INFORMATION HIDING: Steganography and Watermarking­

Attacks and Countermeasures

ADVANCES IN INFORMATION SECURITY

INFORMATION HIDING: Steganography and Watermarking­

Attacks and Countermeasures

by

N eil F. J ohnson Zor an Durie

Sushil J ajodia

Center jar Secure Injormation Systems George Mason University

SPRINGER-SCIENCE+BUSINESS MEDIA, LLC

Library of Congress Cataloging-in-Publication Data

Johnson, Neil F. Information hiding: steganography and watermarking: attaeks and eountermeasures /

by Neil F. Johnson, Zoran Durie, Sushil Jajodia. p. em. -- (Advanees in information seeurity ; 1)

Includes bibliographieal referenees and index. ISBN 978-1-4613-6967-7 ISBN 978-1-4615-4375-6 (eBook) DOI 10.1007/978-1-4615-4375-6

l.Computer seeurity. 2. Data proteetion. 1. Durie, Zoran. II. Jajodia, Sushil. III. Title. IV. Series.

QA76.9.A25 J25 2000 005.8--de21

00-046213

Copyright © 2001 by Springer Science+Business Media New York. Third Printing 2003. Origina1ly published by Kluwer Academic Publishers in 2001 Softcover reprint ofthe hardcover Ist edition 2001

Ali rights reserved. No part of this publieation may be reprodueed, stored in a retrieval system or transmitted in any form or by any means, mechanica1, photo-eopying, recording, or otherwise, without the prior written permission of the publisher, Springer-Science+Business Media, LLC.

Printed on acid-free paper.

Series Foreword

ADVANCES IN INFORMA TION SECURITY

Sushil Jajodia Consulting Editor

Department of Information & Software Engineering George Mason University

Fairfax, VA 22030-4444, U.S.A.

email: [email protected]

Welcome to the first volume of ADVANCES IN INFORMATION SECURITY. The goals of this series are to establish the state of the art, set the course for future research in information security, and to serve as a central source of reference for information security research and developments. The scope of this series includes not only all aspects of computer and network security, but related areas such as fault tolerance and software assurance.

The series aims to publish thorough and cohesive overviews on specific topics in Information Security, as well as works that are larger in scope than survey articles and that will contain more detailed background information. The series also provides a single point of coverage of advanced and timely topics and a forum for topics that may not have reached a level of maturity to warrant a comprehensive textbook.

About this volume

The first volume of this series deals with information hiding. With the proliferation of multimedia on the Internet, information hiding addresses two areas of concern: privacy of information from surveillance (steganography) and protection of intellectual property (digital watermarking).

Derived from the Greek, steganography literally means "covered writing." Steganography explores methods to hide the existence of hidden messages. These methods include invisible ink, microdot, digital signature, covert

VI

charmel, and spread spectrum communication. Digital watermarks represent a commercial application of steganography. Watermarks can be used to track the copyright and ownership of electronic media.

In this volume, the authors focus on techniques for hiding information in digital media. They analyze the hiding techniques to uncover their limitations. These limitations are employed to devise attacks against hidden information. The goal of these attacks is to expose the existence of a secret message or render a digital watermark unusable. In assessing these attacks, countermeasures are developed to assist in protecting digital watermarking systems. Understanding the limitations of the current methods will lead us to build more robust methods that can survive various manipulation and attacks.

The more information that is placed in the public's reach on the Internet, the more owners of such information need to protect themselves from theft and false representation. Systems to analyze techniques for uncovering hidden information and recover seemingly destroyed information will be useful to law enforcement authorities in computer forensics and digital traffic analysis.

SUSHlL JAJODIA Consulting Editor

To my parents Bill and Carolyn, wife Ann-Marie, and son William. -NFJ

To my wife Sladjana, and my children Petar and Sonja. -ZD

To my parents. -SJ

Contents

LIST OF FIGUR.ES ............................................................................. XIII

LIST OF TABLES .............................................................................. XVII

PREFACE ............................................................................................ XIX

1. INTRODUCTION ............................................................................ 1

1.1 Steganography: Hiding Information ............................................. 1 1.2 Steganography throughout History ............................................... 2 1. 3 Methods for Hiding Information .................................................. 4

1.3.1 Hiding in Text .................................................. .................... 5 1.3.2 Hiding in Disk Space ........................................................... 7 1.3.3 Hiding in Network Packets ................................................... 7 1.3.4 Hiding in Software and Circuitry ......................................... 7 1.3.5 Hiding in Audio and Images ................................................. 8

1.4 Attacks against Hidden Information ............................................. 8 1.4.1 Detection ............................................................................. 8 1.4.2 Distortion and Removal ....................................................... 9

1.5 Countermeasures Against Attacks .............................................. 10 1.6 Contributions & Future Work .................................................... 11 1.7 Organization of the Book ........................................................... 12

2. EXPLORING STEGANOGRAPHY .............................................. 15

2.1 Digital Images ........................................................................... 15 2.2 Hiding Information in Images .................................................... 17

2.2.1 Hiding Data in the Noise ................................................... 18

x

2.2.2 Watermarking Techniques ................................................. 22 2.3 Issues in Information Hiding ...................................................... 24

2.3.1 Level of Visibility: Perceptible or Imperceptible ................. 25 2.3.2 Robustness vs. Payload ............................................... ....... 25 2.3.3 Spatial or transform domain .............................................. 27 2.3.4 File Format Dependence ............................................ ........ 28 2.3.5 Image Modeling ............................................... .................. 28 2.3.6 Summary of Hiding Techniques .......................................... 29

2.4 Examples of Digital Image Steganography Software .................. 30 2.4.1 StegoDos ........................................................................... 32 2.4.2 White Noise Storm ................................................. ............ 34 2.4.3 S-Tools .............................................................................. 36 2.4.4 Comments on Other Software ............................................. 40 2.4.5 Summary of Tools ............................................... ............... 43

2.5 Comments on Steganography .................................................... 43

3. STEGANALYSIS: ATTACKS AGAINST HIDDEN DATA ........ 47

3.1 Detection: Seeing the Unseen .................................................... 48 3.1.1 Techniques for Detecting Hidden Information .................... 49 3.1.2 Examples of Detecting Signatures in Stego-Images ............ 50 3.1.3 S-Tools .............................................................................. 52 3.1.4 Mandelsteg ............................................ ............................ 53 3.1.5 Hide and Seek .................................................. .................. 53 3.1.6 Hide4PGP .............................................. ........................... 54 3.1.7 EzStego, Stego On-line ................................................ ....... 55 3.1.8 .lsteg-.lpeg ............................................ .............................. 55

3.2 Distortion: Disabling Steganography and Watermarks ............... 60 3.2.1 Techniquesfor Distorting Embedded Data ......................... 61 3.2.2 Examples of Distorting Embedded Information .................. 62

3.3 Application of Steganalysis: Forensic Investigation ................... 73 3.4 Comments on Steganalysis ........................................................ 74

4. COUNTERMEASURES TO ATTACKS ....................................... 77

4.1 Countermeasures to Distortion ................................................... 78 4.2 Stronger Watermarks ................................................................. 79 4.3 Recognition Based on Image Characteristics .............................. 80

4.3.1 "Fingerprinting" Images ................................................ ... 82 4.3.2 Affine Transformations and Invariants ............................... 88 4.3.3 Using Fingerprints for Recognition .................................... 91

4.4 Recovering Watermarks from Distorted Images ......................... 96 4.4.1 Recovery using Image Fingerprints .................................... 96 4.4.2 Refinement using Normal Flow .......................................... 99 4.4.3 Examples of Recovering Watermarks from Images ........... 103

xi

4.5 Comments on Countermeasures ............................................... 108

Appendix A: Hiding Data in Network Traffic ..................................... 111

Appendix B: Glossary of Methods to Distort Stego-Images ................ 117

References ............................................................................................. 123

Index ...................................................................................................... 129

List of Figures

Figure 1. Steganography Model. ................................................................. 5 Figure 2. Grayscale Palettes ...................................................................... 16 Figure 3. Images with varying texture ....................................................... 18 Figure 4. Noise is introduced to the two images ........................................ 18 Figure 5. Example of a palette shift causing visible noise .......................... 20 Figure 6. Replacing four lower bits of each byte for a 24-bit pixel. ............ 21 Figure 7. Watermark based on a mask ....................................................... 22 Figure 8. Example of a commercial watermark [23] .................................. 23 Figure 9. Reading Digimarc's PictureMarc ............................................... 24 Figure 10. IDustrations of Marks on an Image ........................................... 27 Figure 11. Long-Range Aviation Airfield .................................................. 31 Figure 12. "Renoir" Cover ........................................................................ 31 Figure 13. "Shakespeare" Cover ............................................................... 32 Figure 14. Result of embedding the text message with StegoDos ............... 33 Figure 15. Airfield embedded using White Noise Storm. ........................... 35 Figure 16. Hiding the Airbase in a 24-bit Renoir with S-Tools ................... 37 Figure 17. Hiding the Airfield in a 8-bit Renoir with S-Tools . ................... 39 Figure 18. Impact of S-Tools on the palettes of the 8-bit Renoir image ...... 39 Figure 19. IDustration of Steganos hiding data in every third LSB (24-bit).41 Figure 20. IDustration of Steganos hiding data in every third LSB (8-bit) .. 41 Figure 21. Data from a BMP image with a terminating zero byte ............. .42 Figure 22. Impact of Steganos to LSBs of an 8-bit version of the Renoir ... 42 Figure 23. Impact of image noise from applying Hide and Seek . ............... 50 Figure 24. A suspicious image .................................................................. 51 Figure 25. A signature for S-Toois . ........................................................... 52 Figure 26. Example of a palette created by Mandelsteg . ............................ 53

xiv Contents

Figure 27. "Seeing" data hidden in an image ............................................ 55 Figure 28. Jpeg image (left) and ]steg image (right) .................................. 56 Figure 29. Plots of Jpeg Coefficients ......................................................... 56 Figure 30. Difference between the graphs in Figure 29 ............................. 56 Figure 31. Histograms of Jpeg Coefficients ............................................... 57 Figure 32. Plots of Differences in adjacent Histogram values .................... 57 Figure 33. Probability of Embedded Data ................................................ 58 Figure 34. Jsteg-processed image and plot of first 100 coefficients ............ 58 Figure 35. Difference between the graph in Figure 34 and the left graph in

Figure 29 .......................................................................................... 59 Figure 36. Histogram of Jpeg coefficients and differences in adjacent

histogram values ............................................................................... 59 Figure 37. Probability of Embedded Data ................................................. 59 Figure 38. Impact of an attack using StirMark ............................ ............... 69 Figure 39. illustration of an attack on a watermark using StirMark ............ 70 Figure 40. Original image with an embedded watermark ........................... 72 Figure 41. Images after processing with 2Mosaic ...................................... 72 Figure 42. Example of strengthening a mask-based watermark. ................. 80 Figure 43. Candidate feature points based on edges ................................... 83 Figure 44. Examples of similarity functions for three local neighborhoods. 85 Figure 45. Selected unique feature points for 112, 114, and 118 resolutions. 86 Figure 46. Identifying likely feature points ................................................ 87 Figure 47. Selected feature points for full, 112, and 114 resolution ............. 88 Figure 48. Examples of Affine Transformations ........................................ 89 Figure 49. Affine invariance of area ratios ................................................ 91 Figure 50. Images used for recognition ..................................................... 92 Figure 51. Matching results for the image in Figure 50a ........................... 93 Figure 52. Matching results for the image in Figure 5Ob ........................... 93 Figure 53. Affine invariants for the image in Figure 50a ........................... 93 Figure 54. Affine invariants for Figure 5Ob ............................................... 94 Figure 55. Additional images to illustrate incorrect matches ...................... 95 Figure 56. Matching results for the images in Figure 55 ............................ 95 Figure 57. Correlation between Figure 55a and Figure 50a ...... ................. 96 Figure 58. Correlation between Figure 55b and Figure 50a .. ..................... 96 Figure 59. Recognizing images ................................................................. 98 Figure 60. Recovering image size and aspect. ........................................... 98 Figure 61. Refining image size and aspect.. ............................................. 101 Figure 62. Recovery of an image using Normal Displacement.. ............... 102 Figure 63. Mask-based watermark recovery ............................................ 104 Figure 64. Recovery of a commercial watermark. ................................... 105 Figure 65. Further recovery of a commercial watermark. ........................ 106 Figure 66. Application of normal displacement for recovery ................... 107

Information Hiding: Steganography and Watermarking xv

Figure 67. Sample IP Header .................................................................. 112 Figure 68. Sample TCP Header ............................................................... 114

List of Tables

Table 1. Security Categories ........................................................................ 2 Table 2. Cross-reference of Hiding Techniques ......................................... 29 Table 3. Cross-references of Tools to Classification .................................. 43 Table 4. Steganalysis Attacks .................................................................... 49 Table 5. Encoding "Neil" in the IP Identification Field ............................ 113 Table 6. Encoding "Neil" in the TCP Sequence Number Field ................. 114

Preface

Steganography (literally, covered writing) is the hiding of secret messages within another seemingly innocuous message, or carrier. The carrier can be anything used to transfer information, including, for example, wood or slate tablets, hollow heels, images under stamps, tiny photographs, or word arrangements. Digital carriers include e-mail, audio, and video messages, disk space, disk partitions, and images.

Steganography, like cryptography, is a means of providing secrecy. Yet steganography does so by hiding the very existence of the communication, while cryptography does so by scrambling a message so it cannot be understood. A cryptographic message can be intercepted by an eavesdropper, but the eavesdropper may not even know a steganographic message exists.

Digital watermarking addresses issues related to intellectual property and copyright protection. Digital watermarks can be thought of as commercial applications of steganography and may be used to trace, identify, and locate digital media across networks. Digital watermarks are attributes of the carrier, as a watermark typically includes information about the carrier or the owner.

The goal of steganography is to avoid drawing suspicion to the transmission of a secret message. Detecting the secret message-an attack against steganography-relies on the fact that hiding information in digital media alters the carriers and introduces unusual characteristics or some form of degradation to the carrier. The characteristics introduced by the embedded data may be the key to such an attack. A successful attack against a digital watermark, on the other hand, renders the watermark useless or unreadable.

xx

In general, attacks against embedded data can include various combinations of cryptanalysis, steganalysis, image processing techniques, or other attempts to overwrite or remove the embedded information. These attacks may reveal a steganographic message or confuse a watermark reader as to the authenticity of the watermark. Based on the understanding of the impact data embedding has on carriers and the corresponding attacks, countermeasures can be devised to aid in the survivability of the embedded information.

This monograph presents the research contributions in three fundamental areas with respect to image-based steganography and watermarking: analysis of data hiding techniques, attacks against hidden information, and countermeasures to attacks against digital watermarks. Analysis of data hiding techniques involves investigating available tools and techniques for hiding information, classifying these techniques, and understanding the impact steganography software has on various carriers (see Chapters 1 and 2).

Attacks against hidden information involve identifying patterns and characteristics the embedding processes have on the carriers. From these characteristics, methods for attacking hidden information (steganalysis) are defined and executed. These attacks are used to document the break points of various tools for embedding information and to identify the limitations of steganography and watermarking tools (see Chapter 3).

Based on understanding the impact the attacks have on carriers, countermeasures to these attacks are explored. These countermeasures utilize salient feature points (fingerprints) and affine invariants for image recognition and image tracking as a complement to image watermarking. After images are recognized the feature points are used for automatic recovery of image aspect and scale. The recovery process is further refined using normal displacement tields as a means to calculate image transformations. Following the recovery process, previously unreadable watermarks can be detected (see Chapter 4).

Supplemental information is available via the Internet. Web pages for additional reference materials, bibliographic data, software, and color tigures may be found at:

http://ise.gmu.edu/-njohnsoniSteganography and http://www.jjtc.com/Steganography

Information about research efforts at George Mason University's Center for Secure Information Systems (CSIS) is available at:

http://ise.gmu.edu/-csis