Hiding Data in Data

Cryptography—the science of writing messages in secret code—addresses all the elements necessary for secure communication over an insecure communications medium: namely, privacy, confidentiality, key exchange, authentication, and nonrepudiation. However, cryptography doesn't always provide safe communication.

Consider an environment in which the use of encrypted messages causes suspicion. If a nefarious government or an ISP is looking for encrypted messages, it can easily find them because encrypted data sticks out like a sore thumb. For example, Figure 1, page 38, contains text that's encrypted with Pretty Good Privacy (PGP), a popular email-encryption program. The government or ISP would easily spot this encrypted message because it's nonsensical to casual readers. In addition, the characters that make up the message appear at random and don't adhere to the relative frequency counts that you'd expect in a plaintext message (i.e., a large number of the more commonly used letters of e, t, o, and a, and a small number of the less commonly used letters of q, w, and z).

Steganography is the science of hiding information. The goal of cryptography is to make data unreadable by third parties, whereas the goal of steganography is to hide the data from third parties. Although many different steganographic methods are available, the basic process is the same. Let's look at the various steganographic methods, the steganographic process, and how to hide data manually and with an automated program.

Steganographic Methods
If you've watched a lot of spy movies, you're probably familiar with such steganographic methods as using invisible ink, embedding hidden messages within text, and using microdots. (The sidebar "Other Forms of Steganography" details some of these methods.) With computers and networks, you can hide information many other ways, including the following:

• You can hide files in plain sight. For example, you can hide a file by giving it an important-sounding filename such as system_save.exe and placing it in the C:\winnt\system32 directory.
• You can use covert channels. Loki and some Distributed Denial of Service (DDoS) tools use the Internet Control Message Protocol (ICMP) as the communications channel. Similarly, you can use ICMP to hide information.
• You can use digital watermarking, one of the most widely used steganographic applications. Historically, a watermark is the replication of an image, logo, or text on paper stock so that the source of the document can be at least partially authenticated. A digital watermark can accomplish the same function. For example, on a Web site, a graphic artist might post sample images that have an embed-ded signature. If someone plagiarizes an image, the graphic artist can reveal the signature to prove ownership of that image.
• You can hide information in image or audio files you post on the Web or send in an email message. People often use this form of steganography in conjunction with cryptography to doubly protect the information. The information is encrypted, then hidden so that intruders have to first find the information (an often diffi-cult task in itself) before they can decrypt it.

The Steganographic Process
The basic steganographic process follows a generic formula:

cover_medium + hidden_data + stego_key = stego_medium

where cover_medium is the file in which you hide the hidden_data, which you've encrypted with the stego_key. The resultant file is stego_medium, which will be the same type of file as cover_medium. Cover_medium (and thus stego_medium) are typically image or audio files. In this article, I focus on image files, so I refer to cover_medium and stego_medium as cover_image and stego_image, respectively.

Before I discuss how to hide data, I want to discuss how images are stored. An image is a binary file that contains a binary representation of the color or light intensity of each picture element (pixel). Images typically use 8-bit or 24-bit color. An 8-bit color image uses 8 bits per pixel and provides up to 256 colors in a palette. A 24-bit color image uses 24 bits per pixel and provides a much better set of colors (more than 16 million colors). In 24-bit color images, each pixel is represented by 3 bytes, with each byte representing the intensity of the three primary colors of red, green, and blue.

The HTML format for specifying colors in a Web page often uses the 24-bit format. To specify a color, you use a six-digit value consisting of three hexadecimal numbers that represent the amount of red, green, and blue, respectively. For example, suppose you want to specify the color orange, which consists of 100 percent red, 50 percent green, and 0 percent blue. First, you need to specify 100 percent of the red byte:

binary 11111111 = 
 decimal 255 = 
  hex FF

Next, you need to specify 50 percent of the green byte:

binary 01111111 = decimal 127 = hex 7F

Finally, you need to specify 0 percent of the blue byte:

binary 00000000 = decimal 0 = hex 00

So, in the HTML code, you would specify #FF7F00 as the color. The number sign (#) specifies that it's a hex value.

The size of an image file relates directly to the number of pixels and the granularity of the color definition. For example, an 8-bit color image that's 640 * 480 pixels results in a 307KB file (640 * 480 bytes), whereas a 24-bit color image that's 1024 * 768 pixels results in a 2.36MB file (1024 * 768 * 3 bytes).