Investigators Guide to Steganography

• Stego-only attack: Attack is one where we only have the stegomedium, and we want to detect and extract the embedded message (Figure 4.14).

  Figure 4.14

• Known-cover attack: Attack is used when we have both the stegomedium and the cover-medium, so that a comparison can be made between the two (Figure 4.15).

  Figure 4.15

• Known-message attack: Attack assumes that we know the message and the stego-medium, and we want to find the method used for embedding the message (Figure 4.16).

  Figure 4.16

• Chosen-stego attack: Attack is used when we have both the stegomedium and the steganography tool or algorithm (Figure 4.17).

  Figure 4.17

• Chosen-message attack: Attack is one where the steganalyst generates a stego-medium from a message using a particular tool, looking for signatures that will enable the detection of other stegomedia. (Figure 4.18).

  Figure 4.18

Disabling Information

We have seen, through steganalysis, that we can detect the existence of hidden information, thereby defeating the imperceptibility that steganography tries to maintain. However, there are methods other than detection that are much more effective. These methods are called active attacks and rather than try to detect hidden information, their purpose is to destroy it. The primary advantage of using active over passive attacks is that they are easier to implement because it is easier to destroy than detect. Following are some active attack methods and their descriptions.

• Blur: Smoothes transitions and decreases contrast by averaging the pixels next to the hard edges of defined lines and areas where there are significant color transitions.

• Noise: Random noise inserts random-colored pixels to an image. Uniform noise inserts pixels and colors that closely resemble the original pixels.

• Noise reduction: Reduces noise in the image by adjusting the colors and averaging pixel values.

• Sharpen: Sharpening is the opposite of blur. It increases contrast between adjacent pixels where there are significant color contrasts, usually at the edge of objects.

• Rotate: Rotation moves an image around its center point in a given plane.

• Resample: Resampling involves an interpolation process to minimize the "raggedness" normally associated with expanding an image.

• Soften: Applies a uniform blur to an image to smooth edges and reduce contrasts, and causes less distortion than blurring.

With all of these ways to disable hidden information, how does steganography stand up to these types of active attacks? The simple truth is it does not, especially when more than one is applied in succession, as is the case with the StirMark tool. Watermarking tools, which do not have to work at secrecy, tend to fare much better but are still subject to being damaged by these attacks.