Show HN: SpeakingJpg – Hide encrypted text messages inside jpeg images | Hacker News Reader

Show HN: SpeakingJpg – Hide encrypted text messages inside jpeg images

github.com

34 pointswolframhempel20 comments

I think they are sticking the encrypted message into a jpeg metadata field?

I've been thinking for a while that a subtler version of this -- where the encrypted message is overlayed into the picture data -- would be very hard to detect.

I'm thinking down a path where using strong encryption would be illegal and all communications are monitored, so hiding the fact that an encrypted message even exists is important.

The idea is that the encrypted signal would be essentially indistinguishable from random noise so as long as the message isn't very dense relative to the picture it would be hard to determine it was even there. Also, people naturally and normally send all kinds of inane pictures back and forth so it seems like it would be hard to even infer the existence of an encrypted conversation from data sharing patterns.

>where the encrypted message is overlayed into the picture data

You can play around with this idea using imagemagick.

It has a built it "stegano" option to hide one image within another: http://www.imagemagick.org/Usage/transform/#stegano

And, as long you're using a lossless format, it's trivial to encode arbitrary data with imagemagick. You do have to calculate the size beforehand, 14 bytes as a 7x2 image in this example:

  $ echo -n "this is a test" | convert -size 7x2 -depth 8 GRAY:- output.png
  $ convert output.png GRAY:-
 this is a test

So, you create the png with your data (encrypted first if you want), then use the IM stegano option to embed the noisy png into a larger image so it's not so obvious.

Indeed, yes. That is exactly what I expected to find here. Encode the message in high-frequency image components. I think the challenge is making that robust against image manipulation, so perhaps add some kind of LDPC code for forward error correction.

The keyword you're looking for is "Steganography". See, for example, https://stackoverflow.com/questions/20863721/image-steganogr....

This is what I remember and it was a really classic example even in Schneiers book. But yeah easy overlay method was just picking a picture with the number of pixels >= number of encrypted message bits.

Make the LSB of each pixel equal to a bit value of the message. EZPZ lemon squeezy and it doesn't affect the image visually. If your message was encrypted well then also the bits would appear randomly so no one would be able to be certain a message was contained as you said.

You was probably thinking about this: http://steghide.sourceforge.net/

It hides data in the least significant bits (at locations defined by a passphrase) of the image or audio data itself. This doesn't survive re-compression, though (there are methods that do).

Agreed, though that would require a lossless format (e.g. png) and would limit exchanges to sources that don't change the image (e.g.as email attachment) but not social networks that resize or otherwise reprocess the image

You don't have to use a lossless format for steganography, for example:

'Statistically Undetectable JPEG Steganography: Dead Ends, Challenges, and Opportunities'

http://dde.binghamton.edu/tomas/pdfs/Pev07-ACM.pdf

https://en.wikipedia.org/wiki/Steganography

I remember being told that Al-Qaeda used this mechanism to exchange messages pre-9/11. Surely there are longer established tools for this?

Edit: https://www.openstego.com/

> I remember being told that Al-Qaeda used this mechanism to exchange messages

I don't think that was ever confirmed. Niels Provos and Peter Honeyman went looking for stego content "in the wild", examining over 2 million images, which was a lot at the time. Their search came up empty.

http://www.citi.umich.edu/u/provos/papers/detecting.pdf

Edit: Apparently they did find one image, created as a demonstration for the ABC News story. http://www.citi.umich.edu/u/provos/stego/abc.html

Cool, but it appears to embed in a jpeg comment section with a predictable constant that marks what it is. So fun to play with, but not terribly covert.

true - would make sense to make the identifier configurable and/or just iterate trough all comments in the jpg

Really cool! I actually read about this idea years ago in a book (Dean Koontz, The Husband iirc). Ever since then I've wondered why it isn't more common to try to obscure messages through normal means.

I guess the data formats are too inefficient in most scenarios. Eg, encoding bytes as words is insanely inefficient, but somehow encoding them in such a way that they make grammatical sense as to not seem "off" - I imagine would be nearly impossible and/or crazy inefficient.

Double that with trying to encrypt your encoded bytes, such that if they were discovered, the encoded bytes wouldn't be blatantly obvious. That's... a lot of damn data haha.

Nice, I haven't looked at the code yet, but I'm curious what the 65k limit is due to?

I was just thinking though, if you're using the meta data field, couldn't that make it obvious data is hidden?

I wrote a little program a while ago to send data, by changing the intervals between packets:

https://www.anfractuosity.com/projects/timeshifter/

The data is going in an APPn jpeg metadata block (jpg "comment"), max size of 65k. You could use multiple comment blocks, but this doesn't implement that.

Having text in the comment section does not seem very useful as most online services will resize the image and very likely strip comments (as mentioned in the readme).

A suggestion: would svg not be better ? That is a lossless format in xml format. An image could have lots of details in a very small section, actually composed of readable text that is (in some way) turned into xml. The svg in total has to be valid though.

An interesting experiment would be to sent pictures of airports to eachother using this tool to send meaningless messages to different parties and see how good the authorities actually is in detecting it.

Anyone?

This reminds me of DesuDesuTalk used for embedding text into images posted to imageboards.

There are techniques in Chinese articles supported by CPC on the topic of detecting steganography and decrypting it. Tampering a file will leave prints that aren't normal, and that could be found. So steganography maybe isn't a good idea at all.

Surely you're no worse off sending any content steganographically compared to in the clear?

Worst case, they find it, and you're in the same position as you would be if you sent it without steganography.

Reply on news.ycombinator.com