0x835 · 2013. 12. 16. · Introduction 2 SecurIMAG - Stegano –0x835 –2013/11/07 Steganography is the process of hiding one medium of communication (text, sound, image, …) within

0x835

Steganography

2013-11-07

Grenoble INP

Ensimag

http://www.ensimag.fr/

Introduction

2 SecurIMAG - Stegano – 0x835 – 2013/11/07

Steganography is the process of hiding one medium of communication (text,

sound, image, …) within another without changing in original format.

From the Greek word steganos meaning « covered » and the Greek

word graphie meaning « writing ».

Steganography

covered writing

Some properties


Steganography → process of hiding of a secret message

Anyone else viewing the message will fail to know it contains hidden or

encrypted data

Differences between cryptography and steganography:

Crypto → information is known to exist

data is encoded such a way that only the intended recipient can read it (normally...)

Stegano → we don't know that information is hidden...

data are some times encrypted

History


- Tattooed shaved heads

- Ancient Greeks used wax-covered tablets

- More modern methods:

* George Sand & Alfred de Mussetl« Quand je mets à vos pieds un éternel hommage,lVoulez-vousqu'un instant je change de visage ?

lVous avezcapturé les sentiments d'un cœurlQue pour adorer forma le Créateur.lJe vous chéris, amour, et ma plume en délire

lCouchesur le papier ce que je n'ose dire.lAvec soin de mes vers lisez les premiers mots,

lVous saurezquel remède apporterà mes maux. »

* Invisible ink

History


- Other modern methods

World War TwoFishing freshwater bends and saltwater coasts rewards anyone feeling

stressed. Resourceful anglers usually find masterful leapers fun and admit

swordfish rank overwhelming anyday.

lBy taking the third letter in each word, the following message emerges :

Send Lawyers, Guns, and Money.

Invisible ink « decoded » with UV Lamp

Use of computers

- for images: Least Significant Bit (LSB)

- for audio data: LBE, SSE, EDH- for network data: icmp, http or dns hidden channel

Least Significant Bit – LSB (bmp, png, ...)


- Image = array of numbers that represent light intensities at

various points (pixels)

- Primary colors: Red, Green and Blue. Each primary color is

represented by 1 byte (8 bits).

- 24-bit images use 3 bytes per pixel

- If information is stored in the least significant bit (LSB) of each

byte, 3 bits can be stored in each pixel

- Image will look identical to the human eye !!!



Illustration of a pixel

LSB



Some tools

And some others...

EZ-Stego

Snow

S-Tools

Camouflage

Image Hide

DEMO !!!

Encoding secret messages in Audio (wav, mp3, ...)


LBE (Low Bit Encoding): kind of LSB for images

SSE (Spread Spectrum Encoding): we add noise (in which there will be the

message) to the original sound

EDH (Echo Data Hiding): in melodies there are often some echoes associated

to the original sound. The distance between those two sounds can be used to

hide information.

« Perception mask »: we hide a sound behind another most powerfull but with

the same intensity

Attacks


Two types of attacks

Passive attack

Attacker will try to detect the embedded message

Active attack

Attacker will try to destroy/modify the embedded message

Known carrier attack: The original cover media and stego media both are

available for analysis

Steganography only attack: only stego media is available for analysis

Known message attack: hidden message is known

Known steganography attack: cover media, stego media and steganography

tool or algorithm are known

PDF Steganography


Genesis of the idea

- PNG something other than LSB (need to know the structure)

- JPG ?

- Why not PDF ?

PNG

Lossless data compression (DEFLATE) → zlib (same as ZIP file)

DEFLATE = LZ77 + Huffman

PNG header: 89 50 4E 47 0D 0A 1A 0A (8 bytes)

Blocks = chunks

Critical chunks: IHDR, PLTE, IDAT and IEND

Ancillary chunks: tEXt, zTXt and iTXt

Chunks


IHDR (0x49484452)

must be the first chunk; it contains the image's width, height, and bit

depth

PLTE (0x504C5445) (not necessarily present, only if colour type = 3)

contains the palette; list of colors

IDAT (0x49444154)contains the image, which may be split among multiple IDAT chunks

IEND (0x49454E44)

IEND marks the image end

Chunks


IHDR (0x49484452)

must be the first chunk; it contains the image's width, height, and bit

depth

PLTE (0x504C5445) (not necessarily present, only if colour type = 3)

contains the palette; list of colors

IDAT (0x49444154)contains the image, which may be split among multiple IDAT chunks

IEND (0x49454E44)

IEND marks the image end

tEXt, zTXt and iTXt can be used to hide information (latin-1, DEFLATE, UTF-8)

because not read by decoders (because optional)

JPG and PDF


JPG:

- lossy compression (compresses data by losing some of it)

- difficult to do it and already done by some tools

PDF

- why not? We use this type of file increasingly!- what about his structure?

PDF structure


There are different structures (explicit and implicit ones)

Structure divided into 4 parts:

Header

%PDF-1.x

Body (objects)

1 0 obj % entry point

>

endobj

PDF structure


Xref table (position of the objects)xref

0 3

0000000000 65535 f

0000000010 00000 n

0000000079 00000 n

Trailertrailer

>

startxref

492

%%EOF

PDF Reader


1) reads 1st line (PDF version)

2) will go to the end (check %%EOF)

3) will go one line above (offset of xref table)

4) builds xref table in memory and see /Catalog

Start of the document

It is a tree in fact!!!

Object syntax


There are 9 types of objects:

Number: e.g. 3

Indirect reference (n r R): references an object, e.g. 5 0 R. If the objects

doesn't exist this is equivalent to the Null object (see below).Name (/Name): names are identifiers.

Dictionary (>): this is a unordered list of (Name,Object) pairs. They

are essentially hash tables.

Object syntax


There are 9 types of objects:

Number: e.g. 3

Indirect reference (n r R): references an object, e.g. 5 0 R. If the objects

doesn't exist this is equivalent to the Null object (see below).Name (/Name): names are identifiers.

Dictionary (>): this is a unordered list of (Name,Object) pairs. They

are essentially hash tables.

Array ([ x y z ... ]): an ordered list of objects, e.g. [ 0 0 200 200 ].

String Object ((text)): text.Stream (> stream ... endstream): embedded data, can be

compressed. It starts with a dictionary that describes the stream such as its

length or the encoding (/Filter) is uses.

Boolean: true or false.Null Object: null.

PDF structure


What about the updates?

DEMO!!!

How does it work?

Different types of compression filters:

ASCII 85, JPX Filter,

LZW Filter, etc.

Malicious PDF


Some bad guys are also trying to make bufferoverflows with your pdf reader!!!To take control of your PC!!!!

PDF structure


Mecanism

Hide the object in the PDF!!!

MSG

AES

Filter PDF

My tool


Conclusion


Questions?

Bibliography


Some useful links

Stegano conceptshttp://partners.adobe.com/public/developer/tips/topic_tip31.html

http://en.wikipedia.org/wiki/Steganography

http://www.slideshare.net/yprajapati/steganography-11960186

Malicious PDFhttps://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-

pdf-analysis-33443
http://partners.adobe.com/public/developer/tips/topic_tip31.htmlhttp://en.wikipedia.org/wiki/Steganographyhttp://www.slideshare.net/yprajapati/steganography-11960186http://www.slideshare.net/yprajapati/steganography-11960186http://www.slideshare.net/yprajapati/steganography-11960186https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443https://www.sans.org/reading-room/whitepapers/malicious/owned-malicious-pdf-analysis-33443

Documents

0x835 · 2013. 12. 16. · Introduction 2 SecurIMAG - Stegano –0x835 –2013/11/07 Steganography is the process of hiding one medium of communication (text, sound, image, …) within