How Do Steganography Tools Work?

To show how easy steganography is, I started out by downloading

one of the more popular freeware tools out now: F5, then moved to

a tool called SecurEngine, which hides text files within larger text

files, and lastly a tool that hides files in MP3s called MP3Stego. I also

tested one commercial steganography product, Steganos Suite.

F5 was developed by Andreas Westfield, and runs as a DOS

client. A couple of GUIs were later developed: one named “Frontend”,

developed by Christian Wohne and the other, named “Stegano”, by

Thomas Biel. I tried F5, beta version 12. I found it very easy to encode

a message into a JPEG file, even if the buttons in the GUI are written

in German! Users can simply do this by following the buttons,

inputting the JPEG file path, then the location of the data that is

being hidden (in my case, I used a simple text file created in Notepad),

at which point the program prompts the user for a pass phrase. As

you can see by the before and after pictures below, it is very hard to

tell them apart, embedded message or not.

Granted, the file that I embedded here was very small (it included

one line of text: “This is a test. This is only a test”.), so not that many

pixels had to be replaced to hide my message. But what if I tried to

hide a larger file? F5 only hides text files. I tried to hide a larger

word document and although it did hide the file, when I tried to

decrypt it, it came out as garbage. However, larger text files seemed

to hide in the picture just as well as my small, one line message.

95

 

 

SecurEngine doesn’t seem to be as foolproof as the tools that

hide text within pictures. When I hid my small text file in a bigger

text file, I found an odd character at the bottom of the encoded file

(“y”). This character was not in the original file. SecurEngine gives

users the option of just hiding the image, hiding the image as well as

encrypting it, or both. The test message was encrypted and decrypted

without issue. SecurEngine also has a feature that helps to “wipe”

files (to delete them more securely).

MP3Stego, a tool that hides data in MP3 files worked very well.

How the process works is like this: you encode a file, a text file for

example, with a .WAV file, in order for it to be compressed into MP3

format. One problem that I ran into was that in order to hide data of

any size, I had to find a file that was proportional in size. So, for

instance, my small text message from the previous exercise was too

big to hide in a .WAV file (the one that I originally tried was 121KB,

and the text file was around 36 bytes). In order to ultimately hide

a file that was 5 bytes (only bearing the message “test”.), I found

a .WAV file that was 627 KB. The ultimate MP3 file size was 57KB.

Steganos Suite is a commercial software package of numerous

stego tools all rolled into one. In addition to a nifty Internet trace

destructor function and a computer file shredder, it has a function

called the File Manager. This allows users to encrypt and hide files

on their hard drive. The user selects a file or folder to hide, and then

selects a “carrier” file, which is defined as a graphic or sound file.

It will also create one for you if you prefer, if you have a scanner or

microphone available. If you don’t have a file handy or if you want to

create one, the File Manager will search your hard drive for an

appropriate carrier. This tool looks for a wider variety of file types

than the majority of the freeware tools that I perused (such as .DLL

and .DIB files), so if you intend to do quite a bit of file hiding, you

might want to invest in a commercial package.

 

Steganography and Security

As mentioned previously, steganography is an effective means of

hiding data, thereby protecting the data from unauthorized or

unwanted viewing. But stego is simply one of many ways to protect

the confidentiality of data. It is probably best used in conjunction

 

96

 

 

with another data hiding method. When used in combination, these

methods can all be a part of a layered security approach. Some good

complementary methods include:

Encryption — Encryption is the process of passing data or

plaintext through a series of mathematical operations that generate

an alternate form of the original data known as ciphertext. The

encrypted data can only be read by parties who have been given the

necessary key to decrypt the ciphertext back into its original plaintext

form. Encryption doesn’t hide data, but it does make it hard to read!

Hidden directories (Windows) — Windows offers this feature,

which allows users to hide files. Using this feature is as easy as

changing the properties of a directory to “hidden”, and hoping that

no one displays all types of files in their explorer.

Hiding directories (Unix) — in existing directories that have

a lot of files, such as in the /dev directory on a Unix implementation,

or making a directory that starts with three dots (...) versus

the normal single or double dot.

Covert channels — Some tools can be used to transmit valuable

data in seemingly normal network traffic. One such tool is Loki. Loki

is a tool that hides data in ICMP traffic (like ping).