First Steganographic Image Found In The Wild

Niels Provos writes: "After months of searching for steganographic content on eBay and elsewhere -- downloading millions of images, we were finally able to find an image with a stegangraphic message hidden in it. Stegdetect and Stegbreak made short process with it. It took less than a second to compute the secret key necessary to extract the hidden message. Two commands at the prompt, and we found the hidden message to be an image of B-52 scrapyard. Right off Terraserver."

Yeah, except for...

[Anonymous Coward]

What about the Evil Bert picture? We didn't seem to have the flood of Anthrax here in the U.S. until after that poster came out.

Hidden message?

Hidden like a fox!

Not exactly "in the wild"

[wiredog]

It was shown on ABC news during a discussion of, guess what, steganography. The key was "abc". The person who created it said that it had a message hidden in it. An image "in the wild" would be one that was found at images. [slashdot.org] that wasn't known beforehand to have steganographic content.

Preview is my friend

[wiredog]

images. [google.com]

Is this really in the wild?

[Araneas]

So what we have, is an image prepare by ABC as a demonstation of how this type of steganography works. This strikes me more as an image found in the lab rather than the wild.

What I would like to see is a truly wild image culled from the net. Unfortunately, it probably would be kiddie porn.....

Still, the test is interesting.

Re:Not exactly "in the wild"

[sulli]

Right, but it was a good demonstration that their steganography detection tools work.

Re:How do I create Steganographic Files?

[kptBlaha]

Just type "steganography" to Google or Altavista.

Re:Not a very good algorithm / implementation

[cs668]

That is the problem. Sometimes stego can be detected because it is more random than the surrounding data.

If you have an image and you store the encrypted message in the low order bits of the image then they will look too random when compared to typical images.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Dont use naive implementations

[Anonymous Coward]

You can use spread spectrum techniques, you dont have to use the LSB. If an image has any uncorrelated noise at all you can always make sure the signal strength of your encrypted message is below the level of that noise ... and if the encryption algorithm can produce a sequence indistuingishable from noise if you dont know the key ...

Detection Methods

[Keeper ofthe Keys]

Many are beginning to discredit the detection of steganographic images in the wild without learning the actual methods of detection!

While it is very easy to change an algorithm by byte offset, this is NOT the method of detection being used.

The method of detection exploits the characteristics of the JPEG compression algorithm to detect non-naturally occuring deviations in the image file. An example of this would be the gamma balance which is averaged over a certain number of pixels. In order to "hide" a change to a single bit, another bit would need to be inversely modified such that the balance of the image remains within or close to natural balance.

Re:Not a very good algorithm / implementation

[Tom7]

I think it takes more than half a brain. Some of those statistical stega ("stego"?) detectors are pretty clever, and I would imagine that my first try would be caught. I think you'd need to at least sit down and do statistical analysis in order to write a successful tool.

Before you berate the clueless programmers, let's see your solution...

Re:Matter of opinion of course,

[almightyjustin]

Umm...I don't think eBay actually hosts any images other than basic layout stuff. All the auction images are linked from other providers.

Re:Yeah, except for...

[Anonymous Coward]

thankyou.

did anyone see the channel 4 news (UK) the other day, after the images of a flattened village?
robin cook was interviewed, and when asked about civilian casualties replied "we have to remember that 7000 innocent civilians were killed by the terrorists".

Think about it. The people in that village weren't terrorists. I'm glad to say that john snow (the interviewer) picked up on this and asked him "so what are the plans when the civillian casualties in afganistan reaches 7000", to which made mr cook squirm..

On another note, if you can, i advise watching the "langdon behind the lines" (i think that was what it was called) series on afganistan which was shown on bbc 2 - made well before the sept 11 events, and very interesting indeed. it gave a real insight into the lives of people living in afganistan.

jeffcapeshop