Slashdot Mirror
Steganography with Flickr
yiangocy writes "Steganography
is not something new, there have been techniques and available programs for hiding data in pictures/audio files for a long time now. However, one step further is using popular online photo sharing sites, such as Flickr in hiding your data, successfully."
Nothing to see here. Please Move along.
Not exactly a new idea, goverments have been paranoid of "Terrorists" using stego on places like ebay for triggers.
More interesting projects, though off topic slightly; a method of obscuring your network communications and resolving key issues with stego (though I think the project stopped)
http://www.m-o-o-t.org/
They is also much more interesting uses for stego. in files, hdd slack space and this nice little project 4c.
http://dione.ids.pl/~shykta/
4c (or fourcrypt) is a multiple-file steganography program inspired by Michal Zalewski's twocrypt (2c) program, designed to be "subpoena-proof". It supports mixing between one and eight files with independent keys. The files are architecture-independant (tested on x86 and UltraSparc).
"I disapprove of what you say, but I will defend to the death your right to say it." - Voltaire
So basically they're showing you how to use a photo storage service to store private data. I think this is immoral and is probably against the terms of service.
Flikr could probably detect the changes anyway. When you do stego on Jpegs you do it by altering the coefficients on the waveforms. The problem is these coefficients usually conform to a gaussian distribution and by packing so much data in to the jpeg you're going to screw up that distribution.
To hide truly undetectable data in there is going to be difficult and the channel capacity wont be all too great. It's a clever idea but I'm against it. If you want storage, buy a web-hosting package and FTP it up tot there.
Simon
owell, its probably goatse now, you guys should just put (NSFW) after all wikipedia links.
This is an interesting article, but it has nothing to do with Flickr, except for the fact that instead of saving the images on a local device, this guy uploaded them to Flickr.
Yaaaawn, -1: misleading.
there's no place like ~
Easier? Sure, but a Flickr Pro account has unlimited storage.
Trolls lurk everywhere. Mod them down.
Also, if part of the point is simply to save non-image file types into a seemingly unlimited Flickr storage space, what happens if you simply change the file extension to something like filename.pdf.jpg and upload that? Does Flickr actually validate file contents?
Here's what I do: Bitty Browser & Andromeda
Saddam's Weapons of Mass Destruction have finally been found inside pictures! Call Fox STAT!
A couple of years ago newspapers and network news showed the cabin layout of a 747 shown inside the Mona Lisa, supposively used by terrorists. What supprised me was how little attention was payed to the fact that nobody was giving credit to Leonardo da Vinci for inventing the 747.
Woverly Harris Gooch, IV CTO American Fire and Bomb, LLC
You should probably try out Flickr then. They allow you to download the original size images.
http://www.flickr.com/help/photos/#89
Other similar techincs is hiding messages so it looks like a spam http://www.google.com/search?hl=en&lr=&q=hiding+me ssages+using+spam&btnG=Search
I've even read an article (can't find link right now) analizing some samples of the actual spam and concluding that they in fact used as an encripted communication medium by spam originators.
No. Sending to a gmail account is directed. If the receiver or sender is compromised then they can quite intercept the message. It may take them a while to decrypt it, but since they already know it's there then it's possible. Even if an attacker does not understand message, they gain information from the timing of it and the recipient. Posting to a flickr account means that it is impossible to track the recipient. Posting a random picture every day, eventually including a message, means that it is very difficult for an attacker to get any information.
I am TheRaven on Soylent News
Ho-hum. There are much better ways to back up your data for $25 a year.
This is a general "this can be used by terrists!" freak-out. Well, you know, this is an awfully stupid and ineffective way to pass information -- something Bruce Schneier likes to call "movie plot" vulnerabilities. Why bother with steganography when there are much better means to pass encrypted data between two people? Like, I don't know, DCC'ing a file over IRC, or just plain sending an email? If you own both the sending and receiving servers, or use one of the infected army of the drones, there is a miniscule chance of your message even being observed in the ocean of the information that is the internet. Much less stupid than using a complex routine to hide data in an image, and then upload it to a central service like Flickr for all to see (it shows up immediately in the "recently uploaded" pool).
This is a fine idea for a movie plot, but utterly dumb for someone to actually try this. Thus, I assign the article a -1 Troll.
If you open yourself to the foo, You and foo become one.
Why you are right there is NO legitimate use for this.
Only terrorists would use it to get information out like proof that GW bush knew there was no WMD's. or a secret Oval office taping that has "... I don't care the cost in american lives, I need to get saddam for daddy! You do not disrespect a bush! and he said bad things about my mommy..." or maybe those secret laws that are passed that you can not even be told about... Yes only TERRORISTS would get that information out so that the populace knew the truth...
as we all know the truth only supports terrorism! Be a good american! Join the Bush youth league! REport all unamerican activities to your local Homeland Security officer!
All hail bush! All hail bush!
A free mind is a dangerous mind!
posting anon to avoid being turned in for unamerican thought.
Flickr can have a simple solution to this, If they change a few random colour or other attributes on the uploaded pictures they would render the stego. worthless.
"I disapprove of what you say, but I will defend to the death your right to say it." - Voltaire
Yes, but would you want to upload pictures (stego or not) that are going to be modified by Flickr? If you are using Flickr as a backup and they modify the files, it is not exactly a great backup idea. I like my files to stay the away I uploaded them, and I am sure you would, too.
Not necessarily. The flipside of stegonography is "digital watermarking," which is the same thing, except used for copyright enforcement. There has been a lot of work done in creating watermarks which aren't too noticeable, but which are resistant to resampling etc.
Would be to zip all your files together, encrypt them, then share them on Kazaa as "hot XXX teen pporn pr0n tryout mother daughter incest dog sex sex sex.avi." You data will never be lost completely ;-)
Warning: this novel is a demanding read. It is a higher-brow---and markedly dystopian---treatment of the same themes as Neil Stephensen's Cryptonomicon. In writing it, Mr. Scholz seems to have received considerable help from insiders at the national laboratories.
With luck, the following link to Google Print will show you a sample page that is reasonably representative of the entire book.
http://print.google.com/print?id=kVP7pIA9TYUC&pg=P A382&lpg=PA382&dq=steganography&prev=http://www.go ogle.com/search%3Fclient%3Dsafari%26rls%3Den-us%26 q%3DRadiance%26ie%3DUTF-8%26oe%3DUTF-8&sig=-uyML9j p9G4JsUZOCa59fPI6YpM
So bad guys can communicate through even more opaque channels. Woop-dee-doo.
The too-often referenced 9/11 attack was not a failure of signals intelligence. Secret services whose job it is to capture communications did their job in this regard.
Information was not translated and/or acted upon.
Getting more sigint will lead to a panopticon society, without actually resolving the fundamental problem of our lack of human intelligence.
Information: "I want to be anthropomorphized"
I ran the image through stegdetect and it came up with a "false possitive". This utility detects images encoded with jsteg, jphide, invisible secrets, outguess, F5(header analysis), AppendX, and Camouflage. Although, steghide is not listed, I have found that false possitives are shown with images that I know to have an embeded file.
I played around with steganography at one time and setup a script to create embed images via the web using Outguess
From: Joe
To: Michelle
Subject: No stego here
<attachment: cutedoggy.jpg>
Adwords by Gooooooogle
Terrorists are using the Internet to send secret information.
www.paranoia.gov
Can't find your WMDs? Buy some more
www.dod.gov
Suspicious emails? Let us examine them
www.noprivacy.gov
Looking for Cute Doggies?
www.sexwithcutedogs.com
Windows Tweaks
BTW, it is possible to create a file consisting of two encrypted messages, with two keys, interleaved such that you can retrieve the one or the other. If the one message is innocent and the other not, then you can give the Police the innocent key and the other message remains deniable. This is described in Applied Cryptography.
Oh well, what the hell...
New Text Document.txt.jpg was not uploaded: File was not a recognised type or was unable to be decoded (we only support JPEG, PNG, non-animated GIF, BMP and TIFF)
Trolls lurk everywhere. Mod them down.