Simple Steganography: Hiding Files in Images

Steganography is the art and science of hiding information in ways that prevent the detection of hidden messages. Steganography literally means “covered writing” and is usually interpreted to mean hiding information in other information. Comparing it to cryptography, steganography has its advantage because the message itself will not attract the audiences, as the very nature of a steganography system is to hide the message in an imperceptible manner.

Using the step-by-step instructions below, we will try to hide a document file in an image file. We can hide other types of files (excel, powerpoint, text, etc) in the image file too.

Get two files. For the example below, we will name these files as Doc1 and Img1.

Document file: Doc1.docx
Image file: Img1.jpg

Step 1:
Create a new folder and put both the document and image files together in the folder.

Step 2:
Compress Doc1 using WinZip or WinRAR. Name the file as Compress1. (Note: You can compress more than one file to be hidden in the image file)

Step 3:
Open "Run" dialog box by pressing the "Windows + R" buttons and type "cmd" in the box. Click OK or press the Enter button to open the Command Prompt Window.

Step 4:

Use the "cd" command to navigate to the folder where you have kept your files. See the example below.

Step 5:

Use the command below to copy the compressed file (Compress1) to Img1.jpg.

copy /b Img1.jpg+Compress.zip Img1.jpg

We are done! We have just hidden the Compress1 file in Img1.

Step 6:

Now, how do we view the Compress1 file hidden in the Img1 file?
We have to extract the Img1 file using WinZip or WinRAR. Yes, you read it correct. We have to extract the image file to view the hidden files!

Lena.jpg - The Interesting Story of the Image

The Interesting Story of Lena.jpg

The image above is one that has been widely used in the image compression studies, even today. This actual photo is dated back to November 1972, and was actually a Playboy magazine centrefold. The same image is also commonly used as a cover/host image in the multimedia (image) security researches; ie. steganography and digital watermarking.

The interesting story of this image was published in the May 2001 article in the Newsletter of the IEEE Professional Communication Society by Jamie Hutchinson. An excerpt from the article as follows: 

Alexander Sawchuk estimates that it was in June or July of 1973 when he, then an assistant professor of electrical engineering at the USC Signal and Image Processing Institute (SIPI), along with a graduate student and the SIPI lab manager, was hurriedly searching the lab for a good image to scan for a colleague's conference paper. They had tired of their stock of usual test images, dull stuff dating back to television standards work in the early 1960s. They wanted something glossy to ensure good output dynamic range, and they wanted a human face. Just then, somebody happened to walk in with a recent issue of Playboy.

For the complete article, please click here.

Lena.jpg that is used in the researches comes with the size of 512x512 pixels (as in the grayscale image above). 

To view the full digitized original image, click here. (Warning: The image contains nudity)

Breaking a Steganography System

Breaking a Steganography System

Breaking a steganography system can be grouped into three types; detecting, extracting and disabling.

A steganography system already becomes insecure if an attacker could prove the existence of the hidden message. 

While developing a formal security model for steganography, it is then important or more precisely, is a must to assume that an attacker has unlimited computation power and is able and motivated to perform a variety of attacks.

If an attacker could not confirm that a hidden message exists, then the steganography system is theoretically secure.

Passive attacker: Detecting a secret message

The purpose here is decide whether a cover message (c) contains a hidden message or not.

This can be formally defined as a test function, f:c->{0,1}

The covers are classified as they are passed through the insecure channel. In some cases, covers will be correctly classified. In other cases, the covers will not be detected for hidden messages. This is called a type-II error of the test function.

There are also possibilities that the test  function falsely detects a hidden message in a cover which does not contain any message. This is called a type-I error.

A good steganography system tries to maximize to probability that a passive attacker makes a type-II error.

Active attacker: A need for Robust Steganography

Steganographic systems are highly sensitive to cover modifications. Even simple image processing techniques can destroy the message entirely. Some examples of modifications are like smoothing, filtering, cropping, image transformations, etc.

A lossy compression could also result in total loss of information. The nature of lossy compression techniques is to reduce the amount of information by removing the imperceptible signal components. This in turn can also cause the hidden information to be removed.

An active attacker whom could not prove or extract the existence of a secret message can simply add random noise to the transmitted cover. This is an attempt to destroy or disable the hidden information.

Some Applications of Information Hiding

Some Applications of Information Hiding


Data hiding
-To provide private secret messages

Copyright protection

-To prove ownership

Copy control (fingerprinting)

-To trace illegal copies of data, image, etc.
-To include licence agreement

Data authentication

-To disallow the viewing/editing of data if the digital content is modified

Broadcast monitoring

-To use for commercial advertisement

Copy protection

-To control copying through device or other integrity checks

Differences between Cryptography, Steganography and Digital Watermarking

Cryptography is defined as the art and science of secret writing. The word itself comes from Greek where the words kruptos (κρυπτοσ) and graphen (ϒραφην) mean secret and writing, respectively. The focus in cryptography is to protect the content of the message and to keep it secure from unintended audiences.

The purpose of cryptography is to create schemes or protocols which can still complete the intended tasks even in the presence of an adversary. Cryptography’s main task is to ensure users able to communicate securely over an insecure channel. This communication however must ensure the transmission’s privacy and authenticity. [1]

Steganography is the art and science of hiding information in ways that prevent the detection of hidden messages. Steganography literally means “covered writing” and is usually interpreted to mean hiding information in other information. Comparing it to cryptography, steganography has its advantage because the message itself will not attract the audiences, as the very nature of a steganography system is to hide the message in an imperceptible manner.

Another definition given for steganography is “hiding in plain sight”. The message is still in the open, but it goes undetected because the existence of the message itself is a secret. It is explained as a communication that takes place in open, but unless they are in the know (the sender or recipient), the message goes unnoticed. [2]

Watermarking is the process of embedding a message on a host signal.  Watermarking, as opposed to steganography, has the additional requirement of robustness against possible attacks. A watermark can be either visible or invisible.

Using digital watermarking, copyright information can be embedded into the multimedia data. This is done by using some algorithms. Information such the serial number, images or text with special significance can be embedded. The function of this information can be for copyright protection, secret communication, authenticity distinguish of data file, etc. [3]

In cryptography, the message is usually scrambled and unreadable. However, when the communication happens, it is known or noticed. Although the information is hidden in the cipher, an interception of the message can be damaging, as it still shows that there is communication between the sender and receiver. In contrast, steganography takes a different approach in hiding the evidence that even a communication is taking place.[2]

Some of the differences between steganography and watermarking are [4]:

• the information hidden by a watermarking system is always associated to the digital object to be protected or to its owner while steganographic systems just hide any information
• “robustness” criteria are also different, since steganography is mainly concerned with detection of the hidden message while watermarking concerns potential removal by a pirate
• steganographic communications are usually point-to-point (between sender and receiver) while watermarking techniques are usually one-to-many

References:

1. Coron, J.-S., What is cryptography? IEEE Security and Privacy, 2006. 4(1): p. 70-73.
2. Wiles, J. and R. Rogers, Techno Security's Guide to Managing Risks for IT Managers, Auditors, and Investigators. Security & Networking. 2007: Syngress. 1.
3. Jiang, X. Digital watermarking and its application in image copyright protection. in 2010 International Conference on Intelligent Computation Technology and Automation, ICICTA 2010, May 11, 2010 - May 12, 2010. 2010. Changsha, China: IEEE Computer Society.
4. Stefan Katzenbeisser, Fabien A. P. Petitcolas, “Information Hiding Techniques for Steganography and Digital Watermarking”, 2000, pp. 2.