Welcome back!
Now that you have enough knowledge about how steganography works.
Let's get started with the practical part.
I'll show you a tool called steghide which is the steganography program that is able to hide the
data in various types of image and audio files like jpg, bmp, wav and au file formats. Steghide
uses a graph theoretic approach to steganography and can be installed on Linux, Windows or Mac
OS. On Kali Linux or any other debian based distribution
you can simply install steghide by executing apt install steghide.
Okay!
It was installed!
We notice that it has a lot of options.
In this example img.jpg will be the cover file and julius_ caesar.txt
the embedded file. I want to embed or to hide this txt file in the jpg image. At first
the secret data is compressed and encrypted.
Then a sequence of positions of pixels in the cover file is created based on a pseudo random number
generator initialized with the passphrase.
The secret data will be embedded in the pixels at the those positions.
If those positions do not need to be changed because they already contain the correct value by chance
are sorted out. For audio files
the algorithm is the same except that audio samples are used instead of pixels. By default encryption
algorithm is advanced encryption standard which is an extremely strong encryption algorithm. If you want
to dive deep or into how a steghide works read its man page; this is its man page! You'll find here a lot
of the information. For the following example I have as a cover file the same picture you've already
seen in the previous lecture. I took it by myself using my phone. Inside this picture I'll embed the
tragedy of Julius Caesar by William Shakespeare.
I've downloaded it from the Gutenberg Project as a text file. This is the Shakespeare's play. I recommend
you to have both files in the same directory, the directory where you'll execute steghide. I have
them in the home directory of Kali user in another director recalled Spago. In the steganography process
the cover file will be changed so I'll make a copy of it. I want to have the original as well.
So cp, the file and the copy will be named img_original.
Now both images are the same and we can always check these by calculating their hashes, like this.
It's the same hash so the files have the same contents. Let's see what's the capacity of the carrier file,
the cover fight.
Steghide info img.jpg and we see its capacity, almost 140 kilobytes. Let's embed the
secret file into the cover file: steghide embed -cf from cover file and the cover file -
ef from embedded file and the embedded file and that's all; I am hitting enter. Now it's asking for a passphrase.
Always use a strong password of at least 12 random characters or if you use a passphrase use at least
six or seven random words.
Okay, it's done! The secret file was embedded! Now let's open
both images.
This is the modified image,
the one that contains the secret and this one is the original file.
I'm switching between them.
They look the same to the naked eye.
How could someone detect that there is a secret message
hidden in such a file?
The easiest way is to compare the stego file, the file that contains the message to the original file
using a hash algorithm. There are changed bits in the stago file so its hash will be different.
Let's see their hashes!
And it's different.
We notice that the hashes of these two files are different so that means the files are different.
But if it's so simple to detect the existence of a hidden message what's the purpose of steganography
after all?
In this example I have created a copy of the original image on purpose, to make my point and show you
this. But in a real world steganography use case you should always use unique images.
There should be no original image that someone can compare the stego file to. Any image that is taken
using a digital camera is theoretically unique.
You cannot take the same image again.
There will be a small difference in light colors and so on.
Or a print screen could be also unique! Being unique means that there is no other image to compare to.
And we've solved the problem.
The second way someone can detect that a file contains a secret
image is by using Steganalysis. Steganalysis is the study of detecting hidden messages using
steganography.
This is analogous to Cryptanalyses applied to cryptography.
The problem is generally handled with statistical analyses.
In practice however it's extremely complicated to break steganography. Let's move on and try to extract
the secret file in the current working directory
there is also the original file I have embedded.
I'm gonna rename it so it won't be overwritten in the extraction process.
Perfect and I'm extracting the embedded file: steghide extract - sf from stago file and the
name of the stago file img.jpg. It's asking for the same passphrase
and the file was extracted. Let's see if it's the same file.
Okay, it seems it's the tragical play of William Shakespeare.
I want to be 100% sure that the file was extracted entirely so I'm checking the hash of both
files.
And it's the same hash and that means it's the same file.
OK that's all about the staghide and steganography.
Thank you!