Show HN: Encrypt and hide files inside images

https://github.com/7thSamurai/steganography

by 7thSamurai • 4 years ago

208 84 4 years ago

This form of steganography, of course, can't survive virtually every image transformation and format conversion and thus can only be used for limited cases. PICO-8's .p8.png format is one such example [1].

[1] https://pico-8.fandom.com/wiki/P8PNGFileFormat

zamalek2• 4 years ago

My childhood friend reached out about wanting to hide her music collection. This completely nerd sniped me. What I did was create a FAT-like FS in complete reverse (starting at the end of the disk). AES-CTR was used to encrypt it (hurrah plausible deniability), so it would merely look like random empty space. The idea was then to drop some decoy files on the drive, defrag+compact, and then use the free space for the music collection.

She decided against crossing the border with the music collection, and so it was never used. Still a fun steganography project.

7thSamurai3• 4 years ago

Wow, that sounds super cool! Nice work on that!

unstatusthequo• 4 years ago

What border crossing is this so I make sure to never visit?

zamalek2• 4 years ago

New Zealand if I'm remembering correctly.

system2• 4 years ago

Did she tell you why she wanted to hide her music collection? Is this a common thing?

nix23• 4 years ago

Yes in the old times when your friend's where Emo's but you secretly listened to Britney Spears.

ale423• 4 years ago

Sounds a bit like the hidden volumes in TrueCrypt/VeraCrypt...

motohagiography• 4 years ago

Nice of them to write a useful tool for doing it, and I have never implemented it, but having done stego detection as part of CTFs/creepypasta puzzles, if the shannon entropy of the data in the LSB (extracted using cyberchef) is greater than that of the rest of the image, it probably has data encoded in it. Similarly, you can randomize the palette of an image to look for noise that would indicate encoded data.

hayst4ck3• 4 years ago

You can also break an image down into layers based on bit position. Static is a clear sign of random and therefore likely encrypted or compressed data.

GoblinSlayer2• 4 years ago

What if the image is a noisy photo?

krick2• 4 years ago

CTFs/creepypasta puzzles

Where can I find games like that?

alphabet9000• 4 years ago

nice. to anyone else curious about the difference between the two images in the repo, here's the difference and then equalized: http://telnet.asia/diff.png

etaioinshrdlu• 4 years ago

Cool, but Least significant bit steganography is kind of old now. It would be nice to see hiding data in the content or meaning of images, probably using Stable Diffusion.

mgkimsal• 4 years ago

Will we get to "hide <secret info x> in 3 red balloons floating over a waterfall"?

chirau• 4 years ago

How do you install this?

7thSamurai3• 4 years ago

Currently it's only for Linux and Mac users. Check out the building section at https://github.com/7thSamurai/steganography#building to learn how to compile it.

jamesy0ung• 4 years ago

Getting errors when building it on my machine, macOS 12.5, Intel.

racingmars• 4 years ago

Looks like there's already a pull request to fix building under macOS: https://github.com/7thSamurai/steganography/pull/1

7thSamurai3• 4 years ago

Just merged it!

nuraxy• 4 years ago

The author claims it is possible to detect an image having some possible data. How does one detect this?

dexterdog• 4 years ago

usually by the fact that a 200x200 jpg is 15MB

Retr0id4• 4 years ago

The LSBs of a typical photograph are not uniformly random. For example, here's the blue channel LSBs of the input image from the repo: https://i.imgur.com/lOVlcpU.png

If they are uniformly random, then you know something is up.

ale423• 4 years ago

This image is clearly showing JPEG artifacts, you'd never see such square blocks in an photograph that has not been compressed with a lossy algorithm.

kristopolous• 4 years ago

As another example I have an extremely easy to understand and well commented version of a similar technique from about 10 years ago

https://github.com/kristopolous/piggypack

tsumnia• 4 years ago

Nice work! Steganography is always one of the topics I introduce at the end of CS1, since they've learned all the bits and pieces on how to do it. Its fun to watch their minds get blown over something like this and go "you can DO that?!"

behnamoh• 4 years ago

If a JPEG can store data, can that data (code) also be run upon opening the JPEG? This could be really disturbing.

awestroke• 4 years ago

Only if there is a flaw in the jpeg decoder

af3d• 4 years ago

Generally speaking, no. While theoretically a JPEG could be used to STORE a virus, the chances of that code actually running on your computer is almost nil. (Provided you don't do silly things such as clicking on a file named "img.jpeg.exe" or what have you.) Of course from time to time in the past there have been bugs. Some of the early Windows versions for example. AFAIK most (if not all) JPEG decoders in common use today have already ironed out those issues.

bawolff4• 4 years ago

JPEG as a format allows you to add extra data to the end. ZIP as a format allows you to add extra data to the beginning. So its probably easy to make a JAR-JPEG polygot.

Generally though, even if you make an executable JPEG, the thing stopping this is that normally you look at the extension to decide how to interpret a file, so when you see a .jpg ending, you don't try and execute.

billpg2• 4 years ago

You could store the bytes of an EXE inside an image, just like how I could paste the base-64 of an EXE on the end of this message. The trick is going from that to actually running it.

TVoKSGVsbG8gdGhlcmUuClRoYW5rIHlvdSBmb3IgcmVhZGluZyBteSBlbmNvZGVkIG1lc3NhZ2Uu ClRoZSBiZXN0IHdvcmQgaW4gdGhlIEVuZ2xpc2ggbGFuZ2FnZSBpcyBSdXRhYmFnYS4KQ2hhbmdl IG15IG1pbmQ=

jdthedisciple• 4 years ago

yea I'm not going to run that trojan you just posted here

teaearlgraycold• 4 years ago

Combine with stable diffusion and you don’t even need to bring your own image to the table. Plus there’s no public reference that exists to compare against.

UberFly• 4 years ago

I always wondered how many of the images on eBay were actually clandestine underworld spy messages. The equivalent of the crossword puzzles during WW2. Ok probably not many but you never know. :)

ale423• 4 years ago

Not spy messages, but steganography has been used for malvertizing campaigns, hiding malicious code inside ad images to prevent automated detection by ad networks. See for example https://www.proofpoint.com/us/threat-insight/post/massive-ad....

ipython• 4 years ago

Have you seen any of these images? If so, then yes they were clandestine spy messages. https://vault.fbi.gov/ghost-stories-russian-foreign-intellig...

ASalazarMX• 4 years ago

When the Internet was fast enough, image forums were such a novelty it was common to hoard images/memes/wallpapers for later use. I've always wondered what kind of stenographic messages I unknowingly saved in my old files.

the_jesus_villa2• 4 years ago

Kind of a fun barely-related historical script kiddie note, but due to the way the jpeg and zip file formats work, you can store both in the same file, then just change the file extension from one to the other and it will work correctly.

The "Dangerous Kitten" pack of hacking tools was famously shared this way on early image boards: https://web.archive.org/web/20110902044711/http://partyvan.i...

Nowadays must image parsing is done via libraries that will strip out extraneous info to prevent this, but back in the day when most people would roll their own code for this (or copy paste poorly thought out implementations) this was commonly, if unintentionally, supported.

Retr0id4• 4 years ago

Nothing has fundamentally changed, you can still upload images containing file archives to most social media services, if you pay attention to the relevant file format specs.

yjftsjthsd-h• 4 years ago

Don't most social sites reencode/compress everything? I would expect this to get inadvertently broken as everyone tries to save space/bandwidth.

gernb• 4 years ago

Nice tool.

As semi-related trivia, Pico-8 stores its "cartridges" using this technique so the carts are .PNG files.

https://www.lexaloffle.com/pico-8.php

MrGilbert• 4 years ago

On a side note: Pico-8 is such an awesome platform. I'm truely impressed.

herpderperator• 4 years ago

What happens if you send a photo generated by this tool through something like Facebook or WhatsApp where they might re-encode the file to save on storage/bandwidth costs?

daveidol• 4 years ago

Bye bye data, probably.

hayst4ck3• 4 years ago

The concept is lossless vs lossy compressions. Facebook is known to do all manner of lossy transformations on images, while whatsapp likely (definitely if you believe it is e2e encrypted) would just transfer the bits.

Re-sizing would trash the payload, but any type of conversion that losslessly preservers the raster (the matrix of pixels) would likely still be recoverable.

Ecstatify• 4 years ago

WhatsApp compresses the image/video on the device before sending.

Example video 13.2MB => 7.2MB

codetrotter• 4 years ago

whatsapp likely (definitely if you believe it is e2e encrypted) would just transfer the bits

They could still compress images on the client side before sending the message. Dunno if they do or not, didn’t check. Just saying that E2EE does not prevent them from doing so.

Bad_CRC• 4 years ago

Or something like Amazon Photos which can store RAWs...

spiffytech• 4 years ago

I've wondered whether this could be addressed making the pixel adjustments in the form of a QR code. Much lower data storage, but much better chance of surviving image transforms thanks to the built-in resilience and redundancy.

leni536• 4 years ago

The steganography aspect does not seam very robust. It significantly alters the distribution of LSB of pixel values of typical images.

In contrast steghide[1] encodes the data by swapping pixels within the image. This leaves the distribution of pixel values the same, avoiding this channel of detection.

[1] https://steghide.sourceforge.net/index.php

commitpizza• 4 years ago

I love this kind of stuff, if I ever would use security by obscurity this is probably the way I would do it :)

DeathArrow• 4 years ago

When I was a teenager we hid games on DOS on school's computers by just changing the name and extension.

bawolff4• 4 years ago

This is really cool.

However, LSB is the most famous method of doing steno, so if you actually have something to hide this is probably not a good method, as everyone knows about this method.

rndgermandude• 4 years ago

I'd say it's good enough. An adversary would need to know the file the secret is hidden inside, what method was used, probably would need the unaltered container file to compare with to extract the bits, and then has to overcome the additional layer of encryption.

I didn't check the code corresponding to the submitted article, but I'd guess it would be infeasible even for an advanced or even state adversarial actor to automatically check lots and lots of images (unless there is some kind of "signature" that can be detected) just in case there might be some LSB-based steganographically hidden secret inside.

If the adversary is doing a targeted attack against an individual/group of individuals, it might be more feasible, but then I'd wonder if other means of attack, including the good old monkey-wrench-to-the-knee aren't still more efficient.

bawolff4• 4 years ago

unless there is some kind of "signature" that can be detected

There is.

You're right that the encryption probably can't be overcome. The risk is more that it is detected and then the adversary beats you up until you hand over the password.

c7b• 4 years ago

Really depends on what your threat model is, no? To anyone who doesn't even know whether there is something to look for, it's definitely far less suspicious than a TrueCrypt container.

TheCapeGreek• 4 years ago

For the non-gamers or those who didn't play it: Spore used to do this with all its creations[0]. You could export them as PNGs and drag and drop them into an editor to load the content. The image itself was a thumbnail of the creation. That's how every creation was shared between the official servers and between users on the forums. Very neat & niche use case.

[0]https://nedbatchelder.com/blog/200806/spore_creature_creator...

taink• 4 years ago

I can think of Exapunks[1] (by Zachtronics) which uses a similar concept; you can create games for a virtual device called the "TEC Redshift" and to share the solutions between the players, the game creates a cartridge picture with the name of your solution. The instructions are embedded into the file, and you simply have to drag&drop it into the game to import the solution.

It's a neat way of sharing save files!

[1] https://www.zachtronics.com/exapunks/

teddyh• 4 years ago

So did Fractint in the early 1990s; it saved the coordinates and other settings in separate tags of the GIF image, so you could just load a previously saved image and keep panning and zooming.

ranger_danger• 4 years ago

Hydrus also distributes plugins as encoded images.

https://hydrusnetwork.github.io/hydrus/index.html

Pyrodogg• 4 years ago

The Pico-8 virtual console also stores games as PNG. What you see as the game cart is the game.

https://www.lexaloffle.com/pico-8.php https://pico-8.fandom.com/wiki/P8PNGFileFormat

kordlessagain• 4 years ago

It would be interesting to use this to embed tags for an AI to inference.

noxer2• 4 years ago

This is not much steganography and by ditching steganography completely you could make it so that the file is both a valid image and a valid zip. At least that would make it easy to extract the data.

Needless to say that too has already been done many times in the last 20 year.

DocTomoe• 4 years ago

Stenography is quick writing using a vowel-/tone-based script usually used to record the spoken word. You are thinking about steganography, which is hiding something inside other data.

The ZIP thing is a nice trick, but by now is being checked for regularly when computer forensics come into play. Also, I would argue that it is not actually steganography, for it does not hide itself.

krick2• 4 years ago

That's just about "hiding" being a relative word. "ZIP thing" also can be considered hiding, if you are absolutely clueless. And if we speak about "forensics" — that toy implementation is about as much "hiding" as the ZIP thingy. For more or less solid tool somebody already mentioned steghide here, as well as the reasons why the OP's script doesn't really hide anything, if we are being meticulous.

noxer2• 4 years ago

Auto-correction wins again.

Yes, both is easily detected anyway, hence I said "ditching" it would allow to make it a zip file.

Show HN: Encrypt and hide files inside images

Related Stories