Chapter 1 Introduction 1, INTRODUCTION 1.1 Steganography: Hiding Information Steganography is the art of hiding and transmitting data through apparently innocuous carriers in an effort to conceal the existence of the data, The word steganography, as derived from Greek, literally means covered or hidden writing and includes a vast array of methods of secret communications that conceal the very existence of the message. Though steganography is an ancient craft, the onset of computer technology has given it new life. Computer-based steganographic techniques introduce changes to digital covers to embed information foreign to the native covers. ‘Such information may be communicated in the form of text, binary files, or provide additional information about the cover and its owner such as digital watermarks or fingerprints. Steganography can be viewed as akin to cryptography. Both have been used throughout recorded history as means to add elements of secrecy to communication. Cryptographic techniques “scramble” a message so that if it is intercepted, it cannot be understood. This process is known as encryption and the encrypted message is sometimes referred to as ciphertext. Steganography, in essence, “camouflages” a message to hide its existence and make it seem “invisible” thus concealing the fact that a message is being sent altogether. A ciphertext, message may draw suspicion while an invisible message will not.2 Chapter 1 Introduction Kahn places steganography and cryptography in Table / to differentiate against the types and counter methods used. Here security is defined as methods of protecting information where intelligence is defined as methods of retrieving information [44]. Table 1. Security Categories Signal Security Signal Intelligence ‘Communication Security ‘Communication Infeligence ‘Steganography (invisible inks, open © Interception and direction- codes, messages in hollow heels) and finding, ‘Transmission Security (spurt radio and spread spectrum systems) © Crypiography (codes and ciphers) © Cypranalysis ‘© Trafic security (callsign changes, © Trafic analysis (direction-finding, dummy messages, radio silence) _message-flow studies, radio finger printing) Electronie Security Electronic Intelligence ‘© Emission Security (shifting of radar © Electronic Reconnaissance frequencies, spread spectrum) {caves-dropping on radar emissions) © Counter-Countermeasures (looking * Countermeasures jamming radar, through” jammed radar) false radar echoes) Although steganography has been used since ancient times, little is generally understood about its usage and detection. Many ingenious methods of message concealment have been invented. Among these methods are hidden tattoos, covered writings, invisible inks, microdots, character arrangement (other than the cryptographic methods of permutation and substitution), null ciphers, code words, forms of digital signatures, covert channels, and spread-spectrum communications. Steganography can be applied in many ways to digital media. One method of applying steganography is hiding information within images such as a photographs or drawings. A common method for hiding information in an image is to store information bits within the least significant bits of the pixels! comprising the image. Steganography can be used to hide information within plain text files or within audio, video, and data transmissions. 1.2. Steganography throughout History ‘Throughout history, a multitude of methods and variations have been used to hide information, Accounts throughout history have been recordedInformation Hiding: Steganography and Watermarking 3 with tales of cryptography and steganography during times of war and peace [44, 60}. One of the first documents describing steganography is from the Histories of Herodotus. In ancient Greece, text was written on wax-covered tablets. In one story Demeratus wanted to notify Sparta that Xerxes intended to invade Greece. To avoid capture, he scraped the wax off of the tablets and wrote a message on the underlying wood. He then covered the tablets with wax again, The tablets appeared to be blank and unused so they passed inspection by sentries without question. Another ingenious method was to shave the head of a messenger and tattoo a message or image on the messenger’s head. After allowing his hair to grow, the message would be undetected until the head was shaved again. This method has been popularized by Hollywood in pirate films such as Yellowbeard and Cutthroat Island. Another common form of invisible writing is through the use of invisible inks. Such inks were used with much success in bath World War I and World War I, An innocent letter may contain a very different message written between the lines [94]. Early in WWII steganographic technology consisted almost exclusively of invisible inks [44]. Common sources for invisible inks are milk, vinegar, fruit juices, and urine. All of these darken when heated. With the improvement of technology and the ease as to the decoding of these invisible inks, more sophisticated inks were developed which react to various chemicals. Some messages had to be “developed” much as photographs are developed with a number of chemicals in processing labs. Null ciphers (unencrypted messages also known as open codes) were also used. The real message is camouflaged in an innocent sounding message. Due to the “sound” of many open coded messages, mail filters detected the suspect communications. However “innocent sounding” messages were allowed to flow through. An example of a message containing such a null cipher, which was actually sent by a German Spy in WWII [44]: Apparently neutral’ protest is thoroughly discounted and ignored. Isman hard hit. Blockade issue affects pretext for embargo on byproducts, ejecting suets and vegetable oils. ‘Taking the second letter in each word the following message emerges: Pershing sails from NY June 1 ‘As message detection improved, new technologies were developed which could pass more information and be even less conspicuous. With many methods being discovered and intercepted, the U.S. Office of Censorship took extreme actions such as banning flower deliveries, which contained4 Chapter 1 Introduction delivery dates, crossword puzzles, and even report cards as they can all contain secret messages. Censors even went as far as rewording letters and replacing stamps on envelopes. ‘The Germans further developed covert communications by developing, microdot technology. Former FBI Director J. Edgar Hoover referred to microdots as “the enemy's masterpiece of espionage.” Microdots are photographs the size of a printed period having the clarity of standard-sized typewritten pages. The first microdot was discovered masquerading as a period on a typed envelope carried by a German agent in 1941. The message was neither hidden nor encrypted. It was just so small as to not draw attention to itself (for a while). Besides being so small, microdots permitted the transmission of large amounts of data including drawings and photographs [44] Advances in microdot development continue to this day. In 1999, researchers at Mount Sinai School of Medicine in New York encoded a hidden message in a strand of human DNA using a technique described as ‘genomic steganography” [10, 18]. Different combinations of amino bases or nucleotides represented the letters of their message. Additional sequences of amino bases are added to this strand to serve as a “key” to finding the strand containing the embedded message. This stego-DNA strand was mixed with millions of DNA strands and the mixture was soaked into paper to produce a microdot. The researchers then affixed the microdot on a letter and sent it through the mail to themselves. To decode the message, the receiver extracts and soaks the microdot in a solution to unwind the DNA strands. Upon finding the stego-DNA strand, the researchers could then extract the hidden message: “June 6 invasion: Normandy.” Further exploration into the application of DNA for storage, encryption, and steganography is explored in [31]. The authors suggest that DNA can be used for compact information storage. A gram of DNA can potentially hold 100,000,000 tera-bytes. An image is encrypted and concealed in a microscopic strand of DNA as an illustration.” 1.3 Methods for Hiding Information The onset of computer technology and the Internet has given new life to steganography and the creative methods with which it is employed. Computer-based steganographic techniques introduce changes to digital carriers to embed information foreign to the native carriers. Since 1995, interest in steganographic methods and tools as applied to digital media has exploded. *Information Hiding: Steganography and Watermarking 5 Steganography encompasses methods of transmitting secret messages in such a manner that the existence of the embedded messages is undetectable. Carriers of such messages may resemble innocent sounding text, disks and storage devices [4, 57], network traffic and protocols (23, 34], the way software or circuits are arranged [51], audio, images, video, or any other digitally represented code or transmission. ‘These provide excellent carriers for hidden information and many different techniques have been introduced [2,9, 11, 41, 65, 46) Figure 1 provides an illustration of a steganographic model or process. Together, the cover carrier and the embedded message create a stego-carrier. Hiding information may require a stegokey or password that is additional secret information and may be used to select cover regions to hide or even ‘encrypt the embedded message. stegokey (pssovera) Ea] Steganogtnhy Cararathne ‘Sopication aden message Message cover medium + embedded message + stegokey = stego-medium Figure 1. Steganography Model. 1.3.11 ig in Text Documents may be modified to hide information by manipulating positions of lines and words [12]. HTML files can be use to carry information since adding spaces, tabs, "invisible" characters, and extra line breaks are ignored by web browsers. The "extra" spaces and lines are not perceptible until revealing the source of the web page.6 Chapter 1 Introduction Another example of hiding information in text is known as a null cipher or open code. The secret message is camouflaged in an innocent sounding message. The following is such a null cipher: Fishing freshwater bends and saltwater coasts rewards anyone feeling stressed. Resourceful anglers usually find masterful leapers fun and admit swordfish rank overwhelming anyday. ‘Taking the third letter in each word the following message emerges [93] Send Lawyers, Guns, and Money Information can be hidden in the layout of a document. Brassil et al. discuss document identification and marking by modulating the position of lines and words in [12]. Similar techniques can also be used to provide some other covert information just as 0 and 1 are informational bits for a computer. As in one of their examples, word shifting can be used to help identify an original document. A similar method can be applied to display an entirely different message. Take the following sentence: ‘We explore new steganographic and cryptographic algorithms and techniques throughout the world to produce wide variety and security in the electronic web called the Internet. and apply some word shifting algorithm to obtain the following sentence: ‘We explore new steganographic and cryptographic algorithms and techniques throughout the World to produce wide variety and security in the electronic web called the Internet. By overlapping the two sentences, we obtain the following: We explore new steganographic and cryptographic algorithms and techniques throughout the world to produce wide variety and security in the electronic web called the Internet. This example is achieved by shifting the words explore, world, wide and. web up by one point and shifting the word the down by one point Independently, the sentence containing the shifted words appears harmless, but combining this with the original sentence produces a different message: explore the world wide web. Likewise, the way language is spoken may encode a message. Pauses, throat clearing, and enunciations may all be used to trigger hidden messages to an intended listener. For additional text-based hiding techniques see [85]Information Hiding: Steganography and Watermarking 7 1.3.2 Hiding in Disk Space Other ways to hide information rely on finding unused space that is not readily apparent to an observer. Taking advantage of unused or reserved space to hold covert information provides a means of hiding information without perceptually degrading the carrier. The way operating systems store files typically results in unused space that appears to be allocated to files. ‘This “allocated” but available space is known as slack space. For example, under Windows 95 operating system, drives formatted as FATI6 (MS-DOS compatible) without compression use cluster sizes of around 32 kilobytes (K). What this means is that the minimum space allocated to a file is 32K. Ifa file is 1K in size, then an additional 31K is "wasted" due to the way storage space is allocated. With compression the minimum cluster size is 512 bytes. This "extra" space can be used to hide information without showing up in the directory. Another method of hiding information in file systems is to create a hidden partition, These partitions are not seen if the system is started normally. However, in many cases, running a disk configuration utility exposes the hidden partition. These concepts have been expanded in a novel proposal of a steganographic file system [4]. If the user knows the file name and password, then access is granted to the file; otherwise, no evidence of the file exists in the system of the hidden files. 1.3.3 Hiding in Network Packets Characteristics inherent in network protocols can be taken advantage of to hide information [23, 34, 69]. An uncountable number of data packets are transmitted daily over the Internet. Any of which can provide an excellent covert communication channel. For example, TCP/IP packets can be used to transport information across the Internet. These headers have unused space and other features that can be manipulated to embed information. See Appendix A for an illustration of hiding information TCP/IP packet headers. 1.3.4 Hiding in Software and Circuitry Data can also be hidden based on the physical arrangement of a carrier. The arrangement itself may be an embedded signature that is unique to the to the creator. An example of this is in the layout of code distributed in a program or the layout of electronic circuits on a board [51, 52]. This type of “marking” can be used to uniquely identify the design origin and cannot be removed without significant change to the work.8 Chapter I Introduction 1.3.5 Hiding in Audio and Images Many different methods for hiding information in audio and images exist. These methods may include hiding information in unused space in file headers to hold “extra” information. Embedding techniques can range from the placement of information in imperceptible levels (noise), manipulation of compression algorithms, to the modification of carrier properties. In audio, small echoes or slight delays can be added or subtle signals can be masked by sounds of higher amplitude (29, 33] In [88] the authors describe a system that transmits messages in a lossy DCT-based video compression scheme over an ISDN (Integrated Services Digital Network) line used for video conferencing. Up to 8 kilobits could be embedded without degrading the signal to the point that the secret ‘communication becomes apparent. In images, modifying properties such as luminance, contrast, ot colors can be used. These methods hide information in audio and images with virtually no impact to the human sensory system. We will Iook at various techniques used for hiding information in images in Chapter 2. 1.4 Attacks against Hidden Information Understanding the impact that data hiding techniques have on carriers is fundamental to detecting or disabling hidden messages. Successful detection of a message results in a discovery that the message exists. However, that message may not be decipherable. Successful distortion of a message means that the message is rendered unreadable without introducing any readily perceptible changes to the carriers. However, a distortion attack can be used whether or not a message is actually detected. Detection and distortion are explored in more detail below. 1.4.1 Detection ‘As steganography software tools become available, the investigation of the various methods that are employed is necessary to identify repeatable patterns and devise attacks. Partial results of this research were presented in the Second Information Hiding Workshop in Portland, Oregon. This conference was the first to present topics discussing attacks on steganography and watermarking systems. The research was among the first to publish information on attacking, steganographic systems by detecting the manipulation that occurs to carriers and messages hidden within. One method of steganography detection is