Computer Forensics and Steganography

Go back to Tutorial

Steganography is the art of covered or hidden writing. The purpose of steganography is covert communication to hide a message from a third party. This differs from cryptography, the art of secret writing, which is intended to make a message unreadable by a third party but does not hide the existence of the secret communication.

Steganography hides the covert message but not the fact that two parties are communicating with each other. The steganography process generally involves placing a hidden message in some transport medium, called the carrier. The secret message is embedded in the carrier to form the steganography medium. The use of a steganography key may be employed for encryption of the hidden message and/or for randomization in the steganography scheme. In summary:

steganography_medium = hidden_message + carrier + steganography_key

Types

• Technical steganography uses scientific methods to hide a message, such as the use of invisible ink or microdots and other size-reduction methods.
• Linguistic steganography hides the message in the carrier in some nonobvious ways and is further categorized as semagrams or open codes.
• Semagrams hide information by the use of symbols or signs. A visual semagram uses innocent-looking or everyday physical objects to convey a message, such as doodles or the positioning of items on a desk or Website. A text semagram hides a message by modifying the appearance of the carrier text, such as subtle changes in font size or type, adding extra spaces, or different flourishes in letters or handwritten text.
• Open codes hide a message in a legitimate carrier message in ways that are not obvious to an unsuspecting observer. The carrier message is sometimes called the overt communication whereas the hidden message is the covert communication. This category is subdivided into jargon codes and covered ciphers.
• Jargon code, as the name suggests, uses language that is understood by a group of people but is meaningless to others. Jargon codes include warchalking (symbols used to indicate the presence and type of wireless network signal [Warchalking 2003]), underground terminology, or an innocent conversation that conveys special meaning because of facts known only to the speakers. A subset of jargon codes is cue codes, where certain prearranged phrases convey meaning.
• Covered or concealment ciphers hide a message openly in the carrier medium so that it can be recovered by anyone who knows the secret for how it was concealed. A grille cipher employs a template that is used to cover the carrier message. The words that appear in the openings of the template are the hidden message. A null cipher hides the message according to some prearranged set of rules, such as “read every fifth word” or “look at the third character in every word.”

Steganography Forensics

The art and science of steganalysis is intended to detect or estimate hidden information based on observing some data transfer and making no assumptions about the steganography algorithm

Steganalysis techniques can be classified in a similar way as cryptanalysis methods, largely based on how much prior information is known (Curran and Bailey 2003; Johnson and Jajodia 1998B).

• Steganography-only attack: The steganography medium is the only item available for analysis.
• Known-carrier attack: The carrier and steganography media are both available for analysis.
• Known-message attack: The hidden message is known.
• Chosen-steganography attack: The steganography medium and algorithm are both known.
• Chosen-message attack: A known message and steganography algorithm are used to create steganography media for future analysis and comparison.
• Known-steganography attack: The carrier and steganography medium, as well as the steganography algorithm, are known.

Steganography Tools

• WetStone Technologies’ Gargoyle (formerly StegoDetect) software can be used to detect the presence of steganography software.
• AccessData’s Forensic Toolkit and Guidance Software’s EnCase can use the HashKeeper, Maresware, and National Software Reference Library (National Software Reference Library 2003) hash sets to look for a large variety of software.
• Niels Provos’ stegdetect can find hidden information in JPEG images using such steganography schemes as F5, Invisible Secrets, JPHide, and JSteg.

Go back to Tutorial