“What a Digital Forensics Investigator should know about LeastSignificant Bit Steganography in Electronic Communications” DFCS H3011 – Computer & Network ForensicsMichael Hegarty Piotr Mitka B00092937Word Limit:3500Word Count:3500Due Date: 13/12/2017 Table of Contents 1.0 Introduction2.0 History of Steganography 3.0 Implementation4.0 Steganography in text5.0 Method Based on Format6.
0 Types of Steganography7.0 Steganography in the picture8.0 Steganography in the Audio9.0 The Technique of coding Bit10.
0 Spectrum Distribution method11.0 Echo hiding12.0 Video Steganography 13.0 Network Steganography 14.
0 LSB Technique15.0 LSB 16.0 Technique basics17.0 Data Rate18.
0 Robustness19.0 The LSB algorithm20.0 Conclusion21.0 References History of SteganographyHistory of Steganography goes back and is old as much ashistory of writing. Steganography has been used in different forms. The wordSteganography comes from two Greek words: 1 “Steganos” meaning “covered,concealed, or protected” and “Graphein” meaning “writing”. One of the exampleshappened during world war II.
Steganography experienced a real boom duringWorld War II. In December 1940 one of the inspectors came up with suspiciouslooking letter signed “Joe K”. Attention returned to him from seeing unusualexpressions for example the word “cannon” was used instead of “gun”. Thisletter was subject thorough analysis and chemists who applied iodine vapor totest for a hidden message. On the back of the letter there was a secret letter.They have captured the guy that was sending letters with more letterscontacting different information’s, list of ships at the time in New York, thenumber of British Soldiers sent to Iceland etc. This letter was written withpiramidonu, which is a powder used as a cure for headache and available in mostdrugstores.
So even looking back at theHistory we can see that Steganography was used way before, and it is still usedto this day.IntroductionTo understand Steganography, we need to know what happens,Steganography allows to cover or hide message in a file, unlike encryption,only the sender and receiver know a communication exists. The existence ishidden from a third party. In This research paper I would like to discussimportance of “What a Digital Forensics Investigator should know about LeastSignificant Bit Steganography in Electronic Communications”. We will dive ininto implementation and tools that can be used for steganography.An example of a steganography in a text would be like thisWhere every single letter makes up a new sentence.
Implementation We can hide messages and different information in differentfiles or data types. We have an equation for the steganography implementationwhich iscovering medium + data to be hidden + steganographic key= steganographic message Steganographyin textSteganography in documents focuses only on changing some ofits characteristics. This may include text features, and even the textformatting. Hiding information in plain text can be done in many ways. One wayis to simply add a white space and tabs to the end of the line of the document.The last technique was successfully applied in practice, and even after thewagering requirement of printing and copying the text, the secret message couldbe further recovered, setting the background colour and font colour is one ofthe most widely used approaches in steganography. This method focuses inMicrosoft word documents.
Select the colour of the font and background coloursetting, invisible characters, such as space, add, undo. MethodBased on FormatThis type of method physically hides the text. Entering aspace, intentionally misspell words and use different font sizes is a populartechnique based on formatting Types ofSteganographySteganographyin the pictureDigital images are most commonly used objects toSteganography. Due to the availability of a variety of a file formats forvarious applications of the algorithm used for these formats is differentrespectively. It is considered also as aset of bytes that contains the different light intensity in the different areasof the image. In the case of digital images are typical 8 and 24-bit pixelimage files. Both have advantages and disadvantages of the 8-bit images are theperfect file extension to be used due to their relatively small size. Thedisadvantage is that it can be applied to 256 possible colours, which can be apotential problem when encoding.
Several types of Steganography in images are:1. The least significant bit2. Inserted masking and filtering3.
Redundant encoding model 1. Inserting leastsignificant bit (LSB) is the most famous image steganography Algorithm. In thistechnique, the message is saved in the LSB pixels, which can be considered asrandom noise. Therefore, change does not have any obvious effect on the image.
2.Masking and filtering techniques work better at 24-bitimages and grayscale images. Hiding information in a manner like a watermark ona real paper are sometimes used as digital watermarks3. Redundant encoding is to some extent like the techniqueof distributed spectrum. In This technique, the message is scattered around theimage based on the algorithm.
This technique makes the image ineffective forcutting and rotating. Steganographyin the AudioHiding information in AVI works on the same principle as inimages, with the difference that we can encrypt a lot more information. We mustnote, however that the use of any compression can destroy part or all thehidden information. TheTechnique of coding BitParity Bit or Checkpoint Bit is a bid added to the binarycode, to ensure that the total number of 1-bits in the chain is even or odd.Parity bits can be used as the easiest format of error-finding code.
You can have two alternatives of parity bits, even and odd. Evenparity for a given set of bits are calculated examples of bits whose rate is 1.If this number is odd, the value of the parity bit is set to 1, which causesthe total number of instances 1 the entire collection (including beating party)is an even number. If the number of 1 in each set of bits is even, the value ofthe parity bit is 0. SpectrumDistribution methodSecret message is sent across the frequency spectrum of theaudio signal. In this technique, the secret message bits are randomly assignedan audio stream Direct sequence spectrum is a method in which the secretmessage is distributed based on frequency chips and controlled by a randomnumber and attached to the signal coverage. EchohidingEcho technique is added to a discrete signal.
This type ofmethod is also reliable and provides high speed data transmission. Because thebits are coded one by one, the original signal is broken into blocks, encodedwith secret bits and are combined. The echo signals are placed according totheir values. The value of a binary signal offset of 1 will contain only thedigits 1, and signals from the binary correction equal to 0 will contain onlythe number 0. VideoSteganography This technique is for hiding all kinds of files to transferthe video file. The separation of sound and video images or result in an effectivemethod for hiding data.
The use of video as a medium for Steganography is moresuitable when compare to other techniques, due to the size and memoryrequirements for video is very similar to the images. However, there is muchdifference between hiding data in pictures and video. One of the differences isthe size of the media.
Because video provides higher capacity than the photo,more secret messages can be embedded in a video file. NetworkSteganography There are three main basic functions when it comes tonetwork steganography, services, applications, transport information andcontrol the flow of information. In traditional networks PSTN ISDN, circuitswitched data network, services, applications are generally provided by thenetwork transport is done through transparent channels, and control functionsand transport are virtually segregated. When the connection from end to end andthe transport channel information voice or data are sent over the networkwithout interference, User has little effect on the services provided by thenetwork and does not affect the flow of information. The internet, Packetswitched network, significantly changed the traditional paradigm of circuitswitched data network. Services applications are created by the users of thenetwork, and not by the same network and the transport and control functionsare not separated and you can affect them by the user.LSBTechniqueIn this technique, each binary sequence audio file isreplaced with the equivalent sequence of binary secret messages. To implement,analogue audio signals must be converted into digital binary.
The advantage ofthis technique is very high throughput of water channel. LSB Digital data is calculated in binary format, and likewiseto mathematical representation, the right number is considered the lowest digitwhere the left is considered the maximum digit. Due to the positional representation,the least significant bit is called the rightmost bit. Least significant bit isthe opposite of the most significant bit, which transmits the highest rate in amultiple-bit binary number which is farthest to the. In a multi-bit binarynumber, the implication of a bit cuts as it comes closer to the leastsignificant bit. Because it is binary, the most significant bit can be either 1or 0. When we aretrying to get a transmission of binary data it is done with the leastsignificant bit first technique, the least significant bit is the one which istransmitted first, followed by other bits of increasing worth.
The leastsignificant bit is often active in hash functions, checksums and pseudorandomnumber generators. LSB is the lowest bit in a series of numbers inbinary. e.g. in the binary number: 10110001, the least significant bit is farright 1.
The LSB based Steganography is one of the steganographic methods, usedto embed the secret data in to the least significant bits of the pixel valuesin a cover image. e.g.
240 can be hidden in the first eight bytes of threepixels in a 24-bit image.Pixels 00100111 11101001 11001000 00100111 1100100011101001 11001000 00100111 11101001Here if we want to hide 240 in a digital imagethe first step is to convert 240 into a binary number that is 011110000 thenthis 9-bit data is replaced by each least significant bit of the pixels of theimage.Results00100110 11101001 11001001 00100111 1100100111101000 11001000 00100110 11101000TechniquebasicsNowadays, when we try to convert an analog imageto digital format, we have three different ways of representing colors 24-bitcolors are represented with every pixel that have one in 2^24 colors, and theyare represented by: red (R), green (G), blue (B), given by 8 bits in 256 valuesExamples:The letter ‘A’ has an ASCII code of 65(decimal),which is 1000001 in binary. It will need three consecutive pixels for a 24-bitimage to store an ‘A’: Let’s say that the pixels before the insertion are:10000000.10100100.10110101,10110101.11110011.
10110111, 11100111.10110011.00110011Then their values after the insertion of an ‘A’will be:10000001.10100100.10110100,10110100.11110010.
10110110, 11100110.10110011.00110011The same example for an 8-bit image would haveneeded 8 pixels:10000000, 10100100, 10110101, 10110101, 11110011,10110111, 11100111, 10110011Then their values after the insertion of an ‘A’would have been:10000001, 10100100, 10110100, 10110100, 11110010,10110110, 11100110, 10110011From these examples we can infer that 1-LSBinsertion usually has a 50% chance to change a LSB every 8 bits, thus addingvery little noise to the original picture. For 24-bit images the alteration canbe prolonged occasionally to the second or even the third LSBs without being noticeable.8-bit images as an alternative have extra limited space where to pick colors,so it’s likely to change only the LSBs without the adjustment being visible.Data RateEasiest method of LSBs insertion for 24-bitpictures is to insert 3 bits for every pixel. As we know every single pixel is24 bits, so it is possible to hide 3 bits in 24 data pixels, so it is 1 in 8th,so what happens is that we hide 1 bit of hidden message for every 8 bits of thecover image.
So, by adding another insertion to include another LeastSignificant bit our formula will change and there will be 6 hidden bits in 24data pixels, so it would be 2 in 8th and we will be able to hide 2bits of the message for every 8 bits of the cover image. So, going down thisroad we can add a third insertion, so this time we end up with 9 hidden bits in24 data pixels, so it works out 3 in 8th bits and we manage toacquire a rate of 3 embedded bits in 8 bits of the image. Our rate forinsertion in 8-bit images is like one Least significant insertion in 24-bitimages, or in one embedded bit every eight bits. Problem we need to askourselves is how many cover bytes do we need to have to send an embedded byte.So, following our examples for one least significant bit in 24 bit-image or in8-bit the value will be 8 divided by 1 multiply by 8 which is 8 byes, for twoLSB’s insertions in 24-bit picture would be 8 divided 2 multiply by 8 which is4 bytes, and for three least significant bits is 8 divided by 3 multiply by 8which works out roughly to 21.33 bytes. RobustnessLeast Significant bit insertion is weak to a lotof alterations, even the ones that are meaningless and common ones. Lossycompression, which works on JPEG can destroy it completely.
What’s most trickyabout it is the “holes” in the Human Visual System that least significant bitinsertion wants to exploit it, adding bit of sensitivity to added noise workssame as lossy compression algorithms that rely to reduce data rate of theimages. Moving onto geometrical transformations, we need to take the pixels andscatter them around from the original grid, to destroy the embedded message,and one that lets you recover is a simple translation. Doing a differentpicture transformation for example blurring or other effects will most likelydestroy the hidden data. Least significant bit insertion is very tiny robusttechnique for data hiding. It is easy to detect it or extract it.
You don’thave any theoretic outstanding mark of least significant bit insertion, onlything that will be noticeable is little increase of background noise. It isvery simple to take least significant bit and extract it using differentprograms that are widely available on internet, and be able to check if theyhave something hidden or not. We can then check if its suitable forsteganography or watermarking, this is very vulnerable technique forprocessing, least significant bit insertion is unusable for digital marketingbecause it must face malevolent attempts at its own destruction, and on top ofthat normal transformations which are compression or decompression or trying toconverse it to analog or conversion to digital. Moderately high data rate canshow as a good technique for steganography, where robustness its not importantrestriction at all.
We have different problems and possible answers for least significantbit insertion, the biggest major drawback that LSB has it’s the ease ofextraction, we can’t allow hackers to easily just read what we are trying tosend. So, if we want to keep this between the sender and receiver we need toadd some techniques, encrypt the message so whoever needs to read need todecrypt the message before it will make any sense to help us do thatrandomizing the bits around using a function that is scattering will make itnearly impossible to reconstruct the message without knowing what original seedfor the random function is. By doing this our file or message we are trying tosend is protected by two diverse keys, getting more privacy than before. This method helps to protect the integrity ofthe message, from counterfeiting the message by third parties, but we don’twant for our file to be encrypted and scrambled for the other person, so weneed to go back what we wanted to do at the start hide the message, so we cancommunicate without others knowing. Two problems we have is we need to knowwhat choice of image format we want 24 bits or 8 bits and if we want itcompressed it or not. We need to make a cover image casual, so it needs to besomething that would be interested of both sender and receiver something thatlooks like a normal image. Then we need to make sure that it has differentcolours, it must be “noisy”, so when we add a noise it will be covered by theone that is already there.
Different solid colours areas will magnify theamount of noise added to it. Second problem we might have will be the filesize, so we need to pick the right format, because if the file will be too bigit can lead to people thinking something is going on, arise suspicion that thisfile is not what it is. So we need to calculate what is the common size for apicture on internet, with different colours, so lets take a 24-bit color whichwas 150,000 pixels multiply this by 24 pixel and divide by 8 bits which is90,000bytes which is 440KB, same thing with 8-bit color or grayscale we do150,000 pixels multiply by 8 divide by 8 which is 150,000 which equals to146KB. So, by looking at these sizes we know that 24-bit uncompressed pictureis not a regular size, and it is strange that sender wouldn’t compress theimage.
Because it’s a practice that is used a lot and it doesn’t worsened thequality of the image nearly at all. So, what we need to do is to modify theJPEG algorithm that inserts least significant bit into the lossless stages orrounding of constants of the DCT that allows to compress the image to encodethe bits. We need small image file sizes, we should resort in the 8-bit imageif we want to use LSB communication technique, because their size will looklike its normal.
Another tricky part with 256 colours images is that they useindexed palette, and trying to change the least significant bit we need to swapa pixel from a position to an adjacent one. So, when we get adjacentcontrasting colours, it can lead to that pixel changing the colour andrevealing the hidden message. To overcome this problem we have differentmethods, one of them is rearranging the palette so the adjacent colours don’tcover each other. But it is advisable to use the 8-bit grayscale images, as itis hard for human eye to detect any changes. THE LSBALGORITHM The most common and popular method of modern day steganography is to make useof LSB of pictures’ pixel information This technique works best when the fireis longer than the message file and if image is grayscale When applying LSB techniques to each byte of24 bit image three bits can be encodedinto each pixel If the LSB of the pixel value of cover image C(i,j) is equal toto the message bit SM of secret message to be embedded , C (i,j) remainunchanged; if not ,set the LSB of C (i,j) to SMmessage embedded procedure is given below:S(i,j) = C(i,j) – 1 if LSB (C(i,j)) = 1 and SM = oS(i,j) = C(i,j) – 1 if LSB (C(i,j)) = o and SM = 1S(I,j) = C(i,j) if LSB (C(i,j)) = SM Where LSB (C(i,j)) stands for the LSB of cover image C(i,j) and ,,SM” is thenext message bit to be embedded. S(i,j) is the stego image. CONCLUSION In this research paper we have examined differenttypes of steganography but mostly the LSB which stands for least significantbit, we have discussed how its done with examples, different tools that can beused and how does it work.
Hiding a message with stereography methods reducesthe chance of a message being detected. In and of itself steganography is not agood solution to secrecy, but neither is simple substitution and short blockpermutation for encryption. But if these methods are combined you have muchstronger encryption routines.