Battling Steganography 195
An anonymous reader submitted a fairly thin little story about a researcher who is Battling
Steganography. I can certainly see the appeal of the study but it really seems like a needle in a hay stack sort of project. And when you actually can detect one technique, new and better techniques will crop up and take its place.
Forget *battling* stenography. (Score:1)
Wait a minute (Score:5, Insightful)
Re:Wait a minute (Score:4, Insightful)
Was it just me, or did the article make it seem like anyone that would use steganography would be a criminal?
The article didn't say this at all. In fact, the types of criminal activity that were mentioned were "political and corporate espionage or illegal pornography."
Talking on the phone is not criminal, but wiretaps are used all the time in fighting organized crime.
Re:Wait a minute (Score:2)
"give me a grant" written all over it. When you're doing grant writing, you want to make something sound as important or cool as you possibly can. Even if it means you have to play up the problem you're solving a bit.
Of course, that's PR in general these days... I feel sortof dirty after I write things like that.
Relevance to legal community (Score:2)
Re:Wait a minute (Score:4, Insightful)
We might expect this of a promotional article. Breaking crypto to fight perverts sounds more exciting than studying paterns to detect private messages. Others have proposed better promotion, like making crypto stronger by breaking weak methods.
A good analogy to fight the underlying assumption of the negative promotion is cloathing. The assumption is that only criminals have something to hide. Bull. Try working words like "naked" and "bare" into your thoughts. Examples: "What, are you still sending naked email?", "Are you foolish enough to trust bare telnet logins?". People will get the idea.
Society does not work, and it's individuals are debassed when privacy is eliminated. It's impossible to have frank disscusions when you may be overheard by people who may missuderstand. It's impossible to invest or plan without privacy.
Re:Wait a minute (Score:3, Funny)
Go ahead and make the nudists look like criminals.
;)
Re:Wait a minute (Score:4, Funny)
We have to! It's for the children!
Re:Wait a minute (Score:2)
Re:Wait a minute (Score:1)
No! That burning money would create carcinogenic smoke, attracting more lawyers and starting the cycle of lawsuits all over again. Recycle instead.
Maybe this can help with spam? (Score:2)
Let's say I wanted a message to be available to a wide number of people, hidden with stenography, and encoded as well. I pick a image, such as an X10 ad, that could be easily found from a "legit" source. I encode my message, then hide the encoded message in the least significant bit of the color for each pixel of the image - net effect, the ad looks just about the same, but there is data encoded in it.
If I knew messages were being passed this way, I might be able to get the message. First, I'd have to acquire the source image. Then, I would do my own diffs, and try to find the meaningful data. At that point, it's a decryption problem.
But how do I detect the data hiding in the first place? I would have to detect that a stream of data is very similar to another stream of data, but with minor differences.
Let's say I've solved that problem, and now have some signature, such that all identical data streams have the same signature, and very close streams have very close signatures. Then, I have to catalog data streams as they pass by, assign signatures, count instances of signatures, and call a hit when signatures are significantly close but not the same. A quick visual check can confirm the match.
Back to my original thought - instead of a data stream representing an image, what if the data stream represented the subject line of an e-mail, or the e-mail itself? A central database could manage signatures, automatically reported by e-mail clients that generate the signatures. When I get a new e-mail, I can get the signature for the header, and send it to the database. It could then report "that might be spam", and I could delete it without downloading the whole message. I could also download the message, upload the signature, and the database could say "that's probably spam", and it could be deleted or moved before it shows up in my Inbox. With many people uploading signatures, the database could quickly generate the average signature and the variance of the signatures, with people double-checking "Yes, I consider this to be spam".
A couple of benefits would be that, hopefully, the signature doesn't give much info about the text, so it would be safe to upload signatures for personal email. Also, it may be fairly easy to get enough responses to be statisically certain that email with a particular signature is spam, so that many would benefit from a randomly chosen few who choose to respond that an email is spam.
Of course, it may be impossible to generate that signature, or the signature may be long enough to identify the text of messages. Still, I could see that as a benefit of this kind of research. I'd also like a way to auto-respond "You have been found guilty of forwarding hoax emails. Please stop and desist." to just about everything my family sends me...
Warning signs of secret messages (Score:1)
2.) There's that certain, special _sumthin'_ about the fractal glint in Asia's lower lip....
3.) Lip-reader of your acquaintance says, "While he's doing that to Anthony Perkins in that doctored photo, Gore appears to be saying, "Al, your Bates are belong to U.S.."
4.) Snowcrashing.
Who writes these captions ? (Score:3, Funny)
Excuse me ? Did I wander into The Onion [theonion.com] by mistake ?
Re:Who writes these captions ? (Score:1)
Statistics are bullshit. (Score:1)
I like the way he claims a 90% success rate. Either the researcher is a moron or else the person writing the article has already beaten him there.
What if there were three encrypted messages in each image he processed? Finding one is useless, because the sender could put an easy message in and two extra that won't get caught.
Better yet: his algorithm could be giving him garbage hits and not be finding anything real. The pictures could be just pictures. Novel concept.
*whew* Moron alert - eleventy three o'clock.
Big clue (Score:2)
Let's put it this way. If Farid alone can crack a variety of steganography, then the NSA or whoever it is who really want to invade your privacy. If he was trying to crack RSA or DES or PDF's ROT13 encryption, he would be praised - do you really think that steganography is somehow special?
So the article was rather uninformative. I've met Farid. He's a very cool guy. He's working against things like SDMI - which is a form of steganography. As part of a lecture he gave, he showed how to defeat various watermarking techniques for images (without getting arrested, even.)
Consider that when you say "battling steganography is battling privacy! We must hate him!" you are using the same logic that put the DMCA in place. Congratulations.
Patterns in lowest bits (Score:3, Informative)
That lack of certainty really isn't that big an issue, because with a good idea of what percentage of images are false positives it would be fairly simple to look for image sources where the percentage was well outside the norm.
All of this would of course be very resource intensive and would require access to large amounts of data (Omnivore, anyone?) but it's far from outside the capabilities of most governments.
Possibly also of interest to people is Benford's Law, which relates to the distribution of numbers - turns out that in many areas it's very simple to identify real data vs random data, because real data has some definite non-random properties.
Re:Patterns in lowest bits (Score:3, Insightful)
I and my friends generate every image with random trash in it (the output of
and this is where prof-bean's idea falls on it's face. as anyone using this system for real work is doing what I just mentioned or something that is generating massive amounts of decoys in a more effient manner. (hell the decoys now become perfect carriers too! espically if you generated several version of the decoys with different junk in them.)
It's simple to defeat stenography detection. you saturate the detector to the point where the real items get through.
Re:Patterns in lowest bits (Score:1)
Only, if that infomation isn't dectable, you may not want it there for other reasons. For instance mp3 and ogg try to drop information that listeners won't detect for reasons of efficent respresentation. I expect these types of lossy methods will get better (ie less undetectable information that can safely be dropped) over time, particularly where the original information was analog.
Re:Patterns in lowest bits (Score:2)
Something along the line of Ron Rivest's Chaffing and Winnowing technique? http://theory.lcs.mit.edu/~rivest/chaffing.txt [mit.edu]
Prof. Farid (Score:1)
pointless (Score:2, Insightful)
DMCA... (Score:1)
Super Steganography (JOKE) (Score:1)
stegdetect already does this (Score:3, Informative)
You might also want to check the techreports [umich.edu] that I published about my research.
At HAL 2001, I presented on Detecting Steganographic Content on the Internet [umich.edu]. You might like that.
Dartmouth certainly seems to know how to do PR. I would just like to know where their publications are.
Re:stegdetect already does this (Score:1)
But it is especially silly since he does such a bangup job of putting his technical work on-line:
Farid's Publications [dartmouth.edu]
What about deniability? (Score:3, Interesting)
You might say that 90% is no pretty significant. But considering how many actual images are there out there with actually no steganographic message, I think you'll actually end up persecuting more innocent people.
I just more more eveidence than this is required for a warrant to be issued.
Re:What about deniability? (Score:2)
Last I heard, the FBI doesn't go around busting people for passing around what might be secret messages. I know there's been complaining about a general erosion of rights and privacy in the US, but I doubt it's gotten that bad.
Re:What about deniability? (Score:2)
The 10% miss rate in and of itself should still represent plausable deniability. If you take standard legal practices, a 90% probability of a "match" is still weak enough that it would require other supporting evidence, circumstantial or otherwise to present a reasonable case.
If you get caught by the FBI, what can you say?
Caught how? It's not illegal to embed hidden messages in images, just as it's not illegal to hide a plot in pornography - though both are equally unlikely.
I just more more eveidence than this is required for a warrant to be issued.
IANAL, but a 90% probability that you're engaging in a perfectly legal activity doesn't seem, on its face, to meet the burden of probable cause necessary to perform a legal search and seizure.
Re:What about deniability? (Score:2, Insightful)
Re:What about deniability? (Score:2)
But my observation stands. Since the population of nonencoded images is presumably very high, the false alram rate must be higher than 10%.
Impossibility (Score:4, Informative)
An Analogy (Score:3, Interesting)
Also, think about the Blade Runner/Ridley Scott "Is Deckard a replicant" business that lasted, well, right up until he told the world the answer. It is that sort of interpretation that someone hoping to decipher steganography would have to perfect. It's not just stuff like: Hi Everyone Likes Punch!
The only way to get messages out of such texts is intimate knowledge of the author(s) or intended recipients of the hidden meanings. By asking them, or sodium pentothal, or the NSA's computer simulation of everybody's brain.
I'm no cryptographer, but the most reliable and cost effective way to discover a secret is likely to investigate the people that know the secret, rather than try to divine meaning from a text that came into your hands.
application to DMCA et al (Score:1)
Not Quite Useless (Score:3, Insightful)
He is doing research into a very particular kind of steganography, whereby messages are concealed within an image via slightly altering the least significant bits of an image.
When you encode information in this way, somebody knowing how to extract it can pull out a message which is not subjective (as in the example of interpreted images given by another poster), but rather is very concrete.
There is some evidence that this form of encoding has been used to communicate information throughout terrorist cells.
What the researcher is doing is developing a method to detect when the LSB's in an image have been manipulated slightly. He is not trying to decode the message, but only to flag particular images as being suspicious.
Decoding would be a matter for someone completely different -- like the FBI, for instance.
His method does have applications, and if it is through alteration of LSB that a message is embedded in an image, it will apparently detect such 90% of the time.
This is a vast improvement over any existing methods I know of for detecting LSB manipulation.
So he's not quite looking for a needle in a haystack. He's examining millions of haystacks, and pinpointing the ones that probably *do* have needles in them.
Quite a large difference, really.
-l
battling privacy? (Score:1, Insightful)
I don't see how anyone with a conscience could decide to intentionally try to destroy methods with which people can protect their privacy.
Re:battling privacy? (Score:2, Interesting)
The same applies to steganography, IMHO. SOMEONE has to break it - it might as well be me.
Re:battling privacy? (Score:1)
This is more about the perception of privacy.
If I were using a technique to protect my privacy that could be cracked, I would want to know about it and it takes this kind of research to find out.
Having said that, this guy comes off as somewhat of a tool in this article. Not all people who wish to protect their privacy are criminals. Moreover, law enforcement does not necessarily represent the side of good (and corporations almost never do). This is also a method used by people to protect themselves from the abuses of both.
But regardless of the motives of the research, this knowledge will ultimately lead to more privacy through inovation. And if this guy can crack it, who's to say the FBI hasn't been doing it for years?
Re:battling privacy? (Score:1)
Re:battling privacy? (Score:1)
Re:battling privacy? (Score:2)
I don't know how possible this is... (Score:1)
I know, there's the problem of key distribution. But you could include the key itself as plain text in the first x number of bytes of your payload, followed by the actual data encrypted using DES/AES/TwoFish. Unless the decoder knows the length and the location of the key (something you can decide on beforehand), s/he won't be able to decode it.
What about encrypting steg'd data? (Score:1)
Whole Lot O' Nuthin' (Score:1)
> program that can determine the likelihood that
> a secret message has been hidden within an
> image.
So he can show that something is in there? That's not as big a deal as the article makes it out to be...half the time, you'll know the data has encrypted information embedded in it. The hard part is getting the info OUT OF the data, which the article doesn't really address.
This is Wonderful News (Score:5, Insightful)
Now we have more people looking at steganography. This can only make it more effective. Sure, the methods we have now might be broken but what about the next ones, the ones that don't show up on the statistical analysis that he appears to be using.
Re:This is Wonderful News (Score:2)
Re:This is Wonderful News (Score:1)
Re:This is Wonderful News (Score:2)
Yes, if the _method_ itself is discovered, it's useless. However, if each instance of the method's use is quantitatively/qualitatively different enough then the method itself may still be capable of generating additional useful instances even once some are discovered. In other words, if the pattern of uses of a particular method isn't obvious then the method itself remains safe even if some of its output is discovered. Of course, this requires a very sophisticated, dynamic, chaotic, magical method. Or maybe just many methods rolled into one.
Rounding/compression and perfect stenography (Score:1)
If you consider the case rounding 0.5 to an integer, it's clear that either possible choice 1 or 0 is equally good, and in fact the best answer in that case is usually to pick one value at random so as not to add a consitant bias. Therefor, in these rare cases the resulting bits must, by definition, be completely orthagonal to any properties of the resulting image - you could change them all you like.
A stenography routine that did it's own compression and only changed these bits would, by definition, be undetectable.
So, with some fairly heavy constraints, undetectable stenography is inherently possible.
There must be various ways of making stenography routines that used this property, even routines that don't do the original compression, by finding lsb's that by some measures are really good candidates for having orginally been rounded from near 0.5 and only touching those.
What cha all think?
Not a waste of time... (Score:2)
Steganography in movies (Score:1)
This could be fun... (Score:1)
Can you imagine using his techniques to search through Google's image archives, or perhaps a gnutella network just to see what is sitting out there?
This sounds like it could uncover yet another seedy underbelly of world culture.
I imagine there could potentially be millions of hidden messages out there that noone knows about.
Re:This could be fun... (Score:3, Funny)
some thoughts (Score:3, Interesting)
Second, I'm not sure how to react to this. I don't use steganography to hide information, nor do I encrypt my email normally. I guess it's good to know if the techniques used to do this are detectable or breakable, but if it was actually used on a large scale you can bet I'd be screaming, "Big Brother!!!"
Not too plausable of an argument (Score:2)
I can see detectability from some of the crude software packages out there, but not the better ones that make sure the applied file is expanded to the size of the image and reversed.
Re:Not too plausable of an argument (Score:1)
Re:Not too plausable of an argument (Score:3, Informative)
Re:Wrong. (Score:2)
I take a picture If a room and the Television has only static on the screen... Pretty innocent picture, except the tv screen holds DeCSS.c or The chemical forumla for Cokeacola.
There is a large amount of randomness in the world. A photograph taken during a rainstorm, an artsy photo of sand.... etc...
I can give you many many innocent looking photos that have quite a bit of randomness in them. (and a few nicely staged UFO photos, but that my hobby
Re:Wrong. (Score:2)
Re:Wrong. (Score:1)
That depends on many factors including the speed of the film, apreature on your camera, shutter speed..... It is quite possible to take a good picture of a TV screen, you just have to make sure the shutter speed is long enough to get a whole frame and the aperature is wide enough to expose the film completely.
Re:Wrong. (Score:2)
"Hi, mom. Went hiking in the mountains last weekend. While I was hiking, it started to rain. I heard what I thought was thunder and saw this really cool wedged-shape plane just screaming through the clouds. Never seen anything like it before in my life. Like a stealth fighter but way more weirdly-shaped, and totally faster. I guess it was a sonic boom, not thunder. I was lucky enough to get a high-res pic of it as it passed over my head. Sorry about the raindrops that fell on the lens. Here's the pic!"
(Boy, it's amazing how hard you have to work to keep the Harry Fox Agency off your ass for mailing steganographically-embedded song lyrics and guitar tablatures these days!)
I don't see how this can work (Score:1)
For instance two diffent jpeg encoders, both at the same quality level will result in subtly different encodings of the same source image. If you take these two images, calculate the difference at each decoded pixel, and amplify the diffence (so that you can easily detect minue intensity differences) you'll see the signature of the differences between the encoding engines.
Now if I encode a message in the image (a 1 megapixel image, small by todays standards, can encode a 1 megabit steganographic message assuming only a 1 bit change in colour). If you could get the source image and do the above described difference calculation you would see the pattern representing the message.
If you pick the wrong source image (it LOOKS identical but was compressed slightly differently), you'll only reveal a combination of the signature and message.
Do whatever statistical examination of this noisy signature you want, I don't see how you can determine that the image concealed data. Well, unless you do an impressively poor job of concealing the data in the message. Encoding your message in a pure white gif, jpg or png would be a bad idea for instance.
Watermark detection (Score:1)
see provos' work (Score:2, Informative)
in fact he is presenting a paper on the subject at the usenix security conference tomorrow.
unlike the dartmouth folks, who apparently think press reports are the proper medium for scientific interchange, provos makes his results publicly available; see
http://www.citi.umich.edu/techreports/
reports 01-1 and 01-4.
nobody
Re: (Score:2)
Talk about arrogance... (Score:1)
That's like saying 'if somebody can break 56-bit keys, you can just increase the key length'. In other words, it's really not that simple. Firstly, you're assuming that there will always be new techniques. Secondly, you're suggesting that these new techniques will always be harder to detect than previous techniques. Thirdly, you're assuming the licensing model of such techniques will allow them to take the place of existing techniques.
In short, until you know what you're talking about, or are able to engage your brain, please shut up with your opinion, and just deliver articles and facts. Thanks.
So this guy can predict hidden information? (Score:3, Interesting)
How about a GIMP or Photoshop plugin to randomly insert junk data in any JPEG saved in order to make this technique useless? It'd be fun to the the NSA sit and fret over an image that apparently had a list of Warez traders and DMCA violators but instead contained the lyrics to 'Penny Lane'.
Better yet, how about an Apache module that does this same thing to every JPG it serves?
The point is, that as soon as it becomes common procedure to intercept images to check for steganography, those who use steganography will switch methods. I bet PGP data encoded in a JPG is a lot harder to detect, and infinitely harder to extract.
Re:So this guy can predict hidden information? (Score:1)
Hey, remember the site on the net that had the lyrics to many songs that got shut down? Embedding the lyrics to Penny Lane is illegal
Robert
Re:So this guy can predict hidden information? (Score:2, Interesting)
How about a GIMP or Photoshop plugin to randomly insert junk data in any JPEG saved in order to make this technique useless?
You can't do that. JPEG/DCT (as is the norm with files adhering to the JIFF) is a lossy compression scheme, which means LSB's are lost in the process.
This is one reason why I think it is not practical to embed messages in images files posted over the Internet. De-facto standards are JPEG and GIF's, and although LZW is lossless, you don't want to mess with LSB's in a 256-color palleted image (except if you "color" pallete is an ordered grayscale pallet). A TIFF file with either grayscale, RGB or CMY/CMYK data would do the trick, but who sends TIFF's? If someone already has an eye on you, that would definitely look suspicious.
Re:So this guy can predict hidden information? (Score:2)
The problem is that it would corrupt any real steganographically hidden messages in the images, hence rendering images a bit of an unreliable mechanism for storing hidden text... ;)
Re:So this guy can predict hidden information? (Score:2)
Re:So this guy can predict hidden information? (Score:1)
of course it gets more cunning when the data you remove stenagraphically is itself an image with stenographed data on it, and that data is...
and eschelon has a machine do do all this but completely missed your bombing plans which were the subject of the picture itself and not the stenographed data itself... hiding the wood in the tree's as it were.
dave
Re:So this guy can predict hidden information? (Score:2)
Sorce for stenography info (Score:2)
is a great place and has a software archive.
This could not be held up as evidince (Score:1)
With standard encryption, if you are in court you can be ordered to decrypt it, but if there is a chance where there is nothing there, they can't force you to do anything.
This just seems to be a waste of time to me.
F u cn rd ths ... (Score:3, Funny)
Re:F u cn rd ths ... (Score:5, Interesting)
for most of today's privacy requirements.
You might think that it'd be easy to detect,
or simple to prevent, but that's simply not true.
Unless someone lists all the ways in which one
can hide information, and a fantastically fast
approach to testing any given communication on the
net against those techniques. Otherwise, to
read a steganographically-encoded message,
each recipient will need to figure out which of
all the messages intercepted even includes the
data you're looking for, and what was used in
this particular instance. Hell, one might even
have two or more different techniques applied
in a single message. Like this message does.
Sort of.
....
Re:F u cn rd ths ... (Score:1)
Very clever... (Score:2, Insightful)
1) Take the first letter of each line.
2) Take the first work of each paragraph.
Re:Very clever... (Score:2)
Certainly there are tools out there that put together random, sensical-looking text with specific patterns in word usage, punctuation, spacing, whatever, to encode messages, but to actually tweak a message with intrinsic meaning in itself is a bit more difficult.....
Re:F u cn rd ths ... (Score:2)
Re:F u cn rd ths ... (Score:1)
Best way to avoid scrutiny with a hidden message (Score:2, Funny)
Hmm. I wonder if he's violating the DMCA (Score:2)
This guy should still be afraid of violating the DMCA. If he tries to detect steganographic images in a sound file, he might run afoul of the RIAA. He shouldn't even think about publishing his research.
Open Source Steganography? (Score:2)
How can you detect random noise? (Score:3, Interesting)
This is an interesting idea, but surely any good encryption produces an output which is indistinguishable from random noise. So, how can the algorithms mentioned in the article (which is interesting, but rather short on facts...) distinguish between the noise added by a steganographically embedded encrypted message and the noise caused by a slightly underspecced A to D converter?
I'm honestly curious... has anyone got any links to a more detailed report on this?
Re:How can you detect random noise? (Score:5, Informative)
So, how can the algorithms mentioned in the article (which is interesting, but rather short on facts...) distinguish between the noise added by a steganographically embedded encrypted message and the noise caused by a slightly underspecced A to D converter?
You're right, there isn't too much of a difference between random noise and an encrypted communication. If you had a pure digital stream that had just been converted from analog, you could stick data in the least significant bits and no one would be the wiser. For example, a CD is just a sequence of 16 bit words iterated 44,100 times a second; you could just replace the least significant bit in each word with bits from your hidden message and it would be indistiguishable from random noise.
The problem arises when you try to compress digital information. These compression algorithms use the most optimum way to represent data that they can find and discard the least significant data, so they would completely destroy the afore mentioned hidden message. To hide data in a compressed file you need to play with how the compression mechanism stores the data, and the resulting file is most probably not going to be optimally compressed when you're done. What this guy is doing is looking at how the information was compressed, extract the overlying data that was being stored, and making sure the compression algorithm was indeed optimal. If there are any odd quirks in the compressed data or it doesn't look like the compression was optimal, it may be because data is hidden inside.
I hope this is a good enough explanation. I'm short on the examples but the underlying ideas are pretty basic.
Re:How can you detect random noise? (Score:1)
dave
steganographic pictures on ebay (Score:2, Informative)
Here's an interesting article that mentions some steganographic pictures hidden on some ebay auctions! Bin Laden at work?
NSA, Pentagon, Police Fund Research Into Steganography [info-sec.com]
Re:random noise detection: entropy signature analy (Score:2)
The 1 minute explanation of entropy signature analysis is that it seeks to quantify in R^(n+m) space, the statistical properties of a stream of data by applying n statistical tests to the data. How well or poorly the data passes these tests helps identify the method of generation.
I'm curious about this statement. Assuming a truly random number source, an excellent encryption system, and removing any identifying marks (header, etc.), a cryptographic string should be indistinguishable from random data. Any given byte should statistically appear the same number of times as any other, any pattern should appear the same number of times as any other pattern of the same length. Is there some important mathematical precept I'm missing or are you merely talking about the idiosyncrasies of convention algorithms?
In case anyone was wondering why I spend time working with LavaRnd, cryptographically strong PRNGs, Lava Lite ® lamps and other random oddiments
When I came across the original SGI Lava Lamp number generator so long ago, I thought it was one of the coolest things around. I have yet to come across something that could generate as random a number in as closed a space... cool stuff.
Re:random noise detection: entropy signature analy (Score:1)
Most cyphers are pseudo-random to some degree. Nearly all of them will pass various statistical tests for randomness and entropy measurements to some degree. How well they pass is another matter and it something on which one can construct an entropy signature.
In Steganography you want your plaintext to appear statistically as identical as you can to your chaff / image / noise stream. Creating a good match is difficult. Hany Farid, for example, is attempting to use various tests to identify plaintext within an image. With the right tests one should help identify which is noise and which is plaintext.
To combat Farid's method one needs a cryptographically strong PRNG or true random source. Then bias the output in a fashion that is identical to the noise (big handwave here ... this is hard to do well).
Finally mix the plaintext with the
biased stream and inject it into the
noise in a way that is known to you
and the receiver.
I have yet to come across something that could generate as random a number in as closed a space...
The next generation LavaRnd [lavarnd.org] will give you that in a very compact space, using a patent-free algorithm and open source demo software. Final hacking is going on now. Code completion and demos will soon follow. Paper to be published sometime after ...
p.s.: Gotta love moderating. My original article stays a 1 and your reply gets a 2. Both are directly on topic while some joke gets a 4. Maybe moderation scores are a good source of random noise? :-)
Re:How can you detect random noise? (Score:2)
Resource Intensive (Score:3, Interesting)
Given a certain state of network bandwidth, the quality of images transferred over the network is likely to increase as the ability to transmit that data increases. This means that anyone trying a large scale data mining for steganographic data, for example in a Carnivore-type application, would need to have many times the bandwidth of ALL the senders/recievers in order to analyze that much data.
That would make it so the only real application of this method would be for people you already suspect of sending steganographic data. You could direct the search toward them. However, then it is still trial and error to find which steganographic protocol they used, etc., and you're back to square one.
Maybe if the steganographic checking system was actually *intergrated* to the Carnivore system you could get somewhere. It might be a good way to search for messages that were "suspicious".
It is interesting, though, that this method is possible without knowing the individual steganographic protocols. It just seems that it would be too resource-intensive to deploy on a wide scale, and a wide scale is the only place it would be really more useful than trial and error.
Whack a mole (Score:2)
The more the corporations, and their lackeys in government restrict freedom, the more determined those to preserve it will become, and the less effective their efforts will be.
For one thing, it's a challenge, and nothing inspires great accomplishments from hackers than waving the red flag.
Battling Hany Farid and Other Privacy Snoopers (Score:2)
But wait a minute, seeing they can enact freedom squashing laws like the DMCA with impunity, what's to keep them from making steganography illegal? Resist Big Brother. Demand freedom always!
Statistical analysis? (Score:2)
Personally, no matter what, I wish Prof. Farid a lot of luck. His work might be what will save our collective ass from SDMI-like schemes down the road.
Re:Did you know? (Score:1)
Re:Did you know? (Score:1)
Yeah, I know, don't feed the trolls. Are they animals, or some form of insect life, I wonder?
Re:If steganography becomes illegal (Score:2)
Porn's good. Er, I mean for steganography that is... "I only use porn for security reasons".
As another thought, how about using TCP window pointers? You might only get a couple bits per TCP packet, but they can add up. This might be useful for key exchange, for instance. Also, there would be no lasting image (or whatever) subject to future recovery. On the other hand, you would have to watch out for proxies.
Re:If steganography becomes illegal (Score:2)