Slashdot Mirror
First Steganographic Image Found In The Wild
Niels Provos writes: "After months of searching for steganographic content on eBay and
elsewhere -- downloading millions of images, we were finally able to
find an image with a stegangraphic message hidden in it. Stegdetect and Stegbreak made short process with it. It took less
than a second to compute the secret key necessary to extract the
hidden message. Two commands at the prompt, and we found the hidden
message to be an image of B-52 scrapyard. Right off Terraserver."
What about the Evil Bert picture? We didn't seem to have the flood of Anthrax here in the U.S. until after that poster came out.
Hidden message?
Hidden like a fox!
It was shown on ABC news during a discussion of, guess what, steganography. The key was "abc". The person who created it said that it had a message hidden in it. An image "in the wild" would be one that was found at images. that wasn't known beforehand to have steganographic content.
Best Slashdot Co
It says "host cannot be reached, click OK to continue"
:)
yay. It only took me 10s w/Netscape to find the message
...now we're going to need federal registration to download images off the web... all for the greater cause of fighting terrorism, of course!
Skivvy Niner? Email me!
HEY! Look left just ONE MORE TIME!
The linked page says that the steg. image found "in the wild" was intentionally done as a demo of steganography and publicized on TV.
Someone please take this article out. It's an embarassment.
That it was the planted image from ABC. This is not what I would call a real detection of "in the wild" Show me an image that wasn't part of a media company stunt, or other reporter activity on the very technology of stenaography. Any of the supposed bin-laden images? How about a simple script-kiddie or cracker/thief communication?
In the wild denotes actual use by thrid parties.. A virus in the wild means it's out there looking to do damage and infect, This image is the equilivant of a hello world program on a how to program website.
It's not in the wild, It's an example placed by ABC news.
Do not look at laser with remaining good eye.
Good stego should be undetectable -- first off, the hidden message should be encrypted, and therefore nearly indistinguishable from any other set of random numbers. Also, the message needs to be several orders of magnitude smaller than the carrier image -- if you want to hide a 1K message, you ideally want a ~1M image to put it in. Isolating 1K of signal out of 1M of noise would be very computationally difficult.
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
Therefore, we are going to get very worried about, and pass lots of laws concerning, ultra-sophisticated encryption technology that no evil-doer would ever touch due to (a) complexity (b) potential to stand out like a sore thumb.
Clear now?
sPh
but I'm kinda bothered by this sort of thing, not in the way some might think. I don't have any problem at all with the research being conducted (actually I support it, good stuff!), but I hate that gobs of bandwidth are wasted by this sort of thing.
I mean, how much bandwidth is taken from companies with large numbes of images on their sites (EBay for example) as a results of stuff like this? It's not exactly something you can say adheres to purely ethical use of their bandwidth.
There's got be lots of projects out there attempting this stuff, especially given recent press coverage on the topic. Who's picking up the tab for the network usage?
Perhaps a permission-based scheme would be better, or better yet a volunteer-supported test server pool dedicated to hosting images. That way, people could test out steganography techniques by posting their images to the pool for the community at large to take a crack at. Thoughts? Flames? Oranges?
No doubt a fair proportion of them contain spook words too.
Unless of course they have a warrant, or the US government implements some more 1984 laws.
Eventually they get told that yes, there is a steganographic image on ABC, and they look at it, and guess what? They prove that it is a steganographic image and they can really desteg it. Quel surprise!
Of course, this particular image was very simply constructed as an example for a mass entertainment news channel intended for a general, non-specialist, audience. It was not constructed by someone concerned about secrecy or desperate to conceal a secret message. On the contrary it was constructed using handy, freely available steganographic image tools, not special purpose custom written ones.
Great!
This doesn't prove that there aren't staganographic images on eBay which their software can't detect. It doesn't prove there aren't steganographic images on alt.sex.binaries.fluffy-bunnies. It doesn't prove there aren't steganographic images on your favourite pr0n site.
It doesn't even prove that some spook agency somewhere can't detect all these steganographic messages, desteg them, and read the payload. All it proves is that these two academics can only detect a steganographic image it they're told where it is and what it is, and even then only if it's produced with a small range of well known, freely available tools.
Incidentally, there is a steganographic payload in this post. Care to scan all Slashdot posts for steganographic payload? All Usenet? No, thought not.
I'm old enough to remember when discussions on Slashdot were well informed.
I looked at that picture for hours and I couldn't see those B-52s
I just kept staring at it and staring at it....
This
But, eBay did grant permission for the download. Somebody's client said "GET http://www.ebay.com/image/something", and eBay said "OK, here it is, catch!". If they didn't want to spend the bandwidth to send it to you, they shouldn't have done so. At no point did eBay not have a choice.
You may think I'm being needlessly literal here (and in a sense I am), but really this points out the fact that HTTP isn't a suitable protocol to use if you want to shape and/or limit your traffic in certain non-basic ways like eBay does. Not that I'm in favor of traffic limitations, though - anyone who can type a /. comment in less than 20 seconds will agree with me there :)
Your right to not believe: Americans United for Separation of Church and
You can use spread spectrum techniques, you dont have to use the LSB. If an image has any uncorrelated noise at all you can always make sure the signal strength of your encrypted message is below the level of that noise ... and if the encryption algorithm can produce a sequence indistuingishable from noise if you dont know the key ...
I just find it very strange that somebody tries to make us believe that Steganographic content is limited to pictures and will be found on eBay. _IF_ you really want to hide something you might want to embedd a message at a certain time (time synching is not a problem) into an ever changing stream of data (like a webcam or an Internet radio station). The content has to be spread out over a certain amount of time. Maybe only chunks of a message per hour. This is not exactly emergency communication, orders, information, etc. can be received over several hours if needed. Now you spread the content over a pre-defined sequence and maybe start with a "wakeup" message to indicate that a new block of cipher information is about to come. This would be impossible to detect, because you have nothing to compare against (like a picture of a busy street is never the same). So I personally think that this "we scan on eBay and the pictures are evil" is something to put people at ease, but is not really helping a lot. Other than people will be forced into more stealthier methods ...
But, eBay did grant permission for the download. Somebody's client said "GET http://www.ebay.com/image/something", and eBay said "OK, here it is, catch!". If they didn't want to spend the bandwidth to send it to you, they shouldn't have done so. At no point did eBay not have a choice.
What the agreement said was "prior expressed written permission", which the people conducting the study probably did not have.
Granting an HTTP request does not constitute "permisssion" to use the service for whatever purpose you want. By analogy, the fact that Yahoo's FTP server accepts porn you upload does not mean that they have given you permission to post porn on your web page. If you send out 100,000 get-rich-quick e-mails, you cannot assume that you have "permission" from your ISP to do so because their SMTP server accepted them. The key point is intended use -- which eBay does not know. That's why they have an AUP.
Granting an HTTP request constitutes permission for you to download the file you asked for.
No, it does not. It does not represent a decision by the computer's owner as to whether you had a right to request the file and whether they should supply it to you. If I walked up to your computer and started deleting files, would the fact that your computer deleted the files mean that I had your permission to do so? That's what you are arguing: That the computer has power of attorney for its owner.
If you enter a restaurant with self-serve soda dispensers, do you have "permission" to steal soda just because the automated machine will dole it out at the push of a button? Do you have "permission" to take all of the straws just because the dispenser will give them to you (Your honor, I had McDonalds' permission to take 2,372 straws because their machine gave me a straw each time I pushed the button...)?
If Yahoo posts porn for you on their web site, then they didn't even have to give you permission since they already went ahead and did it.
No one at Yahoo is posting the porn. They are not manually moves the files from the FTP server to the web site. It's an automatic process and does not mean that you have their permission to upload porn. A computer responding to a file transfer request is not equivalent to the company giving you permission to transfer the file.
Just figure out the technology to lock your property down like you want, rather than relying on a crowd of mostly-anonymous, undisciplinable Internet users to follow your rules.
Now you are arguing about the practicality of enforcing a policy rather than the legalities. The most effective way to get people to follow your rules is to identify someone who violated them, sue them for civil damages, and make an example of them.