Steganographic Research

1
Welcome!
Steganographic Research
Conducted By
Jeremy Callinan Donald Kemick III
2
Welcome!
Detecting Steganographic Content in Images Found
on the Internet Theres more than Meets the Eye
Jeremy Callinan Donald Kemick III
3
Steganography ?
Hiding messages within other messages

• Not Cryptography

• Hides the existence of the message

Ancient Greece

• Literal Meaning covered writing

• Wooden tablet covered in wax

• Tattooing messengers shaven head

4
Computer Steganography
Replace unused data areas with information

• Source Graphics, sound, text, html, floppy
  disks

• Content Plain text, cipher text, images

Why?

• Protection of intellectual rights

• Display information covertly to avoid
  observation

5
Steganography and the Internet
Storehouse of steganographic material

• Rumored terrorists communicate over web

- jpeg images were used
Our search for steg begins by

• Spidering large sites (aggregators)

• yahoo.com
• news.google.com
• msn.com
• dmoz.org

6
The Framework
7
Framework Components
Jpegger

• Java web crawler

• Multi-threaded usually 5 concurrent

• Saves Images

• MySQL Database

8
Framework Components
Stegdetect

• JSteg, JPHide, Outguess 0.13b

• Least significant bit method

• DCT Coefficients

• No hidden message

- Probability 0
9
Framework Components
Condor

• Workload management system

• Compute-intensive workloads

• Job queuing

• Policy scheduling

• Resource management

10
Framework Components
Stegbreak

• Brute-force dictionary attack

• 1,323,398 word English dictionary

• Jack the Ripper

11
Results
Jpegger Performance

• We gathered 250,000 images

• Stegdetect found 20,009 suspects !

Stegbreak

• 3.8 minutes locally

• Up to 15 minutes on grid

• Average time was 7.38 minutes

12
Limitations
Time Restraints

• Larger sample size

• Distribute Jpegger to grid

• Concurrent scanning breaking

• Retest with larger dictionary

13
Conclusions
Suspects

• 20,009 out of 250,000

• Roughly 10

• Much higher rate than previous research

Source 17KB

• high use of steganography
• skewed data
• detection methods are flawed
• use of all images sizes

Tear gas instructions
14
Conclusions
None broken

• Zero contained messages

• Dictionary wasnt sufficient