Slashdot Mirror
BitTorrent's Bram Cohen Unveils New Steganography Tool DissidentX
Sparrowvsrevolution writes "For the last year Bram Cohen, who created the breakthrough file-sharing protocol BitTorrent a decade ago, has been working on a tool he calls DissidentX, a steganography tool that's available now but is still being improved with the help of a group of researchers at Stanford. Like any stego tool, DissidentX can camouflage users' secrets in an inconspicuous website, a corporate document, or any other, pre-existing file from a Rick Astley video to a digital copy of Crime and Punishment. But it uses a new form of steganography based on cryptographic hashes to make the presence of a hidden message far harder for an eavesdropper to detect than in traditional stego. And it also makes it possible to encode multiple encrypted messages to different keys in the same cover text."
deserves a medal.
Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
Svefg cbfg!
Come on guys! At least post a link to the project.
https://github.com/bramcohen/DissidentX
It's probably better to work on this kind of thing in silence until it's released...
If you're a whistleblower and use proprietary software, you're braindead. Might soon all dead...
01101110 01101111 00100000 01101101
01101111 01110010 01100101 00100000
01110011 01100101 01100011 01110010
01100101 01110100 01110011
People who want to increase the chances that something will stay secret? People who want to reveal the crimes of their governments?
Need is relative. Even if all i want to do is have my wife send me a note to pick up milk on the way home, its not the governments business. So in reality, *yes* i do have something to hide. It doesn't mean i'm a criminal. Its called personal privacy.
---- Booth was a patriot ----
There are tools to spot obvious steganography, especially if the de-stegged picture is already on the Internet somewhere. I remember reading something on /. where a researcher did a mass scan of Web pictures, and found almost no stego whatsoever.
Stego is a useful tool for transporting provided the de-stegoed document never, ever winds up on the Internet, but for storing data, it would be a lot better to use something like TrueCrypt or PhonebookFS.
People who live in a country with a security force that can make you disappear and torture you to death for posting the wrong message unencrypted.
This does not even have tests. Barely any project-like organization. Just a bunch of python scripts hobbled together. Seriously, this is barely v0.1 material.
Call it a proof-of-concept, an experiment, anything. But not a tool.
What is it with all the dinosaur porn lately? Stenography probably predates the first man-cave, and was probably responsible for early advances in inter-cave communication.
rewriting history since 2109
But it uses a new form of steganography based on cryptographic hashes to make the presence of a hidden message far harder for an eavesdropper to detect than in traditional stego.
I think steganography is far more likely to be used to track the people who leak information. When information gets out that was apparently available to multiple people, the leaker may not realize that his copy had a specific steganographic signature that identifies him as the source. It could be a pattern of extra spaces or line breaks in the code of document that he doesn't even see. The increased availability of the technology will likely mean smaller companies or government agencies will use it to suppress leaks.
I see it as more of a big "screw you" to the people who want to watch everything we do.
I'm not committing any crime, and you have no reasonable basis to believe I am. It's still my right to communicate and keep some things private.
But if you're going to insist on tracking everything we do, we're going to make your job harder.
Expect to see lots of products intended to give end-user security.
If you're willing to allow the government to spy on everything you do (clearly not the case since you posted as AC), that's your problem.
Since the whole planet is being spied on by the US, denying them the information is the best response.
Lost at C:>. Found at C.
I'd like to see someone come up with a steganographic RAID-ish storage volume. I'd like a driver that scattered encrypted data throughout my media files but presented that data as an updateable storage volume. It would need enough redundancy to survive the loss of some of the files (hence the RAID-ish part.) If I could hide writeable encrypted data throughout my iTunes, Photo, Video files and access/update it without actually changing the size, mod dates, etc of the files it would be very handy and reasonably hard to detect.
Suppose you were an idiot. And suppose you were a member of congress. But then I repeat myself. -- Mark Twain
You seem confused about which way you want to troll this one. I admire the thought that maybe you could embrace the power of AND and go both ways, but, sometimes that doesn't work out. This is one of those times.
Cue the NSA insisting that they need to examine every photo and video that passes over the Internet because terrorists might be using this.
Also cue some enterprising NSA employee convincing his superiors that terrorists might hide stuff on porn sites and he needs to examine those photos/videos very carefully and repeatedly.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
All the other side needs to know is that you have something to hide, and depending on the level of society you live on, water boarding, lead pipes, or court order to make you divulge what it is.
Unsophisticated societies use lead pipes to force people to divulge information.
Sophisticated societies use court orders.
Modern societies use waterboarding.
Postmodern societies use facebook.
Think about it.
...what sibling said.
If you post a unique picture to, say, Instagram, then there's not going to be anything to compare against, especially if you're using something non-obvious and intelligent. If you post a unique Excel document with lots of formulas/macros in it, then that's obviously going to bork-up any attempt at finding steganography by way of algorithm. Even in your example of MS Word? one custom font, embedded picture/graph, macro and suchlike will happily help your document evade detection if the encryption lives within the image data.
That said, there are certainly means of testing against it by taking an image and meticulously deconstructing the thing, but that takes processing power and time (even if that time is measured in microseconds, it's still time, especially when you factor in download, data storage, IOPS, weeding out mis-named file extensions, etc - multiplied by the # of files processed.)
Also, I noticed something in your post - you mention posting something on a regular basis. Err, why bother using the same images over and over again? Upload each image/message once, and if it's pr0n (say you sketch the stuff and then photograph it, or make some unique screenshot and pass that around), your recipient would be only one of a mass of people downloading the thing.
Quo usque tandem abutere, Nimbus, patientia nostra?
But normal people do not need this - it's completely loony-tunes.
Normal people shouldn't need this. What's completely loony-tunes is that they do.
systemd is Roko's Basilisk.
*ahem* - apparently this little project costs the end-user $0.00 to acquire.
Not seeing much profit going on with this one...
Quo usque tandem abutere, Nimbus, patientia nostra?
There are simpler ways as well, depending on what one's forseen adversary is. In a past life, I had to deal with a third party whose E-mail server refused to allow any E-mail attachments whatsoever except Acrobat, and AutoCAD files were needed to be exchanged fairly quickly. So, when sending the DXF file, I ended up embedding it as an attachment in a password-protected PDF, and this did the trick.
Yes, but other than that ... and a run-away / out of control government, the USA is not so bad!
I just encode messages by changing the font of the letters in the hidden message to comic sans.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
1) Whether he has a wife or not is the government's business. He notifies them every time he files taxes (married and filing jointly/separately)
2) She can request that he buys milk on the way home. It's a sign of working as a team.
I could also say that he is likely to do it because he enjoys being married, but I think that's a bit sensationalist.
I refuse to sign
Stego is a useful tool for transporting provided the de-stegoed document never, ever winds up on the Internet
Just make sure vast numbers of multiple "similar but not exactly the same" pictures like that one you're using are already on the internet. What did you think all those funny cat meme pictures were for?
He got you, didn't he? I'd call that a success.
Will it be closed like Bittorrent-sync?
Innocent People residing in a land with a security agency of questionable legality in its practices? In other words, 90+% of Americans?
In a past life, I had to deal with a third party whose E-mail server refused to allow any E-mail attachments whatsoever except Acrobat, and AutoCAD files were needed to be exchanged fairly quickly. So, when sending the DXF file, I ended up embedding it as an attachment in a password-protected PDF, and this did the trick.
You probably went to a lot of unnecessary work. Just rename your file "sekritdrawing.dxf.PDF" and it'll get past the server's filter just fine.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
Of course I didn't read TFA!
Will there be an effective way for cryptanalysts to know the number of separately encrypted messages that exist within a data object? If so, the deniability feature of this will be of little use. If the number is not known, then handing over the password to a relatively innocuous message might be sufficient to end the interrogation. If the number is known, the waterboarding will continue until all passwords are revealed..
Have gnu, will travel.
it would surprise me if they don't have automated tools to spot steganography. (i.e. They know exactly what the formatting of say a Word document should be, and should have the capability to automatically flag traffic which has nonstandard information in the headers or data.)
Have you seen the formatting of Word documents that come out of your typical user?
You don't hit the "enter" key to make space, you jackasses. That creates a new fucking paragraph. Edit the paragraph's spacing if you want space below it. If you want an actual newline+carriage return, hit shift+enter. Stop using tab without first defining your tab stops to control where you want shit to be. Why are you using tabs to make columns anyway? Why are you trying to make columns (incorrectly via tabs) when what you want is a table? That's it, you're getting party vanned.
I have a macro that removes tabs, double newlines, and double spaces after periods among other things. I don't really fault users - most people learned word processing by simply dicking around with the software.
The worst one for me is when they don't set the tab stops and so resort to hitting tab and then space a few times until the text lines up approximately where they want. No (easy) way to automate that out!
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Hashes are *always* one way. So you can't ever decrypt something that you only have a hash from. The best you can do is compare the hash to a hash of something you have as well and see if the hashes are the same. Unless you've chosen an algorithm that is known to have a lot of collisions, you can be fairly certain that your original text is probably the same thing as the other person's original text if the hashes are identical. Encrypting something with hashes so others can read it therefor doesn't work and this can't be based on "cryptographic hashes"
I was promised a flying car. Where is my flying car?
This is really clever. It includes encoders that use tabs spaces at the ends of lines, and even Oxford commas. That is ridiculously cool. Nice work, Bram & co.!
Building Better Software
That is proper modern steganography, yes. It's a relatively new development compared to the long history of steganography. The key question, though, is if you're going to use encryption on your source data anyway, why go so far as to hide the cipher text inside a special, different container? Presumably, the answer has something to do the relative amount of work of detection. However, it seems like it would be easier and more effective to hide the encrypted data in a large sea of entropy (on whichever storage device). That will be harder to sort through than any mere individual file.
As far as I can tell, the only real advantage of steganography is that if no one is looking for it, they won't find anything odd. With encrypted data, the high entropy state appears to be gibberish when interpreted by any normal means, and thus looks out of the ordinary on computer systems full of low entropy data.
Today, that's pretty much all of them.
But normal people do not need this
You are not thinking creatively enough. I can see a dozen uses for this, some playful, some serious, some a bit geeky, some artistic.
Assorted stuff I do sometimes: Lemuria.org
You ARE the problem. You've been conditioned to believe this since 9/11 and it's wrong. Us old folks remember when our lives were private unless WE divulged the information. They've trained millennials to SHARE everything and quite a few of us older folks think we have to change with the times. Well, no. Fuck that.
Tell me what you believe...I'll tell you what you should see.
If you can make the diff of the documents
1) take photo
2) do steno stuff to hide data
3) delete original
Ideally you wanna get a digital camera with a ton of megapixels and a very crappy sensor -- ie, one with a very noisy image. I've got a Canon SX100IS that should do nicely, particularly if you use dim lighting...
Just how old are you? America started spying on its citizens during the civil war by intercepting the telegraph, ramped it up during WWI when national security started to be used to justify removable of what were apparent rights such as free speech and not much later the rule of J. Edgar Hoover, based on having dirt on everyone, started.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
I don't understand. If I put a message in some seemingly random data, either it stays on my system or I look suspicious for sending it to somebody else. If I use my phone to get JPEGs of my cats looking cute, and embed messages in them, and send them around, and never reuse a photograph, I'm not doing anything suspicious. (Selfies would also work, but I personally don't like sending all sorts of photographs of me around.)
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Or he fake trolled himself, the real troll, to get you?
I've still not finished "Gödel, Escher, Bach: An Eternal Golden Braid", so I don't know the answer yet.