Detecting Steganography in images

Question

I recently came across an odd JPEG file: Resolution 400x600 and a filesize of 2.9 MB. I got suspicious and suspected that there is some additional information hidden. I tried some straight forward things: open the file with some archive tools; tried to read its content with an editor, but I couldn't locate anything interresting.

Now my questions: What else can I do? Are there any tools available that analyze images for hidden data? Perhaps a tool that scans for known file headers?

Answer 1

To detect Steganography it really comes down to statistical analysis (not a subject I know very well).
But here are a few pages that may help you out.

• Steganography Countermeasures and detection - Wikipedia page worth a read to cover the basics.
• An Overview of Steganography for the Computer Forensics Examiner - Has quite a long list of tools and some other useful information.
• Steganography Detection - Some more information about Stegonography.
• Steganography Detection with Stegdetect - Stegdetect is an automated tool for detecting steganographic content in images. It is capable of detecting several different steganographic methods to embed hidden information in JPEG images. Tool hasn't been updated in quite a while but it was the best looking free tool I could find with a quick search.

Answer 2

I'll second the reccomendation for Stegdetect: here's another good source for information http://www.outguess.org/detection.php as well as downloads for stegbreak and XSteg

You can go right to the source for the research on this if you're interested; Neil Provos's page is here http://www.citi.umich.edu/u/provos/stego/

Answer 3

There's some great general references in the other answers here, so I'll just give some input specific to your situation:

When hiding data in pictures without changing the file size, you put it in the low-order bits; this can be detected by opening in an editor with a histogram and looking for jagged edges. But this sounds like a concantenation of a file to the image; *chan denizens often use this technique for distributing illicit files. Looking for file signatures after the first one--say, using 'grep -a' with a list of known filetype magic numbers--should reveal this technique. The combination of encryption and steganography is beyond the scope of this comment :D

Answer 4

It's probably just a file appended to the end of the JPEG. Look for the EOF or the start of a known header such as PK RAR PE etc

Answer 5

You must try to read its binary using software like Winhex , as they might provide you some clue about some other file extension appended to your file.

Also open it with Notepad in window and vi editor in linux as they also provide certain information about file extensions. If nothing is detected go for some most used stego detecting tools available on internet.