Slashdot Log In
Blocking Steganosonic Data In Phone Calls
Posted by
kdawson
on Wed Apr 02, 2008 02:18 AM
from the could-you-repeat-that-please dept.
from the could-you-repeat-that-please dept.
psyced writes "Steganography is a technique to encode secret messages in the background noise of an audio recording or photograph. There have been attempts at steganalysis in the past, but scientists at FH St. Pölten are developing strategies to block out secret data in VoIP and even GSM phone calls by preemptively modifying background noise (link is to a Google translation of the German original) on a level that stays inaudible or invisible, yet destroys any message encoded within. I wonder if this method could be applied to hiding messages in executables, too."
Related Stories
[+]
News: Disappearing Cryptography 46 comments
Another chromatic review, this time of Disappearing Cryptography. It is a fortunate circumstance that even as governments -- and others -- are becoming more interested in peering over your shoulder, or at least at your data traffic, the exchange of large files suitable for hiding messages has become commonplace. Peter Wayner is also the author of Free For All , reviewed here on Slashdot a few months back.
[+]
Hydan: Steganography in Executables 235 comments
An anonymous reader says "Ever wanted to hide a message into an executable? Now you can with Hydan. Presented recently by Rakan El-Khalil at Defcon and Blackhat, this tool lets you embed data into an application without changing its functionality or filesize! Check it out. Use includes steganography as well as embedding a program's signature into itself to verify it's not been tampered with."
[+]
Secret Data: Steganography v Steganalysis 280 comments
gManZboy writes "Two researchers in China has taken a look at the steganography vs. steganalysis arms race. Steganography (hiding data) has drawn more attention recently, as those concerned about information security have recognized that illicit use of the technique might become a threat (to companies or even states). Researchers have thus increased study of steganalysis, the detection of embedded information."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not going to work.... (Score:5, Interesting)
That's completely pointless. All it does is create an arms race. Any amount of noise you add can simply be dealt with by including the stego data more than once or using checksums or whatever. Any amount of damage sufficient to prevent any possibility of hidden messages would result in significant audible alteration of the sound to the point of unusability....
Re:Not going to work.... (Score:4, Interesting)
Parent
Re:Not going to work.... (Score:5, Insightful)
Maybe they will use the foreground noise -- for example, they could alter the pitch of the speaking voice to precisely fall into certain discrete frequency ranges, and then they occasionally bump a couple of samples into an 'unused' range and use those as a simple binary encoding of the secret data.
If they use enough discrete frequency ranges, the general tone of the speaker's vioce won't be noticeably different and the occasional minor shifts in frequency for the encoded data will hardly stand out.
That is just one example that I literally thought up in 30 seconds. I'm sure someone who was really concentrating could come up with much better ways to defeat the described countermeasures.
Parent
Re:Not going to work.... (Score:5, Insightful)
Given that this project is (according to TFA) partnered by the Ministry of Defence, this smells to me like someone spending a lot of money defending against a non-existent threat. What's the betting they used the magic word "terrorism" in their grant application?
Parent
Re:Not going to work.... (Score:4, Insightful)
It's against the people itself. It's propaganda to keep the "terror" alive in memory, generating visions of terrorist so advanced we have to process and inspect all telecommunication, so you can feel safe.
Please, have a look at this documentary: The century of the self [bbc.co.uk].
Parent
Re: (Score:3, Informative)
a.) The project is a feasibility evaluation, and as such doesn't have to produce results.
b.) The Austrian Ministry of Defence is supporting this project.
This isn't even remotely like DARPA, so chill out
Re: (Score:3, Insightful)
Just as a degenerate example of a little thought experiment...what if I use PKE to encrypt a message to the person on the other end of the line and then write it out in hex? The conversation would go something like: "A! F! 3! 8! 8! 4! 9! BEEEEE!!!"
This is, of course, the most trivially stupid possible way to do this. Much better would be to write a small program that translates the encrypted message to, say, base-256 and then bleeps short tones in one of 256 different frequencies to the receiver program,
Re: (Score:3, Insightful)
Far far easier than trying to secretly encode a message in the background of my audio phone call, and no special gear needed.
Wow are the "spies" of the world getting incredibly lazy? I can come up with at least 30 ways to get around this, one of which is having several prepay disposable cellphones to get around them even tapping my pho
Re: (Score:3, Informative)
I couldn't read TFA as Google translation was hung, but I question the summary's definition of steganography as hiding data in the "background noise".
If you read wikipedia's steganography entry [wikipedia.org], you'll see no mention of background/foreground noise in the definition. My understanding is that steganography generally alters the lowest order bits in a audio/video/image fil
Re:Not going to work.... (Score:5, Funny)
Sounds like an average mobile phone call to me...
Parent
Re:Not going to work.... (Score:4, Funny)
Parent
Re:Not going to work.... (Score:5, Interesting)
Parent
Re: (Score:3, Interesting)
The jamming will also easily be defeated by an entirely new branch of coding theory using the BBC algorithm ( http://crisp.cs.du.edu/frisc/baird.pdf [du.edu]). Error correction is distributed throughout the data stream, so even if the jammer completely obliterates parts of the signal--to the point that the original signal is unintelligible--the coded message will still get through.
This coding theory is handy for all sorts of stuff, from military comms to cell phones to MIMO access points. And unlike most crypto
Re: (Score:3, Funny)
Yes, but how to do this in real-time in a cryptographically secure manner is the subject of much ongoing research.
The feeling in the research community at the moment is that efficient stego-redundancy requires a working database of discovered steganographic synonyms, i.e. a stegosaurus [wikipedia.org].
Re: (Score:3, Insightful)
Re:Not going to work.... (Score:5, Insightful)
(More) deniability.
Parent
Re: (Score:3, Insightful)
I doubt the CIA will investigate every no carrier joke on slashdot, and if they di^H^H^H^H^H^ 01101000 01110100 01110100 01110000 00111010 00101111 00101111 01110111 01110111 01110111 00101110 01111001 01101111 01110101 01110100 01110101 01100010
Re:Not going to work.... (Score:5, Insightful)
Because, they can tell when you send an encrypted e-mail.
The whole point of steganography is to embed the secret message in something you broadcast in the clear, and have nobody be any the wiser that you are, in fact, sending hidden data. You give up your covertness when you observably send something secret. If nobody knows you sent it, they're not looking for it. They just think you were talking about your aunt's petunias.
Think of it as analogous to fieldcraft for spies -- you're supposed to be able to do something completely innocuous so that they can't ever confirm that you've actually done something nefarious.
This system is trying to preemptively just eliminate the ability to send something embedded in a clear-channel communication. Basically, take away your ability to send an encrypted sub-channel in your normal conversation.
Cheers
Parent
Re: (Score:3, Interesting)
Re:Not going to work.... (Score:4, Funny)
Layne
Parent
Subliminal white-noise? (Score:2)
I guess its one way to prevent getting the alien infection from over the phone (anyone remember Threshold)... might mitigate some people's fears of harmful sensation. http://en.wikipedia.org/wiki/Motif_of_harmful_sensation [wikipedia.org]
I wonder if it will foil over the phone lie-detectors like this one: http://www.liarcard.com/ [liarcard.com] ?
Not a secret message. (Score:5, Funny)
I repeat, the butterfly flaps its wings twice.
Re: (Score:2)
Just hope we're not too late.
Re: (Score:3, Funny)
Just need to check because that looked like one of the secret code words I am supposed to be watching out for, anyway if that is you Francis ( there is a code word for this somewhere but I think it's in the basement somewhere so I'll just give you the gist ) the "materials", you know what I mean eh - one ends the barrel and they're "easily triggered", anyway the "materials" will be loaded onto the Builders Merchants truck which will then be park
Re: (Score:3, Funny)
I saw a bug.
-
Re:Not a secret message. (Score:5, Funny)
I repeat, the butterfly flaps its wings twice.
Please clarify immediately. Is that just a repetition or does the butterfly flap its wings four times. This could be the difference between a gang of naked teenagers invading Prime Minister's question time and the defacing of Nelson's column.
Parent
Re: (Score:2)
What is this a reference to? Whatever it is, it doesn't appear to be that popular [google.co.in]. If this is a sci-fi movie quote... I wanna see the movie it's in...
I like parent's sig (Score:3, Insightful)
I see the parents sig as a sort of darwinian filter on how careful one is the slashdot reader at clicking link.
Can I add random noise to a .exe file...? (Score:2)
Yes, you can, sort of. (Score:3, Informative)
Or.. (Score:2)
myString = "FooFoogh234h2j4hj23hj";
search the executable for FooFoo then read the following bytes.
Re:Or.. (Score:4, Informative)
cmp eax, edx
jle offset
to
cmp edx, eax
jae offset
(insert your own variation here). Have a program read all cmp eax, edx (or cmp edx, eax) opcodes and output 0 for the first and 1 for the second.
Parent
Re: (Score:2, Informative)
Additionally you can use empty areas in executable formats, in the headers or padding. Or even add an extra data segment... If file size is no issue, you can typically just concatenate some extra data in the end of file.
However, instruction sequenc
Re: (Score:2)
Re: (Score:3, Informative)
I personally think this is just another government handout. There are so many much easier ways to hide a secret message than using a phone. Hell, they could just post one of those stupid lolcat pictures on the web with the message inside. The operative would only have to know somet
Re:Can I add random noise to a .exe file...? (Score:5, Interesting)
Parent
As the tag says: encryption. (Score:4, Insightful)
Re: (Score:2)
Microsoft uses that. (Score:5, Funny)
Yes, a similar method has been employed by Microsoft to all the executables it ever released, ever since the times of MS-DOS.
After compilation they run the program through a special utility that modifies a few bits in the executable at random. Then they run the resulting executable through some tests and if it passes, they release it, if it crashes, they try with a different random bits.
Arrogant bastards! (Score:5, Interesting)
Good work, guys - Even a classic BOFH has higher efficacy and useability standards than anything related to the War on Non-Western, Non-Irish, Non-Russian (and "non-former-Soviet") Terror. At least the BOFH's systems work for him, you asshats can't even manage that despite taking all that daaaaaaangerous toothpaste away from us.
However, even I overstate the case here - Encoding data in background noise doesn't break any laws!
We all have every right to send hidden data, or even to use hard encryption right in plain sight. However, exercising that right may lead to some undue scrutiny, and thus we expose the real reason for techniques like this... Erosion of plausible deniability, which The Powers That Be loathe far, far more than any actual threat. It looks bad to just deport and torture someone with no evidence. But if you can demonstrate that he had (gasp!) something he didn't want the whole world to know about (because only criminals have secrets, of course), well then the sheep will approve of going all Jack Bauer on him.
Fundamentally flawed (Score:3, Insightful)
Obscuring data equals obscuring the patterns. So, to obscure the data within a 0 and 1 pattern, you might switch around the 0s and 1s.
For a message embedded in the background noise in a phone call, data may be modulated as 'loudness of background noise within a certain frequency range' or whatever. Obscuring this would be to add random data in the frequency range or whatever.
But that actually takes knowledge of the pattern used. If the pattern is rather the speaker knocking on a table, then any method designed to obscure background noise wouldn't register it or obscure it. It's similar to a scrambling technique that randomizes the 0s and 1s on a diskette sent in the post, while the actual message may be morse code holes punched in the plastic.
Conclusion: To void steganographic data, you need to know the method used to embed it.
Hiding information in an executable is easy (Score:3, Insightful)
You can also reverse the order of many comparison operations as long as you also modify the following branch/set instructions.
If you want to jam such a channel you would have to do the same job, first identifying all the possible locations for such transformations, then randomly flip half of them.
(Un?)fortunately neither the encoding nor the jamming process can be totally secure, because you can check (or know up front) which compiler had generated the original executable, then decompile/recompile and check which encodings the compiler tend to use.
Terje
Wow, more money spent on foolishness (Score:4, Interesting)
Stopping secret messages? , puleeese.
"John has a long mustache"
"The chair is against the wall"
Stop that!
Steganography and watermarking. (Score:5, Insightful)
The interesting thing is who is on which side of the battle.
Generally it's corporations who like the idea of watermarks, and individuals who don't. Individuals do however like steganography, but the authorities don't. It will be interesting to see who develops what technologies and who, if anyone, wins this arms race.
The real question is.. (Score:5, Interesting)
It's along the lines of "How do you tell if there are stego images on someone's computer?"
Answer:You find the stego converter tool on their harddrive.
Re: (Score:3, Interesting)
The nice thing was precisely that it wasn't encrypted so the messages didn't just disappear, as so many others we sent did. (We started serializing our messages so we could tell when ones were going missing.)
So
Snoops (Score:3, Interesting)
I want end-to-end encryption on all my calls. This could be added to cell phones with some modest changes. Not having it on VOIP is just inexcusable. If the FBI wants to tap my phone, why don't they get off their lazy asses, obtain a warrant, and do some actual work, rather than expecting everything to be handed to them on a silver platter, complete with booze and hookers. I'm under no obligation to make it easy for them.
Why block? (Score:3, Insightful)
That said, it is relatively easy to disrupt stego by lossy compression/decompression or vice-versa if the source is compressed. Low-order bits will get stripped in JPEGs & MP3s. This obviously doesn't work for loss-less compression as is needed for binaries. If hash or other non-compressibles found, just rehash. Once you've decided to meddle inthe datastream, some eggs will get broken. You'll have both alpha and beta errors (misses and false postives).
Sounds impossibly (Score:3, Interesting)
Unfortunately, I don't real have anything to go on other than a Google translated abstract, a Slashdot headline, and armchair knowledge of electronics. Anyone care to correct me?
Steganography in program files (Score:2)