Slashback: Streamend, Stego, Patches

The first Slashback of 2002 brings you updates on Ogg streaming (listen in while it lasts, and send feedback if you like it!), Qwest and your privacy, holes and patches for products from the MS-AOL-Time Warner Industrial Complex, and even more steganographic images failing to appear.

Getcher hot streams while they last ... jmoffitt writes: "In his post to the Vorbis list, Ciaran announced that the Ogg Vorbis BBC streams of Radio 1 and Radio 4 that we've enjoyed since early November would go offline as the test is ending. Everyone is encouraged to send their encouragement for these streams to continue to webweaver@bbc.co.uk. Also, as a special treat, the Radio 4 Ogg stream has been extended a week - just enough for all to catch the first episode of Lord of the Rings on Saturday at 1430 GMT."

Please mind the people interrupting your privacy. Matt Clauson writes: "Discussion list for the Qwest privacy issue and possible protest action has been set up -- send an email qwest-action-subscribe@dotorg.org to subscribe to it."

Plug, plug, plug ... timekillerj writes "Well it looks like AOL jumped right in and fixed that pesky hole. We can all go back to speculating how insecure it is now. An article on Yahoo has more info, including a short debate on w00w00 disclosing before getting a response from AOL."

Backstepping by any other name ... dagoalieman writes "It appears the FBI has decided that MS's patch is sufficient. According to CNN, they announced this earlier today in a rather quiet fashion. While MS may see it as good news, I think the fact that the hole is coming back to public attention just blackens the eye a little more for them. It will be interesting to see future ramifications of the government getting involved in these issues, too..." It can't look good when your company's software is called into question by some of your largest customers.

Nope, still don't see any. Niels Provos writes: "I just updated http://www.citi.umich.edu/u/provos/stego/usenet.php to reflect the final results from our search of hidden messages in USENET images. We did not find a single hidden message.

I also released a new version of stegdetect.

The disconcert cluster that we used for the dictionary attack contained more than two-hundred workstations, mostly from CAEN (that is the computer aided engineering network at UMich). The peak performance is comparable to 72 1200 MHz Pentium III machines :-) ...

Below my mail to the cryptography mailing list.

------- Forwarded Message
From: Niels Provos <provos@citi.umich.edu>
To: cryptography@wasabisystems.com
Subject: Stegdetect 0.4 released and results from USENET search available
Date: Fri, 21 Dec 2001 12:16:14 -0500
Sender: provos@citi.umich.edu

I just released Stegdetect 0.4. It contains the following changes:

- Improved detection accuracy for JSteg and JPhide.
- JPEG Header Analysis reduces false positives.
- JPEG Header Analysis provides rudimentary detection of F5.
- Stegbreak uses the file magic utility to improve dictionary
attack against OutGuess 0.13b.

You can download the UNIX source code or windows binary from

http://www.outguess.org/download.php

- -----

The results from analyzing one million images from the Internet Archive's USENET archive are available at http://www.citi.umich.edu/u/provos/stego/usenet.php.

[...]

After scanning two million images from eBay without finding any hidden messages, we extended the scope of our analysis.

This page provides details about the analysis of one million images from the Internet Archive's USENET archive.

Processing the one million images with stegdetect results in about 20,000 suspicious images. We launched a dictionary attack on the JSteg and JPHide positive images. The dictionary has a size of 1,800,000 words and phrases. The disconcert cluster used to distribute the dictionary attack has a peak performance of roughly 87 GFLOPS. However, we have not found a single hidden message. [...]

Comments and feedback are welcome. We have an FAQ at http://www.citi.umich.edu/u/provos/stego/faq.html"

Thanks for the update, Niels!

Comments

So....

[cscx]

"It appears the FBI has decided that MS's patch is sufficient. According to CNN, they announced this earlier today in a rather quiet fashion. While MS may see it as good news, I think the fact that the hole is coming back to public attention just blackens the eye a little more for them. It will be interesting to see future ramifications of the government getting involved in these issues, too..." It can't look good when your company's software is called into question by some of your largest customers.

In plain English, does this mean that the whole 'warning' by the FBI was FUD, plain and simple?

AIM Bugs

[mESSDan]

I'm curious, I went looking on the AIM website for somewhere to send information about a SERIOUS bug like the one that was discovered, and of course I didn't find one. So, I'm not surprised when it said in the Yahoo article that they didn't receive a response back after a week, considering that if they submitted it using the "Found an Error" part of the website, it probably got mixed in with thousands of other messages.

Does anyone know a faster way to contact the major software vendors about a severe security issue BESIDES letting them read about it on the front page of their favorite news portal?

(Note, I only said faster, not better)

The point of Stego is that you can't see it.

[lowy]

For those who prefer clicking to cut-and-pasting, the Steganography update is here.

I suspect there are several reasons why they haven't found any Stegonography in Usenet pictures:

1. Very few people find it necessary to hide information in Usenet.
2. Of those who might find it necessary, few actually have heard of Steganography and know how to use it.
3. Those who know enough about Stego have encypted their messages first; you won't find these with dictionary attacks - the method the article suggests they used on "suspicious" images.

It is impossible to differentiate between random numbers (noise) and strong encryption. Are there not places within certain images where low order bits have noise that is completely random and thus a perfect hiding place for encrypted messages?

This Article seems to suggest that it isn't possible to hide info in gifs such that it is undetectable and that more research should be done on JPEGs. Anyone know the state of the art on this?

Unsurprising findings on the steg front...

[electricmonk]

I'm really not that surprised that they didn't find anything out of all the USENET images that they scanned. First of all, even considering that they had such immense computational power at their disposal, stegonography done right would probably elude detection by any software currently available. Secondly, they have probably not considered the fact that the messages that are hidden could be encrypted, thus thwarting any kind of dictionary attack against the image. This actually serves to strengthen the security of the message, since to brute-force the message they not only have to decrypt the message, but they have to find the right bits to decrypt in the first place.

Really, even with a Beowulf cluster, processing that many images so soon makes it seem like they gave it only a cursory examination.

Re:only in english

[Anonymous Coward]

Exactly. Saying "we didn't detect any crypography" only shows that their methods are flawed.

When stego hit the news before, a year ago, I posted a message to a binaries group a year ago with stego in it and not a single of these studies has found it. I invented the method, which seemed obvious to me, and they didn't find it. I don't expect them to.

It's not that my stego was smart, but that it was foreign, and there are a million more ways to stego than to encrypt it.

ps. My dumb method was to encode five paragraphs of shakespeare. Shuffle the letter placing ABC to CAB and add it to each [sq. root of PI]'th pixel so it would occasionally skip one. It was added to a picture, of course, of goatse.

Re:AOL did NOT fix the hole

[rabidcow]

Yes, but you still need to get the packet in question processed in the right part of AIM. Previously, these could be sent normally through the service from another user. Now, you somehow have to slip it into the communication stream, afaik this means using some sort of packet sniffer to find and monitor the connection for a while at least.

This is not security through obscurity, it's taking a trivial exploit and making it nearly impossible. I should hope they're also working on fixing the actual buffer overflow, but for now, and for users who don't upgrade (or don't know how) once this is done, it's much less of a concern.

Somebody should run stegdetect on color copies!

[GlenRaphael]

According to many links in an earlier /. story, color Xerox copy machines currently embed a serial number in every copy they make. So has anybody tried making a color copy of something, scanning it, and using stegdetect on the result?