Quick steganography with Matlab

A. LSB Steganography

• This concept (using the last significant bit of something) is general, and applies not only to RGB bmps, but to many kinds of  images, audio, video, etc. Implementation is simple [3].

B. DCT Steganography

• This idea of hiding information in DCT coefficients is implemented by the JSTEG tool, which is the software from Independent JPEG Group JPEG, modifed for 1-bit steganography, developed by Derek Upham. The source is available here. From the README file, ' The JPEG encoding procedure divides an image into 8x8 blocks of pixels in the YCbCr colorspace.  Then they are run through a discrete cosine transform (DCT) and the resulting frequency coefficients are scaled to remove the ones which a human viewer would not detect under normal conditions.  If steganographic data is being loaded into the JPEG image, the loading occurs after this step.  The lowest-order bits of all non-zero frequency coefficients are replaced with successive bits from the steganographic source file, and these modified coefficients are sent to the Huffmann coder.'
• It's a variation of LSB steganography, using DCT quantization coefficients.
• Clearly detailed process + a tool for extraction (not detection), at [1]
• The JEG Toolbox for Matlab can be used to access the DCT coefficients (and other cool stuff not available directly from Matlab  like quantization tables, Huffman coding tables, color space information, and comment markers). In the JPEG encoding process, these coefficients are quantized, zig-zag ordered and then compressed (Run-Length-Encding + Hufffman), so they aren't accessible from Matlab directly. 
• There are techniques for detection and defeating this method of steganography. An analysis presented in [7]

Links:
1. Extracting data embedded with JSTEG
2. JPEG on Wiki
3. Watermark/stego Matlab project source, implementing DCT and LSB hiding schemes
4. Phil Sallee's Matlab JPEG Toolbox
5. JSTEG Steganalysis
6 Hide and Seek: An Introduction to Steganography
7. J.R. Krenn, Steganography and Steganalysis 

Alternate Data Streams in NTFS

Windows alternate Data Streams  
Windows NT from version 3.1 to 2000 and XP has a nice (and documented!) feature: a file can have multiple streams. Maybe one stream of data, the other with information, metadata. Anyway, you can have a small data file that can have a bigger (and hidden) alternate stream containing maybe viruses, or just information you want to be hidden. This (sometimes useful) feature can be exploited in not so friendly ways.


Creating ADS Example

• Create an ADS associated with hello.txt file:
      echo "Hidden text" > hello.txt:hidden
  
• Associate an executable with an ADS:
        type prog12.exe >hello.txt:hidden.exe
  
• ADS text can be viewed with the same syntax:
        notepad hello.txt:hidden.txt
  
• Running ADS executable:
       start hello.txt:hidden.exe 
  (This generates an error about absolute paths on Windows NT, so running with absolute path solves it)
       start c:\hello.txt:hidden.exe
  This command will start a new shell and execute it. Done.
• Another feature is that ads can be attached to directories:
       type "in hidden dir" > c:\HELLO:hidden.txt
• What makes ADS still cool (in an evil way:) is that public awareness is still very restricted to specific public

Detecting ADS
Those ads cannot be detected with the DIR command. DIR command reports the file hello.txt, with just it's size, not considering the alternate streams. Two good free programs to detect ADS are LADS by Frank Heyne and streams by Mark Russinovich.  The output shows how to create 2 alternate streams with text and an executable, and also that normal DIR operations don't detect them. 

(Click to enlarge)

Task manager and process tools (procexp and tasklist) show the hidden executable correctly ( c:\hello.txt:hidden.exe)


Deleting ADS

• If you move the file/folder containing alternate streams to a file system different than NTFS, alternate streams are deleted
• If ADS is not attached to a directory you can copy just the content of the file (without ads) to a new file, and maybe delete the old one
        type hello.txt > hello_noads.txt
• If ADS is attached to a directory, use the trick from Frank Heyne site, or use streams program with -d parameter. 

References:

• NTFS Streams
• The Dark Side of NTFS at InfosecWriters 
• A thorough analysis of NTFS ADS  (Frank Heyne)
• Streams v1.56 by Mark Russinovich

Hide data in images

     There's a nice feature on windows that allows masking or hiding some files in another file. For example you can append an archive (.zip/.rar/...) to a text file or image file (or any other) using the flag /b with the copy command.  

C:\>copy /?
Copies one or more files to another location.

COPY [/D] [/V] [/N] [/Y | /-Y] [/Z] [/A | /B ] source [/A | /B]
     [+ source [/A | /B] [+ ...]] [destination [/A | /B]]

  source       Specifies the file or files to be copied.
  /A           Indicates an ASCII text file.
  /B           Indicates a binary file.

As the help shows, copy can be used with multiple sources. The /B flag indicates binary copy. Without that flag it would be just a regular copy. The usage is as follows (suppose we have a picture (pic.jpg) and also a .zip file we want to hide, in the same directory):

   copy /b pig.jpg + hidden.zip pic.jpg

Click to zoom

Then the archive can be deleted. You can see the size of the initial file increased with the size of the archive.  Then you can open src.txt with WinZip or 7zip or other programs, like a normal archive:

Enjoy and be respectful:)

References:

• Hide files in a picture