A promising method to thwart global surveillence
The Russian Illegals spy ring in New York used steganography. The Caliphate cell in Brussels used truecrypt files uploaded to cyberlockers in Turkey. But the grugq notes that truecrypt files would probably have a fixed size (and even with a random length, it would still round to kilobyte sizes), so it wouldn't be so simple. Obviously if state-level actors use these methods against the NSA, steganography does have a good role to play. Problem is that machine learning has advanced substantially. In a worst case scenario, it will be obvious that you have steganographic files, that is if photodna hashes are similar for many files, but fuzzy hashes aren't as similar. The best that could be done would be to make automated scans more probabilistic and less reliable (I have tens of thousands of files on my computer), by embedding encrypted data steganographically in images in the PDF file. The text and images of the PDF file could be procedurally generated. But I'm not an expert. I'm just pointing out what makes sense to me.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/26/2016 03:29 PM, Ryan Carboni wrote:
The Russian Illegals spy ring in New York used steganography.
I wasn't able to find much detail on that case (in just a couple of minutes), but it appears that the crew in question were reportedly using a "custom" stego application to hide documents in photos. Steganalysis tools that look for statistical and other anomalies in photos (or audio, etc.) have been under development since ever, and seem to work very well; presumably NSA et al have way better ones than we do. This suggests that the only way to make steganograhy work against State actors is to "act normal" and hope for the best, i.e. that your message traffic will not be inspected. This may sound like it would work, given the terabytes per millisecond of potential carrier files crossing the networks - way more than can be stored and analyzed fast enough for full coverage. Only one little problem: Everyone who has traveled to any "hostile jurisdiction" and everyone who has ever used the word "steganography" in a cleartext message, visited websites on the topic, participated in any kind of online discussion about cryptography, etc. is a small enough set that a large part of /their/ message traffic could be routinely inspected for hidden content by State level actors. So that leaves most spies and all of /us/ out in the cold.
The Caliphate cell in Brussels used truecrypt files uploaded to cyberlockers in Turkey. But the grugq notes that truecrypt files would probably have a fixed size (and even with a random length, it would still round to kilobyte sizes), so it wouldn't be so simple.
Not sure how Truecrypt volumes constitute steganography. Padded ciphertext is still ciphertext, plain as day.
Obviously if state-level actors use these methods against the NSA, steganography does have a good role to play. Problem is that machine learning has advanced substantially. In a worst case scenario, it will be obvious that you have steganographic files, that is if photodna hashes are similar for many files, but fuzzy hashes aren't as similar.
If state-level actors are /caught/ using these methods against the NSA, that would tend to demonstrate that the methods in question do not work against State actors. Hiding files inside of files seems to be a bust, but that's not the only vector for steganography. Manipulating the timing of signal traffic, the timing of "real" environmental noise in audio recordings, the presence/absence/number/postion of certain objects in normal photographs, the presence/location of specific words in text files etc. could convey covert messages with little or no risk of detection through automated analysis - but could not hide kilo- or megabytes of information per carrier file.
The best that could be done would be to make automated scans more probabilistic and less reliable (I have tens of thousands of files on my computer), by embedding encrypted data steganographically in images in the PDF file. The text and images of the PDF file could be procedurally generated.
Any practical stego detection protocol should include native analysis of images embedded in PDF files, with no additional computational overhead vs. analyzing plain old image files. In the case of analyzing the content of seized computer, the presence of stego tools should assure full steganalysis of all relevant files - and stored message traffic to and from the user.
But I'm not an expert. I'm just pointing out what makes sense to me.
Me neither, but I used to be very interested in stenography. Reading up on the subject led me to the conclusion that it should work /great/ against adversaries who "suspect nothing" and/or don't know that stenography exists. Other adversaries, not so much - unless, as noted above, one is using a system more akin to a code than a cipher, which hides a /few/ bits of information in plain sight via the presence, absence or position of "normal" content in text or media files. :o/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXSGcbAAoJEECU6c5Xzmuq5ngIAMODdmUor3IjxjiAMNas2Eli ORv9hSob7GXpakZrEc7ZLGofrZ8aSJHTPSx9/PR2mqraaRYWEo/P/C6iiDabcGon DVhCfGAuhrUoEwRULVqxJkl/2eP5ycZEXOAaJH3YVeVHkbLK2M5j1zwtUQlz/CB9 FtAN9S8cG0QtiP83sDn/gzU6xJZSQH+lMi9ltbaUKWqkU/p87O8kddnPPdqQyFWE FpsbdvjV919MAb7pXRaFZWVshXfj7YR4YgZ60X4ZOUZ3/sJwJ4x3oEnbStEd8lQb hDF8UxZ53NyuS/h8Brw/eLiYLRdjIWN+0ZqYkG+sjHjS7eFWKAGWyntn7CTOP6I= =kulv -----END PGP SIGNATURE-----
From: Steve Kinney <admin@pilobilus.net> To: cypherpunks@cpunks.org Sent: Friday, May 27, 2016 8:26 AM Subject: Re: A promising method to thwart global surveillence
If state-level actors are /caught/ using these methods against the NSA, that would tend to demonstrate that the methods in question do not work against State actors. Perhaps it would be more correct to say that they don't ALWAYS work. Jim Bell
On 2016-05-27, jim bell wrote:
If state-level actors are /caught/ using these methods against the NSA, that would tend to demonstrate that the methods in question do not work against State actors.
Perhaps it would be more correct to say that they don't ALWAYS work.
Thus, when do they work and when do they not? Isn't that the question? -- Sampo Syreeni, aka decoy - decoy@iki.fi, http://decoy.iki.fi/front +358-40-3255353, 025E D175 ABE5 027C 9494 EEB0 E090 8BA9 0509 85C2
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/27/2016 08:07 PM, Sampo Syreeni wrote:
On 2016-05-27, jim bell wrote:
If state-level actors are /caught/ using these methods against the NSA, that would tend to demonstrate that the methods in question do not work against State actors.
Perhaps it would be more correct to say that they don't ALWAYS work.
Thus, when do they work and when do they not? Isn't that the question?
Seems a simple question: The more data you are hiding, and the more capable one's adversary, the less likely that steganography will work. I think "code book" steganography, where pre-determined messages from a list of messages known only to the sender and receiver are transmitted via fully visible message timing, content, etc. is very likely to work until or unless a copy of the code book falls into hostile hands. Example: "Any forum post from me, transmitted during an even numbered hour, is an emergency distress call. Any forum post from you transmitted during an even numbered hour means "help is on the way," odd numbered hour means "sorry, you're on your own." Hiding arbitrary data inside media files by flipping bits is likely to fool a human observer, but unlikely to pass through a stego detection filter without tripping an alarm. :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXSw7dAAoJEECU6c5Xzmuqh1QH/A2SZjdk6XCFddjHZ3N2tL69 rPLWtkaxPzfsrVmu5yXcfl9vvPpuaXYP8OVdCCvFiBHGZP3mt4ce98u2Q4H4pnLb Qkoc1FN3X0XtCEMJKufAl+yUy6TmoxTchePhDY4aEt+0gYHnMWsn+qlkTYcSy6mT 51e7MKIr20AKc/f5ItiP4tfYs0KAVezMt7vxxzElq4b9bHDffZJ+Z08N4o4P2bhL eTwS8H5cn3jTuyKe4cmwhLB2HFWjYgZdrVZXaiciFFEzBWkgKmvhgIswX7HGO6Dy 6l3FE6cmB6Rr97M3uexUaAi/JhNGOttMRoN2unf6S8vlhdrzG7XbyVIGss4zJz4= =z/dJ -----END PGP SIGNATURE-----
On Sun, 29 May 2016 11:46:37 -0400 Steve Kinney <admin@pilobilus.net> wrote:
Hiding arbitrary data inside media files by flipping bits is likely to fool a human observer, but unlikely to pass through a stego detection filter without tripping an alarm.
How? Audio and video have noise. You replace the natural noise with your 'noise'. How can an observer tell if he's looking at noise inherent in audio/video signals or at encrypted, noise-like data?
:o)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/01/2016 03:43 AM, juan wrote:
On Sun, 29 May 2016 11:46:37 -0400 Steve Kinney <admin@pilobilus.net> wrote:
Hiding arbitrary data inside media files by flipping bits is likely to fool a human observer, but unlikely to pass through a stego detection filter without tripping an alarm.
How? Audio and video have noise. You replace the natural noise with your 'noise'. How can an observer tell if he's looking at noise inherent in audio/video signals or at encrypted, noise-like data?
Short answer: Statistical analysis; naturally occurring noise and noise introduced from a "random" source (i.e. encrypted data) and/or at random positions in the data stream are quantifiably different. Longer answer: https://en.wikipedia.org/wiki/Steganalysis Longest answer: Stenography & watermarking vs. detection of same is an ongoing arms race, with substantial advantages on the attacker's side . Example of do-it-yourself steganalysis: http://stegsecret.sourceforge.net/ :o) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iQEcBAEBAgAGBQJXTxuSAAoJEECU6c5XzmuqgucH/RnqAr2Ac+QjNyR6rDN/vI3m z2wu3YgnfujgKyXqcCBY1YB8bcwHL8YBqfe6MOg4HxToSxb8wpNvKF1qS1YQ+3JG 5y7uMPVzEF4XM/cdzuspZXl06x7gdV8sJNHRsuyxxWaKzvB1zf04XaKkE9wGWm85 8fenFtQbTaQXnn1BhO+93yOjXf61W8Q+F8Fg9h/g7a6jYYjQqmCgGeED9Q4DkIfh Rui4eYRUhAC2uDa8ckvLDWUcEcHXi1eFyqEOVnmk+B0wXPXulsz8SxOvet6Igznl k4DuezjkMKbAsF4gtNmcqgQsrbeDfXmwM1/xjO8d2DKcg82jk6Veb99d35QQfzs= =DwpB -----END PGP SIGNATURE-----
participants (5)
-
jim bell -
juan -
Ryan Carboni -
Sampo Syreeni -
Steve Kinney