Implementation of Least Significant Bit Image Steganography and its Steganalaysis

1. Second Quarter Implementation of Least Significant Bit Image Steganography and its Steganalaysis By: Deniz Oran

2. Goals • To conceal either an image or a text message into a "carrier" image with Least Significant Bit Steganography • To detect that an image has been compromised or altered • To extend the method to apply to various image formats • To make the program usable with a Graphical User Interface (GUI)

3. What is Steganography? • Literally means "concealed writing" in Greek • Opposite of cryptography, in which a message is made unintelligible, but transmitted through public means •  Steganography is the concealment of the fact that a  message is even being transferred.

4. Historical Methods • Shaving hair • Wax tablets • Jargon • Cardano grille • Invisible Inks • Thermo-activated inks • Micro dots • Enigma Machine • All of the above have been used for espionage and for coordinating attacks on other bodies.

5. Current Method • Hiding an entire text or image binary in either an image or audio “carrier” using Least Significant Bit encoding • Previously done as a Senior Technology Lab using the same technique with .wav audio files in 2007. • There is currently no established method for encoding something with steganography because better encoding methods translate to lower carrier image capacity. • There is no established method for universally detecting steganography because of the variety of methods.

6. Least Significant Bit Encoding • Images on computers are made out of pixels • Each pixel is represented by three bytes • Each byte is composed of eight bits or 1s and 0s 10010101 00001101 11001001 10010110 00001111 11001011 10011111 00010000 10010100 00001101 11001000 10010110 00001110 11001011 10011111 00010001 • The second set of bytes represents the encoded ASCII character “G” (01000111)

7. Program Design in JAVA • Create a GUI • Dropdown menu • Input a suspected image • Attempt to detect if it has been compromised • Place the two image next to each other for visual comparison.

8. Inputing the Image • Read the binary of the image using Buffered Reader, DataBufferByte, and Writable Raster into a three dimensional array (datacube) with row, column, and corresponding color value (depends on image format ). • Alter every Least Significant Bit in each byte in order to spell out the word. Each ASCII character's binary are understood by DataBuffer ByteSave the altered image because it is ready to be sent • Saving should be done using a “lossless” image standard because this form of steganography exploits the “noise” of an image. Therefore, .PNG is a good start.

9. Steganalysis • Detecting a message encoded using steganography is only feasible if the original image is available or if the exact encoding method is known. • The program will still be able to detect if an image has been compromised by converting the suspected image into hexadecimal but the message may not be extracted. • Each image format has a specific tag associated with it at a specific part of the hexadecimal code (this won't work if a proper LSB is done).

10. Image Hex Tags

11. Detection • Read the suspected image's binary into a text file • Convert the binary code into hexadecimal • Find the supposed image format of the suspected image • Test if its associated hexadecimal tag is legitimate • OR • Just attempt to reverse the process of Least Significant Bit encoding. This method is always tried by commercial software but hardly works if the LSB is done differently.

12. Possible Problems • Steganography is an increasingly complex field because of new algorithms • There are many methods to inconspicuously hide an image or text message with computer science, some are less complex (microdots) and some use higher level mathematical algorithms (stochastic modulation) • The Least Significant Bit method is an established method and will be probably be detected by commercial Steganalysis software, but not the human eye

13. Testing • Tests involve inserting a character into an image, finding where the character is hidden, and verifying that it is indeed the letter. Tests on file size versus message length should be done. A visual comparison is required:

14. Testing Continued • Binary comparison revealed that after 32 bytes there was a variation when the letter “G” (01000111) was encoded: Original: 01110011 11100001 01101100 00111000 01100010 0101000 00100010 00101010 • Altered: 00001110 11000011 00000000 00000000 00001110 11000011 00000001 11000111 • There was also testing on the rendering time of the image. The rendering appeared to be a linear trend.

15. Learned Concepts • How images of various formats are constructed (.PNG) • How to manipulate binary code and understanding the role of bits within bytes. Binary operations such as AND, OR, and addition. • Various methods of Steganography and Steganalysis and which are the most effective • How to determine a file's extension using JAVA

16. Future Plans • Since encoding now works for the .PNG format, the extraction still needs work (getting it to run properly). • Detect the image format with JAVA as opposed to manually inspecting the Hex code. • Encode images into the program. • Extend the program to work with other image formats and improve the algorithms susceptibility to common detection methods (using padding and random byte locations).