Steganographic Tools for JPEG Images

JPEG standard 是 Internet 上使用最廣泛的影像儲存格式。因此, 網路上也有許多隱藏軟體 ( steganographic software ) 可以將訊息藏到 JPEG 影像中, 然後透過 Internet 傳送秘密訊息。

Niels Provos & Peter Honeyman 在 2002 年 ISOC NDSS'02 研討會提出 " Detecting Steganographic Content on the Internet " 這篇論文, 文中 P.4 提到了三個在 Internet 上較普及的隱藏軟體。

There are three popular steganographic systems available on the Internet that hide information in JPEG images:

• JSteg, JSteg-Shell

• JPHide

• OutGuess

All of these systems use some form of leastsignificant bit embedding and are detectable by statistical analysis except the latest release of OutGuess. In the following, we describe the specific characteristics of these systems and show how to detect them.

Niels Provos and Peter Honeyman, "Detecting Steganographic Content on the Internet,"ISOC NDSS'02, San Diego, CA, February 2002.

About OutGuess ... (part 1): N. Provos

OutGuess by Neils Provos
Offical Website: www.outguess.org


Niels Provos & Peter Honeyman 在 2001 年CITI 的技術報告, 還有 2002年 ISOC NDSS'02 研討會論文 "Detecting Steganographic Content on the Internet" 中是這樣描述 OutGuess 的:

[ P.5 ]
　OutGuess is a steganographic system available as UNIX source code. There are two released versions: OutGuess 0.13b, which is vulnerable to statistical analysis, and OutGuess 0.2, which includes the ability to preserve statistical properties and can not be detected by the statistical tests used in this paper.

　OutGuess is different from the systems described in the previous sections in that its chooses the DCT coefficients with a pseudo-random number generator. A user-supplied pass phrase initializes a stream cipher and a pseudo-random number generator, both based on RC4. The stream cipher is used to encrypt the content.

　Because the modifications are distributed randomly over the DCT coefficients, the X²-test can not be applied on a continuously increasing sample of the image. Instead, we slide the position where we take the samples across the image.

　For OutGuess 0.13b, we do not find any clear signatures. Figure 7 shows the probability of embedding for a sample image. The spikes indicate areas in the image where modifications to coefficients cause departures from the expected DCT coefficient frequency.

Figure 7: OutGuess 0.13b is more difficult to detect. Due to the random selection of bits, there is no clear signature.

上面這張圖是論文的 Figure 7, 將整張影像切割成 100 等份(橫軸), 每一等份都用 Chi-Square Attack 去估算嵌有機密訊息的可能性(縱軸)。由於 OutGuess 隨機地將資料分散在整張影像之中, 因此, 分別在這 100 份的部分影像所計算出來的可能值, p, 大小是不固定的, 可以說毫無特定特徵(signature)可言。因此, 相對於 Jsteg/JSteg-Shell 與 JPHide 來說, 隱藏在整張影像的機密訊息是較難被偵測出來的。

Niels Provos and Peter Honeyman, "Detecting Steganographic Content on the Internet,"ISOC NDSS'02, San Diego, CA, February 2002.