156

Short answer: It's an artifact of Nikon Picture Project I had difficulty finding "Nikon Picture Project" but finally found a 1.5 version to try. The last version produced was 1.7.6 . It turns out that "Nikon Picture Project" does indeed implement non-destructive editing with undo and versioning capabilities. Unlike every other photo editing software I've ...


68

The answer is simple. That was not a photo. And .pif is not an image format. Count on NYTimes to provide correct technical info. As the log on NYTimes's article says, and as FireEye's actual report confirms, the file used was a .pif file. It's one of the less known of Windows's executable file extensions. .pif is legacy from MS-DOS, like .com. It's ...


45

This was less interesting than it seemed at first. The user might just have a broken camera, broken memory card, or malfunctioning photo editing software that fails to save the full resolution image, but is able to save various size of working thumbnails, including the 435 × 652 "original" picture. The filesize of your example picture is explained by a 4032 ...


44

Say what you actually want to do is to make your encrypted email look like spam. OK, how to accomplish that? One possible way would be to take the ciphertext and break it down into managable chunks of, say, nine bits each. Using a set of dictionaries, these nine-bit quantities are mapped to one or more words in a target language (nine bits would require a ...


41

No. For it to be steganography, the message must be hidden in something (an image, a file, etc). When someone looks at that something, they should not be able to suspect that it contains a hidden message. This isn't the case for morse code at all. There is no carrier that hides a message, there is just the message itself.


35

The theoretical question here is a size/entropy question. The key rule is that the entropy of the encrypted message is the same as the entropy of the initial message. If the algorithm involves no compression, the size of the encrypted message is the size of the original message. For the encrypted message to be decoded in two different ways depending on the ...


29

At some level, Steganography implies concealing a message within another. The root Greek word steganos means concealed within graphein writing. The understanding of the message is not restricted to experts. Rather it is security by obscurity that only the target recepient(s) can read. Morse code is just a way of representing information. It does not imply ...


28

As other commenters have mentioned, the file contains data from Nikon Picture Project. What if you couldn't run that software, but you still wanted to know what was hidden inside? Nikon's Picture Project format seems to be entirely undocumented, which is no surprise given that it's a custom format for a particular app and was never designed for interchange. ...


26

One of the draw backs of traditional steganography is that both parties need to exchange a secret key. Don't infer from the implementation of one specific tool to the limits of steganography itself. Steganography is just the hiding of information within other data. It does not matter if the information you want to hide by itself are unencrypted, rot13, ...


25

With many common algorithms, by changing the key, it is quite possible to get any arbitrary data in the first block. Where you run into trouble is when the data is longer than they key block size. The rest of the data (beyond the first block) would look random after swapping keys, assuming you are using a secure chaining method. You could use an insecure ...


23

It would help if you elaborated on if you are defending from a targeted attack or just being cautious, and what vector the potential adversary would be using to eavesdrop. That being said, the method you are referring to is called 'security through obscurity', and is "… discouraged and not recommended by standards bodies." I would say that is putting ...


21

I don't think you're looking at a hidden data segment. The FFD9 is an EOI marker and data following it should be ignored, so I wouldn't expect JPEGSnoop to try to actually decode it. The fact that it does seems to indicate the error isn't related to the EOI. An illegal YCC value could indicate that an out-of-range value is actually used to code information. ...


20

This is the first I've heard of keyed steganography, so I'll recap the article you linked, for the benefit of others who might be confused about it. They have narrowed down the number of steganographic algorithms they're analyzing quite a bit. The message must be embedded in a JPEG image (perhaps any raster image format?), and it can't utilize the entire ...


17

It's not corrupt, it's just filled with APP10 segments, containing some sort of application specific data. Nikon-specific probably, because there are Nikon-references in the APP1/EXIF segment at the start. And after about 6 MB of APP10 segments, there's 103,001 bytes of actual JPEG image data. But all the segment markers are in the right place, meaning they ...


15

A cryptanalyst would probably just do this by hand; This is a text file. All printable characters. Frequency analysis shows 2 * '<' and 2 * '>' which is true of all plaintexts, whereas all other character frequencies change, which probably means something interesting is going on. I would say less than an hour to figure out your password scheme. ...


13

The problem with this technique (with any kind of steganography, actually) is that it relies on security through obscurity. An eavesdropper who is aware of spammimic.com could easily train their surveillance system to recognize patterns which are typical for messages generated by spammimic, log them and extract their hidden payload. By the way: Using the ...


12

between > and < so I can find it myself Well, that's it. Whatever your "hiding method", you have to remember a way to find it back. So you password is not the sequence of characters which you ultimately type on the keyboard; your real password, the "secret convention" that you keep in your brain, is the method: find the two strings enclosed in '>' and '&...


12

Nothing is perfect, and a common kind of bug is a buffer overflow, where in short data gets copied where it shouldn't be, and in some cases this can lead to arbitrary code being executed. For example here is a bug in old Microsoft versions in which if you viewed a certain image with IE than arbitrary code could be executed. Note that this is very ...


12

Note that my information may be outdated, as the last time I really dug into this subject was in 2013 - 3 years ago. I lived there, and experienced all the inns and outs of VPNs and Proxies. The love-hate affair with VPNs in China I have family in China. During the past weeks their internet connection was severely limited. VPNs such as Astrill and ...


12

Short answer: no. Encodings are not steganography. Morse Code is the precursor to how modern day computers transmit information: letters -> ascii values ('a' -> "97") ascii values -> binary strings ("97" -> "0110 0001") binary strings -> square waves of high and low voltage ("0110 0001" -> "_--____-") There's nothing secretive here, we've just used a ...


11

The EFF has a page describing how the information is encoded in those yellow dots: https://www.eff.org/issues/printers The Python program to decode can be found at: https://github.com/zackdouglas/docucolor.cgi They also published a list of printers which do not display those dots: https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-...


10

You're asking for http://spammimic.com/ , which is a web site that does exactly that. They use a steganographic method for encoding bits using spam sentences. The drawbacks of the spammimic implementation are severe, though. They're publicly known, so you can bet that someone who might interested in what flows through their site is already intercepting it....


10

Looks like this metadata lists document IDs that were used during creation of the file. You can check this article: http://www.hackerfactor.com/blog/index.php?/archives/2013/05/23.html, search for the "Ancestors" section. So, it contains technical metadata which could be placed there 'naturally' by the Adobe applications.


9

There can be no universal algorithm to detect steganography. You can implement a series of tests against every known specific steganographic system in existence. But an attacker can use that as a test to develop a new form of steganography that bypasses all existing tests. What you'll need to do is start researching all the various known forms of ...


9

Let's first be clearer about "random noise". This is not defined in general. What you may have is a sequence of random values within a specific domain. For instance, you want to have a sequence of bits that is indistinguishable from uniformly random bits. If you want pseudo-random bits, then you will be happier with symmetric than asymmetric encryption. ...


9

Yes. SSH has standardized and quite distinct handshake packets, so you can very easily detect an SSH session initiation. Here is a transcription of Wireshark capture of an SSH session initiation: Encrypted request packet len=41 Encrypted response packet len=39 Client: Key Exchange Init Server: Key Exchange Init Client: Diffie-Hellman Key Exchange Init ...


9

This could be due to many reasons. I'll share the most likely: The user has an app to randomize/change EXIF data/file property data. There's an app for that. Such a program is usually used by those who are paranoid and want some kind of plausible deniability, or maybe they're just bored and messing with you. iMessage should allow you to send images with ...


8

Using steganography instead of encryption is a rather bad idea, especially when the tool used is freely available. Anybody could use it to uncover the message. However, simple encryption has a shortcoming when compared to steganography: Encrypted messages are usually identifiable as such, so while nobody knows what you send somebody, there is a proof you ...


7

Steganography relies on the latent noise-to-signal ratio of the analogue source material. The "least significant" bits (actual bits will depend on codec) are overwritten by an encrypted stream of secondary "stego" bits such that the primary public content of the image is not destroyed or distorted with notable artefacts. If the steganographic tool didn't ...


7

The whole point of steganography is to avoid detection. A "universal test" for steganography would be a constructive proof that steganography is not possible. However, no proof (constructive or not) of the impossibility of steganography is currently known. This implies that no "universal test" for steganography is currently known -- and it is not known ...


Only top voted, non community-wiki answers of a minimum length are eligible