Steganography – The Art and Science of Writing Hidden Messages

Wikipedia defines Steganography as the art and science of writing hidden messages in such a way that no one apart from the intended recipient knows of the existence of the message; this is in contrast to cryptography, where the existence of the message itself is not disguised, but the content is obscured. The word “Steganography” comes from Greek words steganÓs meaning covered, and graptos meaning writing and can trace its origins as far back as 440 B.C.

Steganography has been used for hundreds of years as a means of concealing information from prying eyes before ultimately reaching its intended destination. In Histories written by Herodotus, he gives two examples of steganography. The first is Demeratus, a Greek in the Persian court who sent warning of a forthcoming invasion by Xerxes by writing a message on a wooden pallet and then covering it in wax. The messenger was able to successfully smuggle the “blank” tablet to Sparta. A second example was that of Histiaeus who shaved the head of his most trusted slave and tattooed a message on his head. After the slave’s hair grew, he was dispatched with the “hidden message”. The purpose was to instigate a revolt against the Persians. It relies on the sender and receiver agreeing upon the method by which the information will be hidden and therefore some means of prior communication is essential for steganography to be of any use.

Essentially, steganography is the art of concealing private or sensitive information within a carrier that for all intents and purposes, appears innocuous. Simply put, if you were to view the presented information, it would appear to be something that does not warrant further analysis due to the fact that it does not LOOK or SOUND like anything that contains sensitive information. Steganography is sometimes confused with cryptography. Although the two can co-exist, they are not the same. Both are used to protect information but steganography is concerned with concealing information thereby making it unseen while cryptography is concerned with encrypting information thereby making it unreadable.

As technology has evolved, so has steganography technique. How do we hide information in the electronic age? At the most fundamental level, computers use binary, a combination of zeroes and ones to represent text and graphics. The ASCII is the de facto standard for representing text and certain control characters. ASCII uses one parity bit and seven data bits to represent each character in the English language. For example an uppercase “A” is represented by 10000001. A digital image is composed of picture elements or “pixels.” Each pixel contains information as to the intensity of the three primary colors, red, green and blue. This information can be stored in a single byte (8 bits) or in three bytes (24 bits). For example in an 8 bit image, white is represented by the binary value of 11111111 and black is 00000000. Current information hiding techniques rely on the use of a cover object (image, document, sound file, video file, etc.) sometimes known as a carrier. The secret message is then broken down to its individual bits by a steganographic tool (stego-tool) and Embedded in the cover object. Many tools will utilize a password or passphrase which is necessary to extract the hidden message and is referred to as a stego-key. The result of this process is known as the stego-object.

Where can information be hidden? Almost anywhere on the Internet! The standard protocol suite used in the Internet is TCP/IP. The headers used to transfer data between computers allow the use of flags and certain reserved fields. With the appropriate tools, information can be inserted into these fields. The advantage of this technique is that headers are rarely read by humans and thus makes an ideal place to hide data. The disadvantage of this method is that firewalls can be configured to filter out packets that contain inappropriate data in the reserved fields, thus defeating the steganographic transmission. Another popular technique for hiding information is to include extra spaces in documents. These spaces may contain hidden characters. Again this is simple technique for hiding information and consequently is easy to detect and defeat. By opening such a document in Microsoft Word, the unusual spaces become readily apparent. Reformatting the document can remove hidden message. The use of audio files can provide a good carrier for hidden messages. By their very nature, sound files tend to be large in size and thus do not attract attention. The human eye or the human ear cannot detect very subtle or minute changes in visual or aural presentations making steganography an effective means of concealing private information.

The most prevalent cover objects in use today are digital images because of their potential payload (hidden information). A typical image with 640 x 480 pixels and 256 colors (8 bit) can hide approximately 300Kb of information. A high resolution image, 1024 x 768 pixels and 24 bit color could hide approximately 2.3 Mb worth of data. Due to the potential large size of such files compression algorithms are used to reduce the image to a suitable size for sending across the Internet. There is a wide variety if compression algorithms available, but the three most common are BMP, GIF, and JPEG. When choosing a cover image for use in steganography the first two compression algorithms, BMP and GIF are preferred because offer “lossless” compression. The compressed image is an exact representation of the original. The JPEG compression algorithm uses floating point calculations to translate the picture

Following is the elaboration of a few steganographic techniques.

Technique 1: Substitution.

Every file that is created will contain unused or insignificant areas of data. These areas can be replaced without any discernible changes to the visual or aural clarity of the file. The Least Significant Bit (LSB) method replaces the last bit in an 8 bit byte. The theory is that simply replacing this bit in each byte will not be noticeable to the human eye or ear depending on the type of the file.

10010110 01101010 11100101

This represents a 24 bit image (3 bytes x 8 bits). Let’s suppose we changed the first bit (1) in the first byte. This being the most significant bit would mean that it changing would likely have a significant effect on the picture and be easily seen by the naked eye. However, if we change the last bit (1) in the last byte then chances are that this change would not be noticeable. This last bit is the Least Significant Bit (LSB). Therefore to conceal a message, we can use the LSB’s in the picture file to structure a message to conceal within the file.

LSB works best in files that have a lot of ‘noise’ i.e. pictures that have many colors and shapes or audio files that have a lot of different sounds and effects such as echoes. This is because LSB changes the value of a byte and in turn that changes the color or sound. Therefore, the more noise in a file the harder it will be for human to notice any minor changes. Substitution method generally does not increase the size of the file but depending on the size of the hidden message, it can eventually cause a noticeable change from the unmodified version. The LSB technique is commonly used in steganographic applications because it is quick and easy to use. One drawback to LSB is that the technique does not take well to the file changing eh. The picture being cropped or rotated as this can destroy the hidden message.