關於 JPHide 的點點滴滴 (一) : N. Provos

Niels Provos 在 "Detecting Steganographic Content on the Internet" 這篇論文的 Section 5.2 整節都在談論 JPHide 這個隱藏軟體。內文如下:

　JPHide is a steganographic system by Allan Latham. There are two versions: 0.3 and 0.5. Version 0.5 supports additional compression of the hidden message. As a result, they use slightly different headers to store embedding information. Before the content is embedded, it is Blowfish encrypted with a usersupplied pass phrase.

Because the DCT coefficients are not selected continuously from the beginning, JPHide is more difficult to detect.

The program uses a fixed table that defines classes of DCT coefficients to determine in which order to modify the coefficients. All coefficients in the current class are used first to hide information before the next class is chosen. As a result, coefficients are selected in such a way that they those likely to be numerically high are used first.

One artifact of the implementation is that the information hiding continues in the current coefficient class even after the complete message has been embedded. The first class in the table are the DC coefficients of color component zero. An image with a resolution of 600 * 480 has approximately five thousand DC coefficients. Even if the message is only eight bits long, JPHide modifies all five thousand coefficients in such an image.

這邊提到 JPHide 有一個特殊方式來定義嵌入次序, JPHide 使用一個固定的表格來將 DCT 係數分成不同的 classes, 整張影像相同 class 中的 DCT 係數會依序拿來嵌入機密訊息, 直到此 class 的係數用完了, 才會動用到下一個 class 的 DCT 係數。接著, 相同 class 的係數, 數值較大者也會優先拿來嵌入機密訊息。個人覺得這樣做是有道理的, 因為嵌入影響對較大值的係數來說, 比例相對較小, 因此優先使用。

另外一點令人匪宜所思的是: 即使所有的機密訊息已經嵌入完畢了, JPHide 依然會繼續修改目前這個 class 的所有 DCT 係數。論文中提到一個例子, 第一個 class 就是 DC 係數, 假設一張 600*480的影像, 就會有 (600/8)*(480/8)= 75*60 = 4500 個 DC 係數, 那麼即使機密訊息只有 8 bits, JPHide 依然會去修改這所有的 DCT 係數。

　A pseudo-random number generator determines if coefficients are skipped. The probability of skipping bits depends on the length of the hidden message and how many bits have been embedded already.

JPHide modifies not only the least-significant bits of the DCT coefficients, it can also switch to a mode where the second-least-significant bits are modified.

如其他軟體一般, JPHide 用一個 PRNG 來決定哪些係數該跳過不嵌入機密訊息。然而, 較特殊的作法是跳過的機率是和 1) 機密訊息的長度, 2) 已經嵌入多少資料量。這代表每嵌入 1 個位元, 機率值就隨時進行更新, 用以控制所有的訊息可以完全順利嵌入。另外, JPHide 也會將機密訊息嵌入到次低位元中。

From StegoRN

Figure 6: JPHide has a signature similar to JSteg. The major difference is the order in which the DCT coefficients are modified.

Figure 6 shows the probability of embedding for an image containing information hidden with JPHide. Because JPHide can skip DCT coefficients, the probability is not as high as with JSteg.

Figure 6 是使用 Chi-Square Attack 來針對 JPHide stego-images 分析, 橫軸是將影像平分成 100 等份, 每一等份都用 Chi-Square Attack 計算嵌入機率 p。由於 JPHide 會跳過部份的 DCT 係數不藏, 因此所得到的 P 值並不像 Jsteg 那麼高。


Niels Provos and Peter Honeyman, "Detecting Steganographic Content on the Internet,"ISOC NDSS'02, San Diego, CA, February 2002.

JPHIDE and JPSEEK Offical Website

1999年 8 月推出的 JPHIDE and JPSEEK,
作者: Allan Latham ( alatham@flexsys-group.com ),
官方網站網址: http://linux01.gwdg.de/~alatham/stego.html。
在官網中, 作者對於這個隱藏軟體的描述如下:

JPHIDE and JPSEEK are programs which allow you to hide a file in a jpeg visual image. There are lots of versions of similar programs available on the internet but JPHIDE and JPSEEK are rather special. The design objective was not simply to hide a file but rather to do this in such a way that it is impossible to prove that the host file contains a hidden file. Given a typical visual image, a low insertion rate (under 5%) and the absence of the original file, it is not possible to conclude with any worthwhile certainty that the host file contains inserted data. As the insertion percentage increases the statistical nature of the jpeg coefficients differs from "normal" to the extent that it raises suspicion. Above 15% the effects begin to become visible to the naked eye. Of course some images are much better than others when used a host file - plenty of fine detail is good. A cloudless blue sky over a snow covered ski paradise is bad. A waterfall in a forest is probably ideal.

其大意是這樣的:

JPHIDE and JPSEEK 是一個可以將檔案藏進 JPEG 影像的程式。在 Internet 上, 有許多類似程式及其各種版本, 然而, JPHIDE and JPSEEK 卻相當特別！JPHIDE and JPSEEK 的設計目的並不僅是簡單地隱藏檔案, 反而是進一步要表達: 要證明某張偽裝影像嵌有檔案是不可能的。給定一個嵌有低嵌入比例 (低於 5% ) 的影像, 在沒有原始影像的情況下, 並沒有辦法去判斷這張影像嵌有訊息的。當嵌入比例增加時, JPEG 係數的統計特性偏離了原來的正常範圍, 就會引起懷疑。超過 15% 的嵌入比例時, 對於影像品質的影響是肉眼可見的。當然, 擁有較多細節的影像是比較適合用來做掩護影像 ( host ) 的。例如: 一張藍天無雲的滑雪天堂的圖片, 就不太適合用來嵌入訊息; 在森林中瀑布拍攝的圖片就是一張理想的掩護影像。

JPHIDE and JPSEEK 有兩個版本:
1. JPHS 0.3 是 Linux 版本, Download: JPHS 0.3 & Signature
2. JPHS 0.5 則是 Window 版本, Download: JPHS 0.5

JPHS 0.5 的執行畫面如下:

From StegoRN

Steganographic Tools for JPEG Images

JPEG standard 是 Internet 上使用最廣泛的影像儲存格式。因此, 網路上也有許多隱藏軟體 ( steganographic software ) 可以將訊息藏到 JPEG 影像中, 然後透過 Internet 傳送秘密訊息。

Niels Provos & Peter Honeyman 在 2002 年 ISOC NDSS'02 研討會提出 " Detecting Steganographic Content on the Internet " 這篇論文, 文中 P.4 提到了三個在 Internet 上較普及的隱藏軟體。

There are three popular steganographic systems available on the Internet that hide information in JPEG images:

• JSteg, JSteg-Shell

• JPHide

• OutGuess

All of these systems use some form of leastsignificant bit embedding and are detectable by statistical analysis except the latest release of OutGuess. In the following, we describe the specific characteristics of these systems and show how to detect them.

Niels Provos and Peter Honeyman, "Detecting Steganographic Content on the Internet,"ISOC NDSS'02, San Diego, CA, February 2002.