Slashdot Mirror
Battling Steganography
An anonymous reader submitted a fairly thin little story about a researcher who is Battling
Steganography. I can certainly see the appeal of the study but it really seems like a needle in a hay stack sort of project. And when you actually can detect one technique, new and better techniques will crop up and take its place.
You might say that 90% is no pretty significant. But considering how many actual images are there out there with actually no steganographic message, I think you'll actually end up persecuting more innocent people.
I just more more eveidence than this is required for a warrant to be issued.
The same applies to steganography, IMHO. SOMEONE has to break it - it might as well be me.
grep -ri 'should work'
Imagine trying to decipher the hidden messages in "The 5000 fingers of Dr. T.". It is a movie and as such contains the symbolism and iconography and messages of many individuals. Some of them are apparent, some of them covert, and some of them downright indecipherable.
Also, think about the Blade Runner/Ridley Scott "Is Deckard a replicant" business that lasted, well, right up until he told the world the answer. It is that sort of interpretation that someone hoping to decipher steganography would have to perfect. It's not just stuff like: Hi Everyone Likes Punch!
The only way to get messages out of such texts is intimate knowledge of the author(s) or intended recipients of the hidden meanings. By asking them, or sodium pentothal, or the NSA's computer simulation of everybody's brain.
I'm no cryptographer, but the most reliable and cost effective way to discover a secret is likely to investigate the people that know the secret, rather than try to divine meaning from a text that came into your hands.
I don't need large brains to have a good time.
If steganography can be made "turnkey", it'll work
for most of today's privacy requirements.
You might think that it'd be easy to detect,
or simple to prevent, but that's simply not true.
Unless someone lists all the ways in which one
can hide information, and a fantastically fast
approach to testing any given communication on the
net against those techniques. Otherwise, to
read a steganographically-encoded message,
each recipient will need to figure out which of
all the messages intercepted even includes the
data you're looking for, and what was used in
this particular instance. Hell, one might even
have two or more different techniques applied
in a single message. Like this message does.
Sort of.
....
Second, I'm not sure how to react to this. I don't use steganography to hide information, nor do I encrypt my email normally. I guess it's good to know if the techniques used to do this are detectable or breakable, but if it was actually used on a large scale you can bet I'd be screaming, "Big Brother!!!"
Even Slashdot wants to hide some things
The article stated that the guy used an algorithm to detect statistical variations and predict wether an image had steganographically hidden data 90% of the time.
How about a GIMP or Photoshop plugin to randomly insert junk data in any JPEG saved in order to make this technique useless? It'd be fun to the the NSA sit and fret over an image that apparently had a list of Warez traders and DMCA violators but instead contained the lyrics to 'Penny Lane'.
Better yet, how about an Apache module that does this same thing to every JPG it serves?
The point is, that as soon as it becomes common procedure to intercept images to check for steganography, those who use steganography will switch methods. I bet PGP data encoded in a JPG is a lot harder to detect, and infinitely harder to extract.
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
This is an interesting idea, but surely any good encryption produces an output which is indistinguishable from random noise. So, how can the algorithms mentioned in the article (which is interesting, but rather short on facts...) distinguish between the noise added by a steganographically embedded encrypted message and the noise caused by a slightly underspecced A to D converter?
I'm honestly curious... has anyone got any links to a more detailed report on this?
What this researcher is not mentioning is the false positive rate. This means how often the algorithm reports that a file contains steg when it actually doesnt. There are many tools out there for detecting steg, but their false positive rates render them useless for practicle use. I havent seen any tools under 10%, but I have seen some as high as 65%. This means that the tool says that 65% of all images are steg'd!
False positives are often simply a property of the mechanism that created the image in the first place. For example, certain graphic programs and digital camera's will ALWAYS produce files that look like they contain steg.
Some of the other posts here have mentioned using a carnivore like system with steg detection. With a modest false positive rate of 10%, imagine how many false positives you would have by searching just your office for a month. Not to mention the fact that once you have all of files, what do you do then? arrest everyone you sent a file that has a remote possiblity of being steg? You guys and gals can sleep a little safer because I seriously doubt the government has enough resources to look through 10% of every graphic or sound file that gets transmitted via email.
Given a certain state of network bandwidth, the quality of images transferred over the network is likely to increase as the ability to transmit that data increases. This means that anyone trying a large scale data mining for steganographic data, for example in a Carnivore-type application, would need to have many times the bandwidth of ALL the senders/recievers in order to analyze that much data.
That would make it so the only real application of this method would be for people you already suspect of sending steganographic data. You could direct the search toward them. However, then it is still trial and error to find which steganographic protocol they used, etc., and you're back to square one.
Maybe if the steganographic checking system was actually *intergrated* to the Carnivore system you could get somewhere. It might be a good way to search for messages that were "suspicious".
It is interesting, though, that this method is possible without knowing the individual steganographic protocols. It just seems that it would be too resource-intensive to deploy on a wide scale, and a wide scale is the only place it would be really more useful than trial and error.
"He's more machine now than man, twisted and evil."