4

I want to verifiably demonstrate that there are no hidden partitions, or hidden messages in a given message.

In this scenario, assume the subject is being monitored (consensually) and agrees to align with whatever audits or restrictions need to be in place. OR the receiver agrees to have messages filtered as to reduce the chance such a message is being received.

Edit: I want to highlight the fact that I'm looking for ways to reduce the statistical probability that a subversive message exists... since the premise of steganography uses statistics to identify these covert messages. Basically, I'm just trying to help them along but implementing anti-stenographic techniques.

Question

How can I normalize media in such a way as to reduce the chance a hidden message is contained therein?

Examples

  • In the case of a TrueCrypt hidden partition, I am thinking that I can show that all unallocated (or unused space) is set to either 1 or 0, however that verification process would be time consuming.

  • In the case of steganography, I can normalize images, to a simple format of my choosing which would add noise or eliminate any message if present.

  • Finally in the case of written text, I can perform substitutions (Thesaurus) or grammar replacements as needed (Yoda-fi the text for lack of a direct example)

  • Delay the time that a message is sent, or only release messages at a fixed time

  • 5
    I think you will run into the "prove a negative" dilemma. – schroeder Aug 6 '15 at 3:26
  • How much do you want to reduce this by? It's trivial to set up a pre-defined code in a message. i.e. if I refer to you as Mr. Johnson, it means they're onto you. But if I call you just Burt Johnson, it means you're in the clear. Hidden messages are nearly impossible to detect if the message is far smaller than the noise. This has been tried in things like online auctions, and have generally failed. – Steve Sether Aug 6 '15 at 4:22
  • 3
    Personally I think the question is too broad to have any relevant answer. – Steve Sether Aug 6 '15 at 4:24
  • 2
    Setting all unused data to '0' does not demonstrate that a hidden partition does not exist. With TrueCrypt the partition will seem to hold perfectly random data. With truly random data any outcome is equally possible including all zeros (or all ones, or all digits of pi). It will be extremely unlikely but not impossible. – Jeff Aug 6 '15 at 9:33
  • @Jeff With that atttitude any data might be an unlikely but possible truecrypt volume, e.g. a screenshot of this thread. However, the entropy of an all-1 or all-0 space is so low that it is mor than safe to assume that nothing is hidden in it. Then again, the mere length of the partition might be a secretly transferred number ... – Hagen von Eitzen Aug 7 '15 at 6:40
3

Your question here is basically the question every steganalysts are asking. Reading from wikipedia page:

The goal of steganalysis is to identify suspected packages, determine whether or not they have a payload encoded into them, and, if possible, recover that payload.

The usual way to go is to have a set of known not-steganographed data to extrapolate statistical data. Then you try to devise the characteristics of what is empty containers and run the statistical analysis on the set of all files. If the file does not match the statistical class, you are likely to have found a media with steganographed data in there.

The statistical elements will be different for each media types and there is no definite answer as "this file contains hidden data", it's always a probability unless you have the tool to decode it.

Your next question, normalising, is just a new rule. If you code all images in JPEG, the steganographer just need to find a algorithm that is resistant to JPEG (re)compression.

-1

In case of hidden partitions, copy the materials to a different media. Don't clone it though. Also don't allow compressed or encrypted attachments. One of my clients doesn't allow compressed files beyond 99% compression for instance.

In the case of images, you can resize an image by reduction, which will typically remove any altered binary info in the image. You can also increase the compression algorithm with something like JPG compression, which is much more lossy. This way there is less of a chance of information transfer and added bonus of the addition of compression noise. That's provided they don't know how to translate hex to something like ascii to spell with a certain channel value of a wide area of an image. If this is the case then you could use something like an Instagram photo filter to alter the values of all channels.

Hidden text is harder, but not impossible. You could add an extra word, but if the message contains a keyword as to the length of the message (numerology), then they would likely no longer use this method once they knew you were onto their scheme. If they thought their hidden message was compromised then they likely wouldn't feel the method was safe anymore.

There are multiple methods to hiding text however, so if you weren't sure which method they were using it may be very difficult to prevent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.