Re: Has this photo been de-stegoed?
Well, that sounds reasonable on the face of it, but there's got to be a lot more discussion before I'm convinced. Remember that psuedorandom or encrypted data has a certain noise spectrum. This noise spectrum is extremely different based on what PRBS one is using...PRBS 2^23-1 looks completely different from other 'noise' (and remember noise is a relative term). If you spatially fft a random photo, you'll find that the image detail energy largely occupies certain bands. These are not the bands that stego uses (or so I assume...it really can't be otherwise). The stego-able spectrum will indeed be noise, but this noise will have a certain spectrum. Stego, done well, will I assume try to mimic this noise, but there may be problems. If the message is encrypted, then merely loading that message into the photo will, I assume, NOT result in a noise spectrum that looks like real noise. So you'll need some kind of chopper or spectrum-spreader I guess. If no chopper's used, however, I'm guessing that stego-ed 'noise' doesn't look like true photo noise. If the photo has been de-stegoed stupidly (ie, by writing a random message in its place), that noise won't look like photo noise. So it seems to me that you'd need a sophisticated agent to make the de-steoed photo look like it never had stego. In other words, if the FBI are your man-in-the-middle, then you'll be able to detect that the photo was de-stegoed. If the NSA is your man-in-the-middle, you might not be able to tell. Any of you TLA lurkers wanna come in on a remailer and set me straight? -TD
From: "A.Melon" <juicy@melontraffickers.com> To: cypherpunks@minder.net Subject: Re: Has this photo been de-stegoed? Date: Wed, 10 Dec 2003 13:28:31 -0800 (PST)
Tyler Durden (camera_lumina@hotmail.com) wrote on 2003-12-08:
Is it possible to determine that the photo 'originally' (ie, when it was sent to me) contained stegoed information, but that it was intercepted in transit and the real message overwritten with noise or whatever?
Hardly, given the simple fact that well-encrypted content is indistinguishable from noise.
_________________________________________________________________ Dont worry if your Inbox will max out while you are enjoying the holidays. Get MSN Extra Storage! http://join.msn.com/?PAGE=features/es
If you spatially fft a random photo, you'll find that the image detail energy largely occupies certain bands. These are not the bands that stego uses (or so I assume...it really can't be otherwise). The stego-able spectrum will indeed be noise, but this noise will have a certain spectrum.
There is an obvious solution here ... you don't modulate into the noise band. You modulate the base bits. The image visibly changes but only possession of the original can prove that. Of course, it would have to be pictures of sand, grass, water, crowd from above. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/
At 07:12 PM 12/10/2003 -0500, Tyler Durden wrote:
If you spatially fft a random photo, you'll find that the image detail energy largely occupies certain bands. These are not the bands that stego uses (or so I assume...it really can't be otherwise). The stego-able spectrum will indeed be noise, but this noise will have a certain spectrum.
Stego, done well, will I assume try to mimic this noise, but there may be problems. If the message is encrypted, then merely loading that message into the photo will, I assume, NOT result in a noise spectrum that looks like real noise. So you'll need some kind of chopper or spectrum-spreader I guess.
If you're asking whether something has added stego rather than original picture noise, and how to detect it, that's one thing. But if you're asking whether something used to have added stego, and that stego has now been removed, and how to detect _that_ that's a much harder question. - There was an original. - Then there was an original with stegobits added. - Then there was an original with something different done to the previous stego image. The MITM isn't going to be able to restore the original bits, but they could replace the stego bits with various kinds of noise, or with different stego bits using the same stego system, or using a different stego system, but how can you tell? If they've replaced the message with a different message using the same stego system, and the system gives you a method for determining who a message is from and who it's to, then maybe you can tell whether the new message is for you or not and whether it's from whoever you expected it to be from or not, if you knew. If they've used a different stego system, or if you're using a stego system that's very good, you're back to the question of determining whether the message you received was a message that has somebody else's stego in it.
participants (3)
-
Bill Stewart -
Morlock Elloi -
Tyler Durden