Evidence of Steganography in Real Criminal Cases

ancientribe writes "Researchers at Purdue University have found proof that criminals are making use of steganography in the field. Steganography is the stealth technique of hiding text or images within image files. Experts say that the wide availability of free point-and-click steganography tools is making the method of hiding illicit images and text easier to use. Not everyone is convinced; some security experts such as Bruce Schneier have dismissed steganography as too complex and conspicuous for the bad guys to bother using, especially for inside corporate espionage: 'It doesn't make sense that someone selling out the company can't just leave with a USB.'"

Comments

looks like something doesn't work properly

[petes_PoV]

The whole point of steganography is to embed undetectable data in a file. If some people now claim to have found evidence of it, then the original users can't have a very effective steganographic process.

Maybe this really means that the software available for this type of use just doesn't work very well?

Re:looks like something doesn't work properly

[mu22le]

The article is just saying that they found steganographic software on some criminal's pc.

FYI you can detect the presence of steganographed information by statistical means (http://en.wikipedia.org/wiki/Steganalysis).

These must be freshman researchers

[tkrotchko]

Kids,

To those versed in statistics or the scientific method, find the flaw in this statement (as taken from the article):

"with the little data we have so far, we are finding that there's a strong correlation between criminal activity and at least the installation of steganography programs on those [confiscated] computers"

With the little data I have so far, I think the researchers are pulling our leg.

Re:These must be freshman researchers

[Obyron]

Since being inconspicuous is the very definition of steganography, something tells me Mr. Schneier doesn't have a firm handle on the concept

Considering that Bruce Schneier has been around the block for a loooong time and has written several good books on cryptography and computer security, including the seminal "Applied Cryptography" (which needs a new edition! Hint hint if you're out there, Bruce!), I think it's far more likely that you have no idea who Bruce Schneier is. I'm sure that by "conspicuous" he's referring to the fact that steganography can be detected through statistical analysis, and the fact that most steganography software is crap.

Being inconspicuous isn't the definition of steganography any more than being secure is the definition of cryptography (Ceasar Ciphers, ROT-13, DES). They're both just important traits that make their respective -graphies more effective. Bruce's statement is referring to the sad state of pretty much all of the steganographic software out there right now, because it's pretty much all the security equivalent to sticking your super secret files in a hidden directory and hoping the secret police just overlook it.

I doubt it happens on a large scale

[starseeker]

Installation of steganography tools != using those tools in practice. If someone is looking to conceal data, they may be grabbing anything out there that stands a remote chance of being helpful. Sort of like how in the early days students would have all kinds of music players and point-to-point file exchange programs, looking for ones that would do what they wanted or had what they wanted.

James Wingate, director of the steganography analysis & research center at Backbone Security, and a vice president there, says the use of steganography is on the rise, and it could be used for things like transporting malware.

"Some would call me 'Chicken Little,' but I fervently and passionately believe criminal activity is being conducted with steganography... We do know it's being used to conceal child pornography," Wingate says. "

When someone "fervently and passionately" believes something, particularly something related to a day-to-day project where one's institution stands a good chance of increased funding if what you believe is true, that's a good indication that you need to look hard for real, reproducible evidence that will stand up to rigorous peer review. Nor should concealing those types of images be surprising - unfortunately there seem to be a large number of sickos out there with this stuff, and probably every data-concealing program ever written has been used to conceal it (or try to). More to the point, is it in WIDE use?

I agree that a USB stick is a much more plausible attach vector for a company insider (no "hey what was that huge surge of email traffic with images?" signatures for IT to poke their noses into, just for starters.) If someone wants to hide data on their machine, I would think any of the various harddrive encryption techniques would both be simpler and much more effective.

I remember looking around at steganography tools some years back for other purposes (watermarking images people were considering contributing to a collectibles website) and my conclusion was that the most practical use of the techniques was to store information one WANTED to be found - another way to put metadata into an image so you could later figure out additional information about it (say, for a baseball card certified by a company you could add the certification information using steganography to ensure later availability of the information even without the website context, unless the image was compressed or otherwise distorted. It didn't and doesn't strike me as anything that can be used for anything uniquely evil or even uniquely practical (real image metadata is most likely a better place for useful info, and hiding information in it is an iffy proposition at best.

Remember, just because non-government researchers can't cover all 800+ programs doesn't mean someone like the NSA with large funding and budgets couldn't throw resources at it until they had all of them covered. Somebody will probably use it, but someone will use virtually every possible technique to do something at least once in the vastness of the Internet so that's not a very interesting statement. The interesting question is will a lot of people use it, and I just can't see it being worth the trouble.

get over it

[m2943]

First, legislatures pass bullshit laws about cryptography despite warnings that they are going to be ineffective because of steganography. Now, they claim that the sky is falling because people are using it.

Right now, police can still detect the steganography tools, but those will start to be hidden as well. Encrypted, hidden data can be added to MP3s, MPEG4s, PDFs, scans, executables, random leftover noise on the disk. It can be hidden on microSD cards, printed on paper, and hidden on DVDs.

There is no way governments or companies can stop covert communications of data. Get over it and stop making laws that are unenforceable but give police and governments ever more tools to abuse their powers.

Re:get over it

[Kjella]

Encrypted, hidden data can be added to MP3s, MPEG4s, Actually, the more compressed the less likely you can embed anything useful. Trying to embed information would either lead to inefficient compression, which can be detected or to unnatural noise which can also be detected. Also you can't have an unembedded and an embedded version around, so adding stenography to that episode of Heroes you send would be really stupid and trivially found with a diff. Most good formats like bmp, wav etc. would raise eyebrows since they're so uncommon. I think your favorite non-suspicious option today would be getting a digicam with a raw option, then use the least significant color bit. It's near noise anyway since very few cameras can actually detect 10/12 bits/channel, there's no reference to go by and it's perfectly reasonable to share photos that way. Do an AES pass on the data so you're writing psuedo-random data, and I imagine it'd be rather hard to detect.

Summary of Article

[Chapter80]

Research Shows Image-Based Threat on the Rise
New Purdue University research shows steganography, long considered a minor threat, may be on the rise
OCTOBER 18, 2007 | 6:00 PM

By Kelly Jackson Higgins Senior Editor, Dark Reading

Until recently, steganography, the stealth technique of hiding text or images within image files, has mostly been considered too complex -- and conspicuous -- to be much of a threat. But some forensics experts now worry that the bad guys are starting to use the tactic more frequently, especially in child pornography and identity theft trafficking.

There are an estimated 800 or so steganography tools available online, many of them free and with user-friendly graphical user interfaces and point-and-click features. This broad availability making steganography more accessible and easier to use for hiding and moving stolen or illicit payloads, experts say.

Security experts to date have mostly dismissed steganography as a mainstream threat, relegating it to the domain of spooks and the feds. Their skepticism has been well-founded: The few studies that have searched for images hiding steganographic messages have come up empty-handed.

Debunking steganography

[DrYak]

In fact people like Guillermito has regularly showed that a lot point'n'click stegano softs are just completely useless. They either don't work at all (fail to transport data) or store the data in nearly not hidden at all way (payload stored as-is past the end of the file, or zero-padded and used for the least significant bit of the file without any encryption).

Specially if the marketing blurb mentions "military grade" (translation : triple AES is used to store the password. The reader software inputs a password from the user and if it matches the hash... the soft proceeds extracting the otherwise clear, non crypted and un-obfuscated payload).

So while it *is* possible to design actually working steganography, if a would-be pedo-terrorist-criminal tries to google for stenographic software, he'll most likely land on useless software.

This is just the first stage ...

[Thrip]

Once they've planted the idea in the public's head that child pornographers hide kiddie porn in innocent images, then they can start embedding child porn in all sorts of things, so that when they feel like arresting you, there's a good chance there will be child porn on your computer and your ISP will have server logs of you downloading it. Or maybe I'm just being paranoid.

Re:"Security Expert"

[stranger_to_himself]

Who calls USB keys "USB"s like one of my computer illiterate friends. Or is this some new kind of slang that I am not aware of.

Is there a common standard term for them yet? People I know call them variously "USB drive", "USB key", "Key drive", "Pen Drive", "Memory Stick", "USB stick", "USB..um..memory..thing", or "You know, that thing that goes in the USB slot that you keep stuff on". I personally call mine 'Steve' to avoid the confusion.

Re:"Security Expert"

[Frnknstn]

Who calls USB memory sticks 'USB Keys'?

The best implementation

[Chapter80]

There are about 800 programs that do steganography. The best implementation that I have seen so far works like this:

First the program takes the target JPG (which you want to be very large), and treats it as random noise. Simply a field of random zeros and ones. Then, within that vast field, the program selects a pattern or frequency to place variations in the noise pattern.

The variations in the noise pattern act as a beacon - sort of a signal that the payload is coming. Common variations include mathematical pulses at predictable intervals - say something that would easily be recognizable by a 5th-grader, like say a pattern of prime numbers.

Then it layers in a second layer, nested within the main signal. Some bits are bits to tell how to interpret the other bits. Use a gray scale with standard interpolation. Rotate the second layer 90 degrees. Make sure there's a string break every 60 characters, and add an auxiliary sideband channel. Make sure that the second layer is zoomed in sufficiently, and using a less popular protocol language, so that upon first glance it's not easily recognizable.

Here's the magical part: It then adds in a third layer. Sort of like in ancient times when parchment was in short supply people would write over old writing... it was called a palimpsest. Here you can catalog over 10,000 "frames" of data, which can communicate any message that you want.

Further details on this method can be found here.

Re:"Security Expert"

[GregNorc]

You are doubting Bruce Schneier? There are a few things you should know before you question his credentials... When Bruce Schneier observes a quantum particle, it remains in the same state until he has finished observing it. Though a superhero, Bruce Schneier disdanes the use of a mask or secret identity as 'security through obscurity. Most people use passwords. Some people use passphrases. Bruce Schneier uses an epic passpoem, detailing the life and works of seven mythical Norse heroes.

Re:"Security Expert"

[Paradise Pete]

People I know call them variously "USB drive", "USB key", "Key drive", "Pen Drive", "Memory Stick", "USB stick", "USB..um..memory..thing", or "You know, that thing that goes in the USB slot that you keep stuff on". I personally call mine 'Steve' to avoid the confusion.

In a Spanish-speaking office I was trying to guess at the name and called it a palito, which literally means "little stick." It took about two minutes for the laughter to die down, and then I learned that palito is slang for dick.

Re:"Security Expert"

[NormalVisual]

You forgot to mention that Bruce Schneier also taught martial arts to Chuck Norris.