Steganography and Data Hiding

1
Steganographyand Data Hiding

• Presented for CRIME by
• Steven Russelle
• Detective (retired)
• Forensic Computer Analysis
• Police Bureau Portland, OR
• Box 277
• Gaston, OR 97119
• emailRUSSELLE
• HEVANET.COM

2
Steganography is data hiding

• Dont think its just for hiding stuff in
  pictures
• Steg has dozens of commercial uses
• Watermarking of
• photographs
• chemical structure sets
• GIS data sets
• printed documents
• audio and video files/streams
• television (authorized viewer)
• firmware

3

• Data Protection
• in pictures can be used to add labels, GPS
  coordinates, inset magnification, and set
  resolution, all independently according to
  clearance level of the viewer
• Tamper-proofing of texts

4

• Unlimited non-commercial uses
• Hidden messages or data in files
• pictures
• bitwise
• transform
• movies
• sound
• echo
• spread spectrum
• codec
• Acrobat (.pdf)
• fake spam mail
• text document files
• HTML
• Most any file by appending (PGEnvelope) or DOS
• MP3 - just type data in

5

• Hiding data in structures other than files
• Fonts
• TCP/IP headers
• flash memory
• Hard Drives/Floppies/media
• Steg FS
• unused or ignored areas
• Other Covert Channels

6

• Detecting Steganography
• Know the available applications and their hiding
  methods
• File name and Hash value database of known Steg
  applications, .dlls, and associated files
• but study reverse engineering/software hacking
  sites
• .EXE encryptors/compressors
• patchers, etc.
• disassemblers/debuggers

7

• Steg detection software
• There are some commercial applications
• KNOW its limitations and capabilities, and
• LEARN data hiding techniques
• else youre toast

8

• Steg detection by other means
• recognition of known steg signature
• e.g. F5s header or the color palette or color
  space characteristics caused by some of the
  other tools
• statistical analysis
• look for appended data
• know your file headers and structure
• search tools
• Network data analysis
• TCP headers, etc.

9

• Hardware/Software dependencies
• Data Streams (Keep your eyes peeled HERE)
• Examples of actual use, and whos talking about
  steg?
• University of Michigan Studies
• Study 1 - ebay
• Study 2 - usenet

10

• Links to info
• Steg generally
• www.sans.org/rr/steg/steganography4.php
• http//www.sans.org/rr/papers/index.php?id552
• Steg tools archives and info
• This is Neil Johnsons page www.jjtc.com/Steganogr
  aphy/
• This is Ross Andersons page www.cl.cam.ac.uk/user
  s/rja14/

11

• Univ. of Michigan tech reports including
  searching the internet for steganography (Niels
  Provos - Outguess)
• http//www.citi.umich.edu/techreports/
• www.outguess.org/detection.php
• Reverse engineering and Hacking
• Search internet for sudden discharge
  tutorials and for YOU have found mammon
• -UNICODE