Russian Spies Hid Secret Codes in Online Photos
news.yahoo.com
news.yahoo.com
Heck, it was on Law and Order last year: http://allthingslawandorder.blogspot.com/2009/10/law-order-s...
It's really not that much of a win.
stegdetect is jpeg-only (yes, LSB steganography on raw audio/video is really, really lame, but it's really easy, too) and it really depends on the input media. Using stegdetect itself on the sender's side with various source media makes it easy to avoid detection in-transit.
Plus, any statistical analysis tool is only useful for long messages (higher signal:noise ratios). If you're sending one-liners in a 2MB photo, for all intents and purposes, the original photo hasn't been modified and is really difficult to catch.
I was overly terse in dismissing steg; I didn't really provide a rationale for my comment. But I expect you'll agree with me anyways. Image steganography is a pet trick. Given the constraints of a meaningful image file, it's unlikely you're going to come up with a technique for encoding a covert channel that will be truly hard to spot.
Meanwhile, it's a lot of added effort for a very minimal theoretical gain (and a very likely severe practical loss) in operational security.
(and I'm working on a steganography technique, not steganalysis - if I can get my act together and focus some, I'll be submitting it to a security conference in next month... I hope :)
copy /b IMG_0010.JPG + SecretCodes.rar PartysAreFunLOL.jpgThe article says this is the first time it's actually known to have been used for nefarious purposes. That doesn't exclude prior usage for fun and experimentation, or even for practical purposes (say, wartime or corporate communications).
The accused spies posted the seemingly mundane photos on publicly accessible websites, but then extracted coded messages from the computer data of the pictures, according to the criminal complaint filed by the FBI. Although computer scientists have theorized about the existence of this communication technique for over a decade, this is the first publicly acknowledged use of the technique.
"There have been occasional claims in the press about al Qaeda using it, but never with any evidence or even attributed to specific government officials," said Steven Bellovin, a professor in the Columbia University department of computer science. "Here, we have court papers filed by the FBI under penalty of perjury that says these folks were doing it. The threat, in other words, is no longer hypothetical."
Therefore the cryptography does not seem to have been the weak link. (In truth, it seldom is.)
Were I russia, and if these are their spies, I don't think I'd be too sad to lose that pair.
My brother is named Aaron. First I think of a memorable sentence about him. "Aaron got me to take money from a wishing well when I was 8." OK, that's memorable to me and not many people know that story. Now I'll just take first letters and make a few obvious substitutions. "Agm2t$fWW@8"
That's 11 characters. It includes capitals, small letters, numbers and punctuation. It would be easy for me to remember. And would be a pretty hard password to break. If they had passwords like that, I doubt that the FBI would have ever broken into the program. (Though there must have been some other reason to be suspicious.)
(For the record I just made that up. It has no relation to any password I have ever used.)
It is counter-intuitive, but frequently making security more convenient makes it more likely to happen, which improves security. Conversely measures that should increase security cause users to work around the annoyance, which reduces security.
(For instance in this case the users could just leave a session running.)
I touch type at about 60 wpm. (Where your top is depends on your coordination, but for lots of people that is about the top.) Therefore it takes 5-6 seconds to type in an 11 word password. By contrast a frequently typed 11 character password typed from muscle memory takes no more than a second or two. That's substantially faster.
In fact even when I'm still learning the password, I type it faster than I can type the original sentence.
But there is no shortage of popular sites that will let you post innocuous seeming files unchanged that could serve this purpose. So that is not a problem.
Incidentally any form of encryption becomes even harder to break if you compress the message first. Furthermore this results in a shorter encrypted message, which is easier to hide. So the correct strategy is always compress, then encrypt, then encode.
It's true in general that shorter messages are harder for an attacker to decrypt.
http://en.wikipedia.org/wiki/Unicity_distance
It's not really significant in this case, though. The password was written on a slip of paper.
What's more, if you encrypt by using, say, ZIP, then the resulting file will have a known header, and that makes it tremendously easier to decrypt.
I've read that one of the factors that led to breaking Enigma was that Germans would habitually end their messages with "Heil Hitler". By assuming that was the ending of most messages, the mathematicians were able to work backward to find the key.
When space isn't a constraint, it's fairly easy to greatly reduce the advantage a known plaintext block gives an attacker by using random padding. Now instead of having to try every key looking for your zip header from offset 0, they have N places to start. There are techniques to mitigate this problem as well, but it's much more of a hassle. In any case, SOME simple compression is generally the order of the day with stenography message passing; you only get a few bits per pixel (usually not even a byte per pixel) so space becomes a premium.
Perhaps known-plaintext attacks are how the FBI managed to produce an example of a message with hidden data in it. To me, it seems like such a thing would be very difficult to prove. Anyone with sufficient sophistication to carry out such an attack probably has the sophistication to hide their ability to do it (via, say, hidden truecrypt volumes as workspaces). Because the FBI & DHS has leveled some pretty absurd allegations at suspected terrorists in the past, including random doodles being secret attack plans, simple home movies being terrorist scouting videos (“Do you see the way the camera flicked towards that trash can? That's signaling the terrorists that this trashcan is a good place for a bomb.”), and innocuous phone conversations being elaborate code systems. In all cases, the DHS and FBI experts swore that only someone hyper-trained could ever detect the hidden messages; a normal person could not even if they were told it was there. It was BS, of course, but people can be so afraid of terrorism that they're too scared not to give that kind of argument credibility.
But that said, techniques for breaking encryption rely on identifying redundant information in a message. The less redundant information there is, the harder this is to do. Sure, the known header on a ZIP is useful redundancy. But the amount of introduced redundancy is much, much less than the redundancy you got rid of by moving from a document in English to binary gibberish.
Underlying this is a fundamental fact of information theory, which is that messages with a high information density look like white noise. A slight mistake in the message you have results in something that looks like another potentially valid message rather than something that is obviously wrong. This makes it much harder to verify that you're on an intermediate step towards properly decrypting the message.
Therefore increasing information density makes an attacker's life harder. Compression increases information density by a lot, and so makes the encryption harder to break.
A well-encrypted message -- whether pre-compressed or not -- is indistinguishable from noise. If it was not pre-compressed, then its information density is lower, which means the S/N is lower. Information theory tells us that the worse the S/N, the harder it is to extract the information.
You are correct that a perfectly encrypted message is indistinguishable from noise. Decryption is the art of distinguishing imperfectly encrypted messages from noise. Anything that makes the message harder to distinguish, makes decryption harder. Which means that the more the message looks like noise, the harder it is to decrypt.
Your attempted counter argument fails on the fact that a redundant message has very little noise, and therefore has a high S/N despite having not that much signal per bit. However that said, it is true that if you take a redundant message, remove some redundancy by adding some random noise to it, then encrypt it, the result will be harder to decrypt than if you just encrypted the original redundant message. Of course the fundamental reason behind that is that detecting redundant information is at the heart of decryption.
In that light it is interesting to compare the two known perfect encryption mechanisms. The first is the one-time pad. In that case the transmitted message has absolutely no redundancy because the definition of the encryption method contains as much information as the transmitted message. The second is for the two end points to have a list of pre-agreed messages of equal likelyhood, which they will refer to in binary code. This offers perfect compression with absolutely no redundancy, and therefore the attacker again has absolutely no way to guess what the pre-encoded messages are. (This is much harder to do properly in practice than one time pads, which themselves are pretty tricky.)
- stego the messages locally in photos
- upload photos to a small photo sharing site set up by the agency
- use a secure erase program on the photos
A challenge: can one use a scheme like this to also refuse government counter-spies' access to incoming messages?
But if you can hide communications in photos stored on, say, flickr, then nobody knows that communication between individuals is occurring. And because the images are publicly available, even when the authorities figure out what was happening and look into server logs, there's going to be a lot of noise in there, so they probably won't be able to say exactly who was receiving the messages.
(I suppose if there are many messages, they could do some cross-correlation between them, but I also suppose that savvy bad guys would expect that and take measures to make that noisy as well.)
Once a fact of agent's communication is established, the encryption doesn't matter all that much. It's only a matter of time for beating the keys out of you (ok we know FBI doesn't do that anymore).
This Yahoo post is not far away from one.