View
88
Download
0
Category
Preview:
Citation preview
Overview
• SteganographySome quick definitions What is steganography?Methods of MaskingSteganographic constraints
• Real World ApplicationThe “illegals” and more
• Application in Virtual EnvironmentsGaming and Virtual RealityLimitations
• Conclusion
… But First, Some Definitions
• Cover file: Original message/file in which hidden information will be stored.
• Stego Medium: The medium/type of media of the Cover file..
• LSB: Least Significant Bit, the right-most bit in a byte.
• Capacity: Amount of data that can be hidden without distorting the Cover file.
• Constraint: 3 types: Perceptual, Statistical and Attack.
• Cognitive cost: The impact of a task (measured in time) on mental ability.
• Lossy Compression: Inexact approximations (discarded points/loss of accuracy) to
represent content.
What is Steganography?
• Greek: “steganos” (covered/hidden), “graphie” (writing).
• The art of concealment: Hiding in plain sight.
• “Security through Obscurity”
• Historically a tool of stealth/espionage.
• Threat to Confidentiality (in CIA pyramid).
Steganographic Types and Mediums
Data
Audio
Stream
Image
Still Video
Stream
Textual
IP Header
Linguistic
Semagrams
Visual
Textual
The Digital Do Not’s (3 Constraints)
• Perceptual: Don’t mask so much data that it distorts the cover.
• Statistical: Don’t be too predictable.
• Attack: Don’t make it overly complicated to decipher.
The “illegals”
• FBI “Operation Ghost Stories” culminates in June 2010 with arrest of 10 Russian spies operating out of NY/NJ.
• The spies used sophisticated technologies to exchange data, including disappearing ink and masked digital photos– two applications of steganography
• One of the spies, Richard Murphy, regularly embedded data in the photograph of flowers, right,and uploaded to SVR (Russian Intelligence).
Other Real World Examples...
• 2014: Malware ZeusVM uses sunset (at right)to mask a configuration file containing instructionsto steal user credentials for financial institutions
• 2014: Lurk embeds encrypted list of downloader URLs into an image file using LSB bit substitution. Acts as a backdoor, downloading and executing secondary malware payloads.
• 2015: Vawtrak hides in favicons, aka desktop shortcuts. Steals financial information, FTP credentials, private encryption keys, etc, executes banking transactions directly from the victim’s pc.
…And Some Fictions
• 2001: USA Today story on 9/11 reports Osama and cells employ sophisticated photo steganography to communicate.FALSE – has never been even slightest evidence proving this.
• 2003: CIA monitors al-Jazeera broadcasts, uncovers covert dates, flight numbers, coordinates for high-profile sites.FALSE – overzealous interpretation of SIGInt signal-to-noise.
• 2015: Forbes reports Paris Bataclan attackers used PlaystationPS4s for covert communications.FALSE – To date, no supporting evidence has been found.
Other Digital Examples
• Audio “stream within a stream”, aka voice over voice over IP (VoVoIP) using G.711 codec
• SUNY Stony Brook’s CASTLE in-game covert channels and prerecorded group movement actions in StarCraft
• Traditional textual masking in a digital format:
More on Gaming
• Rook and Castle: Create covert channels in MMORPG games
• Not theoretical: Real world tested in Starcraft, Warcraft, Shogun 2, and Company of Heroes, relies on pre-recorded unit movements.
• Current undetected real-time decryption slow, only 1.5 kpbs, solution: playback from recorded logs offline. (Threatens both Confidentiality and Availability).
• Currently tested in local/desktop only modes.
Virtual Reality Masking
• Special equipment (eg Oculus Rift, Samsung VR) would be needed to even observe Cover.
• Theoretically huge (and unlimited) capacity to successfullymask data, owing to pixel depth and streaming of media.
• One time, uncaptured stream = maximum message security, but low potential Integrity and Availability (in CIA pyramid).
• 4k stream in immersive 360 degree view is too much, too fast for unaided decryption.
The Human Problem: Multitasking
• Speed/amount of masked data in visual VR environment too much for human brain to process.
• Maximum pixel definition for human eye is 2650x1600, but 30 degree field of visibility and lossy compression.
• Cognitive cost of multi stream single source inputs too high == vague and inaccurate decoding.
• Multi stream, multi source inputs decrease retention, impacting Integrity (in CIA pyramid).
Sensory Input, IllustratedGoing to the movies: 3 Scenarios and Steganographic Counterparts
Silent movie. Visual only. Single input stream, single
sense input. Lowest Cognitive cost, highest retention.
(Textual Steganography)
Regular movie. Audio and Visual inputs. 2 competing
inputs, but 2 different senses. Mid range Cognitive
cost, slight loss to details in retention. (Traditional
Steganography)
Foreign movie. Audio + Visual + Subtitles = 3
competing input streams, 2 from the same sense
(visual). Highest Cognitive Cost, least retention. (VR
Steganography)
Conclusions
• Human cognitive and perceptual ability are the biggest hurdles to future technologies.
• High risk of data loss in decryption (loss of Integrity) = VR not a credible threat at present. (Yet!)
• “Old school” methods (think “illegals”) still the best… for now.
• Masking data in gaming = most promising current technology.
Recommended