

isti

cal a

nal

ysis

has

bee

n p

erfo

rmed

an

d is

als

o ca

pabl

e of

det

ecti

ng

Steg

anog

raph

ic p

rogr

ams

(his

togr

am, L

SB, e

tc)

Page 47: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

47

Steg

anal

ysis

St

egan

alys

is ––

Oth

er T

ools

Oth

er T

ools

Wet

ston

e Te

chn

olog

ies

offe

rs S

tego

Wat

chId

enti

fies

th

e pr

esen

ce o

f st

egan

ogra

phy

thro

ugh

sp

ecia

l sta

tist

ical

an

d an

alyt

ical

pro

gram

s.

Acc

ura

te a

nd

com

preh

ensi

ve t

ool,

also

ver

y ex

pen

sive

!

Doe

s n

ot a

ttem

pt t

o cr

ack

or r

evea

l th

e h

idde

n m

essa

ge,

mer

ely

iden

tifi

es it

Off

er a

Ste

gan

ogra

phy

Inve

stig

ator

Tra

inin

g C

ours

e

See

htt

p://

ww

w.w

etst

onet

ech

.com

Page 48: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

48

Steg

anal

ysis

St

egan

alys

is ––

Oth

er T

ools

Oth

er T

ools

Steg

dete

ct b

y N

iels

Pro

vos

Ava

ilabl

e at

htt

p://

ww

w.o

utg

ues

s.or

g/de

tect

ion

.ph

p

Det

ects

–js

teg

–jp

hide

(uni

xan

d w

indo

ws)

invi

sibl

e se

cret

s–

outg

uess

01.

3b

–F5

(he

ader

ana

lysi

s)–

appe

ndX

and

cam

oufla

ge

Site

dow

n d

ue

to S

tate

of

Mic

hig

an la

w!

Page 49: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

49

Ref

eren

ces

Ref

eren

ces

Steg

anog

raph

ica,

Gas

pari

Sch

otti

, 16

65

Dis

appe

arin

g C

rypt

ogra

phy,

Pet

er W

ayn

er,

2002

Hid

ing

in P

lain

Sig

ht,

Eri

c C

ole

20

03

Steg

anog

raph

y –

pres

enta

tion

Ch

et H

osm

er,

Wet

ston

e Te

chn

olog

ies,

Tec

hn

oSec

uri

ty2

00

3

Page 50: Steganography & Steganalysis -  · PDF fileSteganography & Steganalysis SpyHunter   spyhunter@spy-hunter.com. 2 ... word steganos meaning ... appeared blank. X

50

Qu

esti

on a

nd

An

swer

wit

h S

pyH

un

ter

ww

w.s

py-

hu

nte

r.co

msp

yhu

nte

r@sp

y-h

un

ter.

com