June 6, 2003

Steganography & Steganalysis

SpyHunter www.spy-hunter.com [email protected]

Agenda
Steganography
What is Steganography? History Steganography today Steganography tools What is Steganalysis? Identification of Steganographic files Cracking Steganographic files Whats in the future?

Steganalysis

Steganography

Steganography - Definition
Steganography
from the Greek word steganos meaning covered and the Greek word graphie meaning writing

Steganography is the process of hiding of a secret message within an ordinary message and extracting it at its destination Anyone else viewing the message will fail to know it contains hidden/encrypted data

Steganography - History
Greek history warning of invasion by scrawling it on the wood underneath a wax tablet. To casual observers, the tablet appeared blank. Pirate legends tell of the practice of tattooing secret information, such as a map, on the head of someone, so that the hair would conceal it.

Steganography
Both Axis and Allied spies during World War II used such measures as invisible inks -- using milk, fruit juice or urine which darken when heated. Invisible Ink is also a form of steganography

Steganography
The U.S. government is concerned about the use of Steganography. Common uses in include the disguising of corporate espionage. Its possible that terrorist cells may use it to secretly communicate information Its also a very good Anti-forensics mechanism to mitigate the effectiveness of a forensics investigation

Steganography

Terror groups hide behind Web encryption By Jack Kelley, USA TODAY AP

WASHINGTON Hidden in the X-rated pictures on several pornographic Web sites and the posted comments on sports chat rooms may lie the encrypted blueprints of the next terrorist attack against the United States or its allies. It sounds farfetched, but U.S. officials and experts say it's the latest method of communication being used by Osama bin Laden and his associates to outfox law enforcement. Bin Laden, indicted in the bombing in 1998 of two U.S. embassies in East Africa, and others are hiding maps and photographs of terrorist targets and posting instructions for terrorist activities on sports chat rooms, pornographic bulletin boards and other Web sites, U.S. and foreign officials say.

Steganography
Steganography has also been popularized in movies
The Saint, Val Kilmer Along Came a Spider, Morgan Freeman

Steganography
Modern digital steganography
data is encrypted then inserted, using a special algorithm which may add and/or modify the contents of the file Carefully crafted programs apply the encrypted data such that patterns appear normal.

10

Steganography Modern Day

Carrier File

Carrier File with Hidden Message

11

Steganography Carrier Files

Steganography Carrier Files bmp jpeg gif wav mp3 Amongst others

12

Steganography - Tools
Steganography Tools Steganos S-Tools (GIF, JPEG) StegHide (WAV, BMP) Invisible Secrets (JPEG) JPHide Camouflage Hiderman Many others

13

Steganography
Popular sites for Steganography information
http://www.ise.gmu.edu/~njohnson/Steganography http://www.rhetoric.umn.edu/Rhetoric/misc/dfrank/steg soft.html http://www.topology.org/crypto.html

14

Steganalysis
Identification of hidden files

15

Steganalysis - Definition
Definition
Identifying the existence of a message Not extracting the message Note: Technically, Steganography deals with the concealment of a message, not the encryption of it

How is this meaningful???

16

Steganalysis
By identifying the existence of a hidden message, perhaps we can identify the tools used to hide it. If we identify the tool, perhaps we can use that tool to extract the original message.

17

Steganalysis Methods of Detection

Methods of detecting the use of Steganography
View it (JPEG, BMP, GIF, etc.) Listen to it (WAV, MPEG, etc.) Statistical Attack (changes in patterns of the pixels or LSB Least Significant Bit) or Histogram Analysis View file properties/contents
size difference date/time difference contents modifications checksum

18

Steganalysis Methods of Analysis

Detecting Steganography by viewing it

Can you see a difference in these two pictures? (I cant!)

19

Steganalysis Histogram Analysis

Histogram analysis can be used to possibly identify a file with a hidden message

20

Steganalysis Histogram Analysis

By comparing histograms, we can see this histogram has a very noticeable repetitive trend.

21

Steganalysis Compare properties

Compare the properties of the files Properties
04/04/2003 05:25p 240,759 helmetprototype.jpg 04/04/2003 05:26p 235,750 helmetprototype.jpg

Checksum
C:\GNUTools>cksum a:\helmetprototype.jpg 3749290633 235750 a:\helmetprototype.jpg C:\GNUTools>cksum a:\before\helmetprototype.jpg 3241690497 240759 a:\before\helmetprototype.jpg

22

Steganalysis Analyzing contents of file

Viewing the contents of the file If you have the copy of the original picture, it can be compared to the modified suspect file Identify inconsistencies Identify a signature pattern associated with a specific steganographic tool

23

Steganalysis Analyzing contents of file

Identifying the presence of a hidden message Many tools can be used for viewing and comparing the contents of a hidden file. Everything from Notepad to a Hex Editor can be used Reviewing mutiple files generated from the same program may reveal a signature!

24

Steganalysis Analyzing contents of file

WinHex Analysis

25

Steganalysis Identifying a signature

Identifying the signature
WinHex is very helpful for identifying the differences between two files to determine what was modified and/or added. Notepad can then utilized to reveal the signature string added to the file

26

Steganalysis Identifying a signature

Signature found! Signature-based steganalysis was used to identify signatures in many programs including Invisible Secrets, JPHide, Hiderman, etc.

27

Steganalysis - Stegspy
Signature found!
Stegspy.pl searches for stego signatures and determines the program used to hide the message Will be available for download from my site Example:

28

Steganalysis Identifying a signature

How is this handy? No original file to compare it to Search for the signature pattern to determine a presence of a hidden message Signature reveals program used to hide the message!

29

Steganalysis meets Cryptanalysis

Cryptanalysis As stated previously, in Steganography the goal is to hide the message, NOT encrypt it Cryptography provides the means to encrypt the message. How do we reveal the hidden message?

30

Steganalysis meets Cryptanalysis

Knowing the steganography program used to hide the message can be extremely handy when attempting to reveal the actual hidden message Unfortunately, some of these programs use strong encryption 128-bit or stronger GOOD LUCK! The only thing we need is the PASSWORD!

31

Steganalysis meets Cryptanalysis

A few Brute Force password grinding programs have been created. Stegbreak by Niels Provos, www.outguess.org
J-Steg

32

Camouflage Case Study

Determining the password used with Camouflage The location of the password was determined by using MultiHex which allows searches for Hex strings

33

Camouflage
The string was found to be 76 F0 09 56 The password is know to be test which is 74 65 73 74 in Hex

34

BDHTool
Using BDHTool we can XOR the two to reveal the key

35

Camouflage
76 XOR 74 = 02 F0 XOR 65= 95 09 XOR 73 = 7A 56 XOR 74 = 22 The 1st 4 digits of the key are 02 95 7A 22 So lets test our theory

36

Camouflage
We store another message using a different password The file reveals a Hex code of 63 F4 1B 43 We XOR this with the known key 02 95 7A 22 The result is 61 61 61 61 which is a password of aaaa in ASCII Weve revealed the hidden password to hide the message! This exploit discovered by Guillermito at www.guillermito2.net

37

Hiderman Case Study

Lets examine a slightly more sophisticated stego program Hiderman

38

Hiderman
After hiding a message with Hiderman, we can review the file with our favorite Hex Tool. This reveals that the message is encrypted and appended to the end of the file.

39

Hiderman
Extracting the hidden message we have 49 F3 09 6B 65 E4 02 7A 7A ED 5D 74 78 FA 38 20 6C FE 03 65 20 EF 09 7A 7A 61 21 In ASCII we have: I??ke??zz??tx??l??e ??zza! Ever do a cryptogram???

40

Hiderman
Deciphering the code: The first part is the file name: I??ke??zz??tx? = I??ke??zz?.txt The second part is the message: ?l??e ??zza!

41

Hiderman
Many keys are based on the password Assuming the file name is Ilikepizza.txt and the message is I like pizza!, we can reverse engineer this We convert everything to its actual ASCII equivalent: 49 6C 69 6B 65 70 69 7A 7A 61 2E 74 78 74 49 20 6C 69 6B 65 20 70 69 7A 7A 61 21 Ilikepizza.txtI like pizza!

42

Hiderman
Original 49 F3 09 6B 65 E4 02 7A 7A ED 5D 74 78 FA 38 20 6C FE 03 65 20 EF 09 7A 7A 61 21 Deciphered 49 6C 69 6B 65 70 69 7A 7A 61 2E 74 78 74 49 20 6C 69 6B 65 20 70 69 7A 7A 61 21 If we take each ciphered character and XOR it with the actual result, we can reveal the key which in this case is the password F3 XOR 6C = 9F 09 XOR 69 = 69 And perform the same for the remaining characters
43

Hiderman
The resultant is the key 9F 60 94 6B 8C 73 8E 71 97 68 60 is 01100000 in binary Running that through the NOT logic gives us 10011111 which is 9F in HEX So 9F NOT = 60, 94 NOT = 6B, and so forth Same is for the remaining characters

44

Hiderman
Tossing aside the NOT transforms, that leaves us with 60 6B 73 71 68 Adding 1 to each we have 61 6C 74 72 69 We convert this to ASCII => altri And rotate the letters => trial We found the password! More information on my personal site www.spy-hunter.com

45

Steganalysis Future?
Where do we go from here? My program Stegspy currently identifies JPHide, Hiderman, and Invisible Secrets. More to come! Write a program to crack weak Stego programs Need a password grinder, may vary depending on the Stego program (stegbreak already available) Statistical analysis has been performed and is also capable of detecting Steganographic programs (histogram, LSB, etc)

46

Steganalysis Other Tools

Wetstone Technologies offers Stego Watch
Identifies the presence of steganography through special statistical and analytical programs. Accurate and comprehensive tool, also very expensive! Does not attempt to crack or reveal the hidden message, merely identifies it Offer a Steganography Investigator Training Course See http://www.wetstonetech.com

47

Steganalysis Other Tools

Stegdetect by Niels Provos
Available at http://www.outguess.org/detection.php Detects jsteg jphide (unix and windows) invisible secrets outguess 01.3b F5 (header analysis) appendX and camouflage Site down due to State of Michigan law!

48

References
Steganographica, Gaspari Schotti, 1665 Disappearing Cryptography, Peter Wayner, 2002 Hiding in Plain Sight, Eric Cole 2003 Steganography presentation Chet Hosmer, Wetstone Technologies, TechnoSecurity 2003

49

Question and Answer with SpyHunter

www.spy-hunter.com [email protected]

50