psst. wanna see a steganographic picture?

8/14/2019 Psst. Wanna See a Steganographic Picture?

1/5

Cygnus Business Media Website Officer.com Web

Sign Up for Free-mailNotifications

PromoOffers

Job Updates

Daily NewsOfficer

Down

ws Agency Search Web Directory Products Career Center Discussion Magazines

ction Sponsor

ome

ews for Cops

bs Central

fficer Forums

esources

irectory

hop/Products

agazines

ervices

dvertise

nk/Bookmark

ontact

Most Read Most E-mailed E-mail Article Print Article

Home > Law Enforcement Technology

W hat You See Is Not Alw ays What Y ouGet

From the January 2006 Issue

By Douglas Page

The leader of a Toronto terrorist cell puts a different Persian rug for sale on eBayevery Monday morning and posts a corresponding photograph. Bids commence,money is collected and items are shipped. So far, so good.

But, on Tuesdays at 4 p.m., the photo is swapped for a version that contains ahidden message. By prearrangement, the cell members know when to downloadthe image, and the weekly message is delivered.

While this scenario is fictitious, the stealth itself is real enough. It even has aname. The practice of hiding information by embedding messages within other,seemingly harmless, messages is called steganography.

Steganography, from Greek meaning "covered writing," is as old as the Greeks,who tattooed messages on the shaved heads of messengers. After the hair grewback, the messenger was dispatched. Invisible inks, written between the lines of innocuous letters, were a common form of steganography during World War II.

In the digital age, steganography allows someone to hide any type of binary fileinside any other binary file. Image and audio files are the most common carriers.Steganography is not encryption, because encryption relies on ciphers or codes toscramble a message.

Steganography provides some legitimate uses in the digital world, most notablydigital watermarking, wherein an author can embed a hidden message in a file sothat ownership of intellectual property can later be substantiated.

Not all applications of steganography are so benign. Steganography is drawingmore forensic attention, not because it's being used by college students passingaround final exam answers embedded in images, but because many people believesteganography is one of the ways Al Qaeda leaders communicate with terroristsaround the world.

There is also suspicion that the technology is exploited by organized crime andthose engaged in corporate espionage. It gets worse.

e-Alerts

What You See Is Not Always What You Get from Law Enforcement Technology at Officer.com

tp://www.officer.com/publication/article.jsp?pubId=1&id=27989&submit_comment=y (1 of 5)6/27/2009 6:21:12 PM

Search

Enter Email

Click to Go
http://www.cygnusb2b.com/http://www.officer.com/article/index.jsp?siteSection=5http://search.officer.com/agencysearch/http://www.officer.com/resources/http://www.officer.com/shop/http://www.officer.com/jobs/http://forums.officer.com/forums/http://www.officer.com/publication/pub.jsp?pubId=1http://www.officer.com/http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/jobs/http://forums.officer.com/forums/http://www.officer.com/resources/http://search.officer.com/agencysearch/http://www.officer.com/shop/http://www.officer.com/publication/pub.jsp?pubId=1http://www.officer.com/insider/http://www.officer.com/media/http://www.officer.com/insider/link.shtmlhttp://www.officer.com/insider/contact.shtmlhttp://www.officer.com/article/most_read.jsp?type=1http://www.officer.com/article/most_read.jsp?type=3http://emailwindow%28%27/article/email.jsp?id=27989%27,525,625)http://printerwindow%28%27/publication/printer.jsp?id=27989%27)http://www.officer.com/http://www.officer.com/publication/pub.jsp?pubId=1http://www.officer.com/publication/pub.jsp?pubId=1&issueId=20http://ad.doubleclick.net/jump/N1462.111966.1058714003421/B3453092.2;sz=120x600;ord=98468764?http://ad.doubleclick.net/jump/N1462.111966.1058714003421/B3453092.2;sz=120x600;ord=98468764?http://www.officer.com/publication/pub.jsp?pubId=1&issueId=20http://www.officer.com/publication/pub.jsp?pubId=1http://www.officer.com/http://printerwindow%28%27/publication/printer.jsp?id=27989%27)http://emailwindow%28%27/article/email.jsp?id=27989%27,525,625)http://www.officer.com/article/most_read.jsp?type=3http://www.officer.com/article/most_read.jsp?type=1http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/66735697/SW_TOP_468/OasDefault/InSynch_468x60/In-Synch_468x60/34323532303934623461343663343030http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/1767008965/SW_120x60/default/empty.gif/34323532303934623461343663343030http://www.officer.com/insider/contact.shtmlhttp://www.officer.com/insider/link.shtmlhttp://www.officer.com/media/http://www.officer.com/insider/http://www.officer.com/publication/pub.jsp?pubId=1http://www.officer.com/shop/http://search.officer.com/agencysearch/http://www.officer.com/resources/http://forums.officer.com/forums/http://www.officer.com/jobs/http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/1624717666/SN_120x60A/default/empty.gif/34323532303934623461343663343030http://www.officer.com/publication/pub.jsp?pubId=1http://forums.officer.com/forums/http://www.officer.com/jobs/http://www.officer.com/shop/http://www.officer.com/resources/http://search.officer.com/agencysearch/http://www.officer.com/article/index.jsp?siteSection=5http://www.officer.com/publication/http://www.officer.com/http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/1722916042/TA_PAGES_SLOT4/OasDefault/CopsPlus160x50/Copsplusbanner02.gif/34323532303934623461343663343030http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/1465480871/TA_PAGES_SLOT3/OasDefault/OfficerStorecom_Fixed/Holsters2.gif/34323532303934623461343663343030http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/49373345/TA_PAGES_SLOT2/OasDefault/QuarterMaster_160x50/QM_Blue_Round.gif/34323532303934623461343663343030http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/magazine/let/1408892305/TA_PAGES_SLOT1/OasDefault/OFCR_ChiefSupply_160x50/CS-160x50_511_Free_Gear.jpg/34323532303934623461343663343030http://www.google.com/http://www.cygnusb2b.com/


2/5


"I know of a case where steganography was employed to conceal childpornography," says steganography expert Neil Johnson, an associate at Booz AllenHamilton in McLean, Virginia, and author of several papers investigatingsteganography and associated digital forensic considerations. Using patternsJohnson published in a paper, investigators were able to determine the existenceof hidden images and the steganography tool used to produce them.

Johnson says investigators must now look beyond file systems and recovered filesto consider what may be hidden on computers. "Steganography goes beyond thedifficulties of encrypted data in that an investigator must now determine whetherhidden data exists," he says.

Investigators should become familiar with the steganographic tools and the impactthey have on computer systems, as well as the media that contains the hiddeninformation, Johnson says.

First clue The principal forensic problem is not enough computer forensic examiners have thefirst clue what steganography is, how it works, or how to detect or disarm it.

"Stego is well under the radar of a lot of forensic examiners," says Gary Kessler,an associate professor in the Computer and Digital Forensics Program atChamplain College in Burlington, Vermont. "Many examiners don't take it seriouslybecause they've never 'seen' it in use." Kessler also maintains that those

examiners that do "look" for steganography often use the wrong tools.

To address this issue, Kessler published a 12-page paper in the July 2004, issue of "Forensic Science Communication," offering a high-level, technical overview of steganography for those unfamiliar with the field.

"The paper's emphasis is on digital applications, focusing on hiding information inonline image or audio files," Kessler says. Examples of software tools that employsteganography to hide data inside of other files, as well as software to detect suchhidden files, are presented.

"At a high level, all a computer forensic examiner really needs is stego awareness,which means to look for stego clues at the scene and on the suspect computer,"Kessler says.

At the scene, for example, examiners should consider the technical sophisticationof the computer owner. What books, articles, magazines and software manuals arefound in the suspect's library? Then, are there clues on the computer in the formof steganography programs, hex editors or a large number of potential carrier files,particularly where there are apparent duplicates, he says.

Kessler recommends examiners add special equipment to their own arsenal in theform of steganographic detection software, such as WetStone Technologies' StegoSuite, as mentioned in the paper.

"The tools to build stego files are not the same tools you need to search for stegofiles," he cautions.

Ticket to hide In the aftermath of 9/11, several attempts were made to determine whether andto what extent steganographic images were present on the Internet.

One well-known study searched more than 2 million eBay images. Using specialdetection programs, researchers at the University of Michigan were unable to finda single hidden message. Another group examined several hundred thousandrandom images from various Web sites with similar negative results.

Although these projects provide a framework for searching a Web site forsteganography images, no conclusions can be drawn from them aboutsteganography images on the Internet. Absence of evidence is not evidence of



3/5


absence.

"One problem is programs like Stegdetect only look at JPEG images," Kessler says."Other image types were never examined. In the other study, only a limitednumber of Web sites were examined, far too few to make any definitivestatements about the Internet as a whole."

Free steganographic detection programs (such as Stegdetect and Stegbreak) areavailable at www.outguess.org .

In case steganography abuse is more pervasive than anyone is presently aware,federal agencies remain eager to develop solid steganographic detectiontechniques.

"One reason for federal interest is that stego tools have been found in the forensicanalysis of computers belonging to some criminals and terrorists," says HanyFarid, a computer science professor at Dartmouth College, located in Hanover,New Hampshire.

There are few hard statistics, however, about the frequency with whichsteganography software or media are discovered by law enforcement officials inthe course of computer forensics analysis.

"Anecdotal evidence suggests that many computer forensics examiners do notroutinely search for steganography software, and many might not recognize suchtools if they found them," Kessler says. "In addition, the tools that are employed todetect steganography software are often inadequate, with the examiner frequentlyrelying solely on hash sets or the steganography tools themselves."

Computer forensic examinations can be a lengthy process. A thorough search forevidence of steganography on a suspect hard drive containing thousands of images, audio files and video clips could take several days.

Hide and seek Finding steganographic messages has been equated to finding a needle in a countyof haystacks. There are millions of images, for instance, on eBay. Farid believes,however, that disabling steganography in a controlled environment like eBay could

be easy.

"Forget trying to find the needle in the haystack just turn the needle into a piece of straw by adding to each image a low-level noise pattern," he says. "The noise willbe imperceptible to the user but will destroy the stego message, which, unlikedigital watermarks, are highly sensitive to even the simplest attack."

Farid's Dartmouth lab has developed a steganographic tool for use in lesscontrolled environments. He admits, though, that while tools like these will becomeincreasingly necessary in the future, it will always be possible to hide messages inimages in ways that are imperceptible.

"As detection algorithms get better, stego embedding programs will respond by

simply embedding smaller amounts of information," Farid says. "At some point itwill be nearly impossible to detect small amounts of hidden data," Still, a growingnumber of digital forensics examiners now consider the search for steganographictools and/or media to be a routine part of every examination.

"Searching for steganography is not only necessary in criminal investigations andintelligence gathering operations, but forensic accounting investigators arerealizing the need to search for steganography as this becomes a viable way tohide financial records," Kessler says.

While it is impossible to know how widespread the current use of steganography is,it may not matter. Kessler believes it is safe to assume the worst.

http://www.outguess.org/http://www.outguess.org/


4/5

Submit a Commen t

Name: *

Subject:

City, State:

Comment:*

For verifcation purposes, please enter the characters you see in the image below

* = required (comments will appear after this article, as well as on our Readers Respond Page


"The use of steganography is certain to increase and will be a growing hurdle forlaw enforcement and counterterrorism activities," Kessler predicts.

E-mail Article Printer Friendly

Share your though ts, advice, opinions, and expertise @ Officer.com

Submit a comment

To purchase single article reprints (minimum 250) for distribution pleasecontact PARS International at 212-221-9595 x431 or at www.magreprints.

com/quickquote.aspx?ID=cygnus

Product Marketplace

Fire Arms & Accessories

Electronics & Surveillance Books, Videos, Software EMS & Safety Apparel & Off-Duty Wear Gifts & Collectibles Vehicle & Traffic Accessories Duty Gear & Tactical

All Products

Magazines

Law Enforcement

Technology Current Issue Subscribe E-Inquiry

Law Enforcement Product News Current Issue Subscribe E-Inquiry


Submit Comment
http://www.officer.com/readersrespond/http://www.officer.com/online/email.jsp?id=27989&siteSection=1http://popupwindow%28%27/online/printer.jsp?id=27989%27,%20%27100%27,%20%27100%27,%20%27600%27,%20%27600%27)http://www.officer.com/publication/article.jsp?pubId=1&id=27989&submit_comment=y&submit_comment=yhttp://www.magreprints.com/quickquote.aspx?ID=cygnushttp://www.magreprints.com/quickquote.aspx?ID=cygnushttp://www.officer.com/shop/firearms/http://www.officer.com/shop/electronics/http://www.officer.com/shop/books/http://www.officer.com/shop/ems/http://www.officer.com/shop/apparel/http://www.officer.com/shop/gifts/http://www.officer.com/shop/vehicle/http://www.officer.com/shop/gear/http://www.officer.com/shop/http://www.officer.com/magazines/lethttp://www.officer.com/magazines/lethttp://www.officer.com/magazines/let/current.shtmlhttps://cygweb4.cygnuspub.com/Secure/Subscriptions/Sub_form.cfm?iPub_Code=287http://www.officer.com/magazines/let/search.shtmlhttp://www.officer.com/magazines/lepnhttp://www.officer.com/magazines/lepnhttp://www.officer.com/magazines/lepn/current.shtmlhttps://cygweb4.cygnuspub.com/Secure/Subscriptions/Sub_form.cfm?iPub_Code=288http://www.officer.com/magazines/lepn/search.shtmlhttp://www.officer.com/magazines/lepn/search.shtmlhttps://cygweb4.cygnuspub.com/Secure/Subscriptions/Sub_form.cfm?iPub_Code=288http://www.officer.com/magazines/lepn/current.shtmlhttp://www.officer.com/magazines/lepnhttp://www.officer.com/magazines/lepnhttp://www.officer.com/magazines/let/search.shtmlhttps://cygweb4.cygnuspub.com/Secure/Subscriptions/Sub_form.cfm?iPub_Code=287http://www.officer.com/magazines/let/current.shtmlhttp://www.officer.com/magazines/lethttp://www.officer.com/magazines/lethttp://www.officer.com/shop/http://www.officer.com/shop/gear/http://www.officer.com/shop/vehicle/http://www.officer.com/shop/gifts/http://www.officer.com/shop/apparel/http://www.officer.com/shop/ems/http://www.officer.com/shop/books/http://www.officer.com/shop/electronics/http://www.officer.com/shop/firearms/http://www.magreprints.com/quickquote.aspx?ID=cygnushttp://www.magreprints.com/quickquote.aspx?ID=cygnushttp://www.officer.com/publication/article.jsp?pubId=1&id=27989&submit_comment=y&submit_comment=yhttp://popupwindow%28%27/online/printer.jsp?id=27989%27,%20%27100%27,%20%27100%27,%20%27600%27,%20%27600%27)http://www.officer.com/online/email.jsp?id=27989&siteSection=1http://www.officer.com/readersrespond/


5/5


ForumDiscussions

All Discussions Public Forums For Officers Law & Politics Local Discussions Equipment & Tactical Communications

Register Now

W ebGateway

Police Agencies Associations Personal Pages Supplier Directory More Links Training Schedule

MoreHeadlines

Top Stories Officer Down Internal Affairs Most Wanted Homeland Defense Funding & Admin Legislation Industry

News Submit News

JobsCentral

Search Jobs Browse Jobs

20 Newest Jobs Career Forums Degree Programs

Kaplan Criminal

Justice AIU Criminal Justice Mountain State CJ

Advertise on Officer.com | Contact Us | Privacy Statement | User Agreement | Link to Us

Law Enforcement Technology - Law Enforcement Product News - Officer.com e-Alerts

Copyright 2009 All rights reserved. - Cygnus Interactive, a Division of Cygnus Business Media.

tp://www officer com/publication/article jsp?pubId=1&id=27989&submit comment=y (5 of 5)6/27/2009 6:21:12 PM
http://forums.officer.com/forums/http://forums.officer.com/forums/http://forums.officer.com/forums/forumdisplay.php?f=3http://forums.officer.com/forums/forumdisplay.php?f=7http://forums.officer.com/forums/forumdisplay.php?f=5http://forums.officer.com/forums/forumdisplay.php?f=159http://forums.officer.com/forums/forumdisplay.php?f=159http://forums.officer.com/forums/forumdisplay.php?f=6http://forums.officer.com/forums/forumdisplay.php?f=6http://forums.officer.com/forums/forumdisplay.php?f=4http://forums.officer.com/forums/register.php?http://search.officer.com/agencysearch/http://search.officer.com/agencysearch/http://search.officer.com/associationsearch/http://search.officer.com/officersearch/http://search.officer.com/officersearch/http://buyersguide.officer.com/buyersguide/index.cfmhttp://buyersguide.officer.com/buyersguide/index.cfmhttp://search.officer.com/miscsearch/http://search.officer.com/miscsearch/http://www.officer.com/training/http://www.officer.com/training/http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/article/index.jsp?siteSection=2http://www.officer.com/article/index.jsp?siteSection=2http://www.officer.com/article/index.jsp?siteSection=5http://www.officer.com/article/index.jsp?siteSection=5http://www.officer.com/article/index.jsp?siteSection=7http://www.officer.com/article/index.jsp?siteSection=7http://www.officer.com/article/index.jsp?siteSection=8http://www.officer.com/article/index.jsp?siteSection=8http://www.officer.com/article/index.jsp?siteSection=4http://www.officer.com/article/index.jsp?siteSection=4http://www.officer.com/article/index.jsp?siteSection=6http://www.officer.com/article/index.jsp?siteSection=9http://www.officer.com/article/index.jsp?siteSection=9http://www.officer.com/insider/contact.shtmlhttp://www.officer.com/insider/contact.shtmlhttp://www.officer.com/jobs/http://www.officer.com/jobs/http://www.officer.com/jobs/job_query_action.jsp?stateId=0&positionId=0http://www.officer.com/jobs/job_query_action.jsp?stateId=0&positionId=0http://www.officer.com/jobs/job_last20_action.jsphttp://www.officer.com/jobs/job_last20_action.jsphttp://www.officer.com/jobs/job_last20_action.jsphttp://forums.officer.com/forums/forumdisplay.php?s=&forumid=20http://forums.officer.com/forums/forumdisplay.php?s=&forumid=20http://www.eduselect.com/welcome.cgi?h=15301&sh=314815&cat=cjhttp://www.eduselect.com/welcome.cgi?h=15301&sh=314815&cat=cjhttp://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/jobs/163989388/SW_BOTTOM_468/OasDefault/CompassKnowledge468x60_ROS/compass_knowledge_groupADCJofficer_com_468x60BanAD.gif/xhttp://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/jobs/163989388/SW_BOTTOM_468/OasDefault/CompassKnowledge468x60_ROS/compass_knowledge_groupADCJofficer_com_468x60BanAD.gif/xhttp://www.officer.com/media/http://www.officer.com/contact.shtmlhttp://www.officer.com/privacy.jsphttp://www.officer.com/useragreement.jsphttp://www.officer.com/insider/link.shtmlhttp://www.officer.com/magazines/lethttp://www.officer.com/magazines/lepnhttp://go.reachmail.biz/client_files/officercom/signup/signup.asphttp://go.reachmail.biz/client_files/officercom/signup/signup.asphttp://www.officer.com/magazines/lepnhttp://www.officer.com/magazines/lethttp://www.officer.com/insider/link.shtmlhttp://www.officer.com/useragreement.jsphttp://www.officer.com/privacy.jsphttp://www.officer.com/contact.shtmlhttp://www.officer.com/media/http://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/jobs/163989388/SW_BOTTOM_468/OasDefault/CompassKnowledge468x60_ROS/compass_knowledge_groupADCJofficer_com_468x60BanAD.gif/xhttp://ad2.firehousezone.com/RealMedia/ads/click_lx.ads/www.officer.com/jobs/163989388/SW_BOTTOM_468/OasDefault/CompassKnowledge468x60_ROS/compass_knowledge_groupADCJofficer_com_468x60BanAD.gif/xhttp://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=20306&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://aftrk.com/c/c?b=21299&h=15301&sh=314815&bt=234x60http://www.eduselect.com/welcome.cgi?h=15301&sh=314815&cat=cjhttp://www.eduselect.com/welcome.cgi?h=15301&sh=314815&cat=cjhttp://forums.officer.com/forums/forumdisplay.php?s=&forumid=20http://forums.officer.com/forums/forumdisplay.php?s=&forumid=20http://www.officer.com/jobs/job_last20_action.jsphttp://www.officer.com/jobs/job_last20_action.jsphttp://www.officer.com/jobs/job_last20_action.jsphttp://www.officer.com/jobs/job_query_action.jsp?stateId=0&positionId=0http://www.officer.com/jobs/job_query_action.jsp?stateId=0&positionId=0http://www.officer.com/jobs/http://www.officer.com/jobs/http://www.officer.com/insider/contact.shtmlhttp://www.officer.com/insider/contact.shtmlhttp://www.officer.com/article/index.jsp?siteSection=9http://www.officer.com/article/index.jsp?siteSection=9http://www.officer.com/article/index.jsp?siteSection=6http://www.officer.com/article/index.jsp?siteSection=4http://www.officer.com/article/index.jsp?siteSection=4http://www.officer.com/article/index.jsp?siteSection=8http://www.officer.com/article/index.jsp?siteSection=8http://www.officer.com/article/index.jsp?siteSection=7http://www.officer.com/article/index.jsp?siteSection=7http://www.officer.com/article/index.jsp?siteSection=5http://www.officer.com/article/index.jsp?siteSection=5http://www.officer.com/article/index.jsp?siteSection=2http://www.officer.com/article/index.jsp?siteSection=2http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/article/index.jsp?siteSection=1http://www.officer.com/training/http://www.officer.com/training/http://search.officer.com/miscsearch/http://search.officer.com/miscsearch/http://buyersguide.officer.com/buyersguide/index.cfmhttp://buyersguide.officer.com/buyersguide/index.cfmhttp://search.officer.com/officersearch/http://search.officer.com/officersearch/http://search.officer.com/associationsearch/http://search.officer.com/agencysearch/http://search.officer.com/agencysearch/http://forums.officer.com/forums/register.php?http://forums.officer.com/forums/forumdisplay.php?f=4http://forums.officer.com/forums/forumdisplay.php?f=6http://forums.officer.com/forums/forumdisplay.php?f=6http://forums.officer.com/forums/forumdisplay.php?f=159http://forums.officer.com/forums/forumdisplay.php?f=159http://forums.officer.com/forums/forumdisplay.php?f=5http://forums.officer.com/forums/forumdisplay.php?f=7http://forums.officer.com/forums/forumdisplay.php?f=3http://forums.officer.com/forums/http://forums.officer.com/forums/

psst. wanna see a steganographic picture?

Documents