Evidence of Steganography in Real Criminal Cases 231
ancientribe writes "Researchers at Purdue University have found proof that criminals are making use of steganography in the field. Steganography is the stealth technique of hiding text or images within image files. Experts say that the wide availability of free point-and-click steganography tools is making the method of hiding illicit images and text easier to use. Not everyone is convinced; some security experts such as Bruce Schneier have dismissed steganography as too complex and conspicuous for the bad guys to bother using, especially for inside corporate espionage: 'It doesn't make sense that someone selling out the company can't just leave with a USB.'"
"Security Expert" (Score:3, Insightful)
Re: (Score:2, Informative)
From the article (Score:3, Informative)
But Bruce Schneier, CTO of BT Counterpane, disagrees. He says steganography doesn't make sense as an insider threat. It's much easier to just suck the data off onto a USB thumb drive and walk out of the building.
That seems to make a little more sense. They still don't quote Schneier directly, but his general conclusion seems valid. The purpose of steganography is to provide a clandestine channel, in part to avoid traffic analysis. If the data embedded through steganography is also encrypted, it would be very hard to detect. That's why this study is significant. I'll wait until it's farther along than its "early phases" before I draw any substantive conclusions, though.
Re:"Security Expert" (Score:5, Funny)
Who calls USB keys "USB"s like one of my computer illiterate friends. Or is this some new kind of slang that I am not aware of.
Is there a common standard term for them yet? People I know call them variously "USB drive", "USB key", "Key drive", "Pen Drive", "Memory Stick", "USB stick", "USB..um..memory..thing", or "You know, that thing that goes in the USB slot that you keep stuff on". I personally call mine 'Steve' to avoid the confusion.
Re: (Score:2)
*After my love: Jane Eyre
Re: (Score:2)
*After my love: Jane Eyre
Re: (Score:2)
You forgot jump drive, key disk, and thumb drive.
IBM had one of the first (actually made by Kanga?). 8 whole meg!
Re: (Score:2)
Re: (Score:2)
Also, when I was at college, a lot of people called them "jump drives", probably because the Lexar brand was common on campus for some reason.
Re:"Security Expert" (Score:4, Funny)
In a Spanish-speaking office I was trying to guess at the name and called it a palito, which literally means "little stick." It took about two minutes for the laughter to die down, and then I learned that palito is slang for dick.
Pity we can't call it (Score:2)
What you call a thumb drive/flash drive/pen drive (Score:3, Interesting)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:2)
Key drive, although it makes size sense, is confusing given the fact that there are drives with and without "security" software.. which given that theres is a diversity in OS's in use, makes one not want a drive with software for an OS they don't use. Does a key drive have security keys for an OS I don't use ? ... you see the problem.
I thought "thumb drive" was perfect.. Don't see why people have changed it...
Re: (Score:2)
Re:"Security Expert" (Score:5, Funny)
Re:"Security Expert" (Score:5, Funny)
Re: (Score:2)
No "security through obscurity" there - that's good ol' plain "security through kicking the shit out of everyone else"
Re: (Score:2)
Did you know that if you built a Dyson sphere around Bruce Schneier... Well, I forgot the rest, but it implies that he's made of something besides matter and occupies something besides space.
Recently, seismologists have concluded that a series of tremors are in actuality the result of Bruce Schneier and Chuck Norris communicating through a series of cryptographic roundhouse kicks. (That one's from someone on slashdot)
Re: (Score:2)
"USB Naming Expert" (Score:2)
Re:"Security Expert" (Score:4, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Sony. Well, sort of.
Re: (Score:2)
You rule! Keep it up
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Same with BitLocker, anyone without a TPM has to use a USB drive to store the key.
In fact, there are USB token devices which could accurately be called a key, in the same way a smart card is a key.
Re: (Score:2, Funny)
Re: (Score:2)
Old news though (Score:3, Interesting)
Steganography is also in use by some media producers, I've heard cases where demo tracks have included some randomness that is later detectable to find the source of whoever leaked the track (each person on the initial review got a different copy of the randomness).
Re: (Score:3, Interesting)
Re: (Score:2, Informative)
Re: (Score:2, Insightful)
The best implementation (Score:5, Funny)
First the program takes the target JPG (which you want to be very large), and treats it as random noise. Simply a field of random zeros and ones. Then, within that vast field, the program selects a pattern or frequency to place variations in the noise pattern.
The variations in the noise pattern act as a beacon - sort of a signal that the payload is coming. Common variations include mathematical pulses at predictable intervals - say something that would easily be recognizable by a 5th-grader, like say a pattern of prime numbers.
Then it layers in a second layer, nested within the main signal. Some bits are bits to tell how to interpret the other bits. Use a gray scale with standard interpolation. Rotate the second layer 90 degrees. Make sure there's a string break every 60 characters, and add an auxiliary sideband channel. Make sure that the second layer is zoomed in sufficiently, and using a less popular protocol language, so that upon first glance it's not easily recognizable.
Here's the magical part: It then adds in a third layer. Sort of like in ancient times when parchment was in short supply people would write over old writing... it was called a palimpsest. Here you can catalog over 10,000 "frames" of data, which can communicate any message that you want.
Further details on this method can be found here. [imsdb.com]
Re: (Score:2)
Re: (Score:2)
looks like something doesn't work properly (Score:5, Informative)
Maybe this really means that the software available for this type of use just doesn't work very well?
Re:looks like something doesn't work properly (Score:5, Informative)
FYI you can detect the presence of steganographed information by statistical means (http://en.wikipedia.org/wiki/Steganalysis).
Re: (Score:2)
And this is part of the problem with the process. It's no good hiding data in an undetectable way if you leave behind indicators that there's data hidden. It's a bit like breaking into a house, and leaving no trace of where/how you did it - then leaving your lockpicks by the side door.
If you're going to have steganographic software, it must not be recognisable as such.
Re: (Score:2)
Denying access to the software used to hide it would also work.
Debunking steganography (Score:5, Interesting)
Specially if the marketing blurb mentions "military grade" (translation : triple AES is used to store the password. The reader software inputs a password from the user and if it matches the hash... the soft proceeds extracting the otherwise clear, non crypted and un-obfuscated payload).
So while it *is* possible to design actually working steganography, if a would-be pedo-terrorist-criminal tries to google for stenographic software, he'll most likely land on useless software.
Re:Distributing Steganography Software Doesn't Wor (Score:2)
Done right, stego can be resistant to analysis, even by someone who knows the algorithm. Of course, it's a cat-and-mouse game between those working on analy
Re:Distributing Steganography Software Doesn't Wor (Score:3, Informative)
This is only true for weak forms of steganography in much the same way that it is true for weak forms of cryptography.
With strong steganography, the correct key is necessary to recover the message or to even prove that the message exists. Hiding the sp
Re: (Score:2)
All you have to do is randomly change other data and you have done a very good job of obscuring the actual data, though. If you then use a pass phrase as a means of generating a crude program for adjusting the order of the bits (e.g. use a mathematical equation in which the bytes of the pass phrase are hashed to form the coefficients and degrees of each term of a polynomial and take the sin of the resulting value multiplied times the size of the image), you can obscure it really, really freaking well. If
These must be freshman researchers (Score:5, Informative)
To those versed in statistics or the scientific method, find the flaw in this statement (as taken from the article):
"with the little data we have so far, we are finding that there's a strong correlation between criminal activity and at least the installation of steganography programs on those [confiscated] computers"
With the little data I have so far, I think the researchers are pulling our leg.
Re: (Score:2)
Re:These must be freshman researchers (Score:4, Funny)
Re: (Score:2)
http://geekz.co.uk/schneierfacts/ [geekz.co.uk]
Re:These must be freshman researchers (Score:5, Informative)
Considering that Bruce Schneier has been around the block for a loooong time and has written several good books on cryptography and computer security, including the seminal "Applied Cryptography" (which needs a new edition! Hint hint if you're out there, Bruce!), I think it's far more likely that you have no idea who Bruce Schneier is. I'm sure that by "conspicuous" he's referring to the fact that steganography can be detected through statistical analysis, and the fact that most steganography software is crap.
Being inconspicuous isn't the definition of steganography any more than being secure is the definition of cryptography (Ceasar Ciphers, ROT-13, DES). They're both just important traits that make their respective -graphies more effective. Bruce's statement is referring to the sad state of pretty much all of the steganographic software out there right now, because it's pretty much all the security equivalent to sticking your super secret files in a hidden directory and hoping the secret police just overlook it.
Re: (Score:2)
Or maybe I should also read http://en.wikipedia.org/wiki/Tr [wikipedia.org]
Re: (Score:2)
Re: (Score:3, Informative)
Yes it is, in large part because the citizens allow it to. Why did you let the cop "toss your car"? He had no basis for a legal search, so either he searched without your permission, or asked if he could and you said "yes". If he searched without your permission you should have followed up in court. If you told him it was okay to search, then you have nothing to bitch about and aren't any better than the rest of the sheep
Re: (Score:2)
I doubt it happens on a large scale (Score:5, Informative)
Installation of steganography tools != using those tools in practice. If someone is looking to conceal data, they may be grabbing anything out there that stands a remote chance of being helpful. Sort of like how in the early days students would have all kinds of music players and point-to-point file exchange programs, looking for ones that would do what they wanted or had what they wanted.
James Wingate, director of the steganography analysis & research center at Backbone Security, and a vice president there, says the use of steganography is on the rise, and it could be used for things like transporting malware.
"Some would call me 'Chicken Little,' but I fervently and passionately believe criminal activity is being conducted with steganography... We do know it's being used to conceal child pornography," Wingate says. "
When someone "fervently and passionately" believes something, particularly something related to a day-to-day project where one's institution stands a good chance of increased funding if what you believe is true, that's a good indication that you need to look hard for real, reproducible evidence that will stand up to rigorous peer review. Nor should concealing those types of images be surprising - unfortunately there seem to be a large number of sickos out there with this stuff, and probably every data-concealing program ever written has been used to conceal it (or try to). More to the point, is it in WIDE use?
I agree that a USB stick is a much more plausible attach vector for a company insider (no "hey what was that huge surge of email traffic with images?" signatures for IT to poke their noses into, just for starters.) If someone wants to hide data on their machine, I would think any of the various harddrive encryption techniques would both be simpler and much more effective.
I remember looking around at steganography tools some years back for other purposes (watermarking images people were considering contributing to a collectibles website) and my conclusion was that the most practical use of the techniques was to store information one WANTED to be found - another way to put metadata into an image so you could later figure out additional information about it (say, for a baseball card certified by a company you could add the certification information using steganography to ensure later availability of the information even without the website context, unless the image was compressed or otherwise distorted. It didn't and doesn't strike me as anything that can be used for anything uniquely evil or even uniquely practical (real image metadata is most likely a better place for useful info, and hiding information in it is an iffy proposition at best.
Remember, just because non-government researchers can't cover all 800+ programs doesn't mean someone like the NSA with large funding and budgets couldn't throw resources at it until they had all of them covered. Somebody will probably use it, but someone will use virtually every possible technique to do something at least once in the vastness of the Internet so that's not a very interesting statement. The interesting question is will a lot of people use it, and I just can't see it being worth the trouble.
get over it (Score:5, Insightful)
Right now, police can still detect the steganography tools, but those will start to be hidden as well. Encrypted, hidden data can be added to MP3s, MPEG4s, PDFs, scans, executables, random leftover noise on the disk. It can be hidden on microSD cards, printed on paper, and hidden on DVDs.
There is no way governments or companies can stop covert communications of data. Get over it and stop making laws that are unenforceable but give police and governments ever more tools to abuse their powers.
Re:get over it (Score:5, Interesting)
Re: (Score:3, Informative)
And use pics taken indoors with a low iso / long exposure setting. The noise inherent in the CMOS or CCD will probably give 4 out of 10 bits of close to uniformly random noise (or whatever biased,
Re: (Score:2, Interesting)
Encrypted, hidden data can be added to MP3s, MPEG4s, PDFs, scans, executables, random leftover noise on the disk. It can be hidden on microSD cards, printed on paper, and hidden on DVDs.
See, right there I'm with Bruce. Why would you put steganography tools on microSD cards?
Why not put the data encrypted on the card, and then hide the card? Doesn't that seem to make a lot more sense?
I mean, those things can hold a lot now, a good deal more than you could reasonable hide via steganography.
If you're smar
Summary of Article (Score:5, Funny)
New Purdue University research shows steganography, long considered a minor threat, may be on the rise
OCTOBER 18, 2007 | 6:00 PM
By Kelly Jackson Higgins Senior Editor, Dark Reading
Until recently, steganography, the stealth technique of hiding text or images within image files, has mostly been considered too complex -- and conspicuous -- to be much of a threat. But some forensics experts now worry that the bad guys are starting to use the tactic more frequently, especially in child pornography and identity theft trafficking.
There are an estimated 800 or so steganography tools available online, many of them free and with user-friendly graphical user interfaces and point-and-click features. This broad availability making steganography more accessible and easier to use for hiding and moving stolen or illicit payloads, experts say.
Security experts to date have mostly dismissed steganography as a mainstream threat, relegating it to the domain of spooks and the feds. Their skepticism has been well-founded: The few studies that have searched for images hiding steganographic messages have come up empty-handed.
no one said criminals were bright (Score:2)
Criminals are know for their poor work ethic. Why do a bunch of skull drudgery and research, when they can just grab the first thing that comes along.
Another reason it might be attractive is it's over complication itself. One of the main reasons frequently given for people to become real spies is pure excitement. They want to do "spy stuff". Someone like that is going to go not for the best method, but for the most high
Just because you think it doesn't make sense.... (Score:2)
Oh, I think tha
and now THINK for a second. (Score:3, Insightful)
How big is that picture of your daughter? I seen a real world example of it. A 4mb image, that somehow only seemed to result in a small photo of about a 100x100 pixels. Yeah, that ain't suspicious AT ALL. Doesn't set of any alarm bells. Nope.
That is the entire problem with the idea, how do you get enough information inside and still not raise suspicion. It is different for coded messages, keep the code small and it can easily fit but to leak information, you need to start including megabytes of documents i
Re:Just because you think it doesn't make sense... (Score:2)
That's the **AA version of "security"...
And yeah, you could be encrypting all that information, but even an encrypted file would be more suspicious than a picture of your cute daughter.
Except for the fact that the little 320 x 240 pic is 512MB...
Re: (Score:2)
Re:Just because you think it doesn't make sense... (Score:4, Funny)
(slammed against the wall)
"Bro don't tase me, don't tase me! Br-clickclickclickclickclick"
Welcome to the NEW America.
One thing I don't get (Score:4, Insightful)
For example, if "teh terrist" wanted to send a message like "attack now", why couldn't the message be given via a pre-arranged signal -- say the image shows Osama wearing a silver watch for "It's go time", and a gold watch for "wait out the Americans". No one can detect a "hidden message" because there is none.
You could do the same for other things even if you don't use USB (which would probably be easiest in a workplace). How about plain old pencil and paper? Just write down the information, put it in a device called an "envelope", write down the physical address of the guy you're sending it to, and drop it off in the post office. It's virtually untraceable, and would work even if the IT guys turn off the USB ports.
Re: (Score:2)
For example, if "teh terrist" wanted to send a message like "attack now", why couldn't the message be given via a pre-arranged signal -- say the image shows Osama wearing a silver watch for "It's go time", and a gold watch for "wait out the Americans". No one can detect a "hidden message" because there is none.
(1)This works only on messages you already have acknowledged with the receiver. Good for "attack now", but bad for "The new address of the target is X,Y,Z..."
(2)If you repeaditly use the same ima
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Because perhaps the "pre-arranged signal" was given in a face to face meeting, which will only happen once so as not to arouse suspicion.
Re: (Score:2)
Re: (Score:2)
Ideally you would want to use both of these methods.
Even sending an encrypted message saying "we attack X location tomorrow at 3am, bring teams 2 and 3" jeapordizes the whole thing if somehow someone manages to decrypt your message. But if they decrypt the message and say "oh look, a picture of Osama - wtf?".
You
Re: (Score:2)
It worked well, and had some interesting advantages. One benefit was it provided a means for a resistance worker to partially confirm that someone claiming to speak for British intelligence really was: the latter said ``give me a sentence, any sentence, and I'll arrange to have it broadcast by the BBC''. It didn't work as well as it should because SOE were very careless and/or s
Re: (Score:2)
Because hiding a message in a picture can be done on-the-fly, which is much harder with picture as message. Also, because a code (like picture as message) is fairly limited in the number, type, and complexity of messages that can be sent. (And assembling the dictionary is a fair bit of work, keeping it secure even moreso.) OTOH a message hidden in the picture can be a
Re: (Score:2)
Ideally, sending a message should be long enough it's something too big to be memorized
Same thing with an envelope, if you're in the context of industrial espionage, like the Schneier comment earlier, you'd want to send code or cad drawings, as in something too complicated for somone to memorize, and difficult to impossible for someone to replicate independantly. Stego is used in that context to prevent email logging from proving who sent it... at least, that's the theory.
As for virtu
Re: (Score:2)
Because then it has to be prearranged, and all the vast limitations that poses... You have a very limited amount of information you can convey, all possible messages have to be decided upon before-hand, and everyone has to remember every one of them exactly. When there's important information to convey, like someone or some place's name, you have no way to do so.
Second, if you ARE going
This is just the first stage ... (Score:5, Funny)
Re: (Score:2)
Hmm (Score:2)
I believe the technique is you open the jpg with winrar and it ignores everything before the start of the zip file, so ignores the jpg but still reads the zip fine.
If little kids making penis jokes can do it with so much ease I very much doubt it's "too complex" to be useful in other ways. All it takes is the knowledge and you can hide stuff in broad day light, or at least make it very difficult for people to find that zip of (lets
Re: (Score:2)
Don't 4chan users already do this all the time by putting books inside jpgs?
That's a particularly simple form of steganography, yes, but it's easily (almost trivially) detected by anyone who suspects the existence of covert messages being sent. (EG, in Cygwin's bash, "for FOO in *.gif *.jpg *.png ; do unzip -l $FOO ; done", and examine results for a quick 'n sloppy pass; a few minutes work more could give something to automatically announce "hidden" zip files and their contents.) There are more sophisti
Stenography probably not used for bulk data xfer (Score:3, Interesting)
A point to note is that the criminals using stenography are probably not using it to transfer large quantities of information, but merely communicating small very private messages. This might include links to web servers, credit card numbers or meeting/payment instructions. It is unlikely to require more than a few hundred bytes of data.
While Schneier is correct that corporate theft is best accomplished with USB drives or even your corporate laptop, the criminals using stenographic software are probably not using it for their bulk transfers of information, but rather pointers or encryption keys to information transfered by other means.
Comparing the number of web pages against the number of child pornographers who might be hiding stenographic in online images makes Purdue's attempt to crawl the web in search for stenographic data seem futile.
Data transfers by stenography have to be pre-arranged in advance by some other communication method, otherwise how would sender and receiver know how to encrypt/decrypt their messages? If your interest is in stopping crime, then this is the weakest link and should be the focus of your detective work.
Re:Stenography probably not used for bulk data xfe (Score:2, Informative)
Re: (Score:2)
History Repeats Itself... (Score:2)
Those Japanese are too stupid to make it through the jungle at Singapore, and certainly don't have the logistics to sustained forward fleet operations...
It will be at least a decade before the Russians get the atomic bomb...
The United States has a comfortable lead in rocket technology...
A bunch of stupid arabs couldn't put together a complex terrorist attack against the USA....
We've just about got this insurgency licked...
And now..!
Thiefs are too stupid
Is Schneier being naive? (Score:2)
Like, you're sending pictures of your family to relatives overseas?
Steganography is just a new way to mix up the classic techniques of prearranged obscure and innocent signals with ciphers, and these kin
Re: (Score:2, Funny)
Re: (Score:2)
imageboards (Score:2, Interesting)
Re: (Score:2)
Using stenography for sekrit messages? (Score:2)
*yes, I know the difference.*
Underestimating Criminals (Score:3, Insightful)
Yes, there are a tremendous number of stupid criminals out there, just like there are a tremendous number of stupid people out there.
But we chronically underestimate what people are capable of. I know a bit about O-chem, and with a bit of research could probably manufacture meth fairly easily. It's really not much more complicated than setting up a moonshine still. Out of the reach of some? Sure. But the fact remains that tens of thousands of strung-out hoopleheads manage to do it every day.
We complain about them damn young kids sailing the high seas of Internet and maliciously raiding commerce vessels trading in MP3s, and yet many judges seem baffled by even simple concepts like IP addressing and server logging.
These steganography tools are fairly easy to use. So why, again, are we surprised that criminals can point and click?
Uninformed (Score:2)
This utterly removes the utility of steganography in one pass. If the program leaves a signature, there is no longer a reason for using it.
And pictures are not the only thing. There is a tool that will embed data into a Windows
Re: (Score:2)
Re: (Score:2)
I wish that I was so smart that simple things like that would baffle me.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)