Save Byline Data with airSlate SignNow

Save byline data

this presentation is about jadeite this week's entire lesson is about data hiding under pettiness this presentation is meant to have country and of course CGS 5131 at University of Central Florida my name is Rick line occurred here are the objectives for for this week we'll start by just taking a look at why data hiding is important for both the bad guys and the forensics investigators we'll talk about file data hiding now we've already sort of mentioned that when we looked at concatenating images but we'll spend a little more time on that topic from there we'll go to disk slack data hiding this slack is the sectors on your disk that are not allocated okay so for this section we're going to be looking for unallocated disk sectors into which we can insert our data file slack however is different than disk slack while dis slack is a bunch of unallocated sectors file slack is where we put data into allocated sectors but there the slack at the end of a file that's not used and I will I will talk about that in much more detail from there we'll go into encryption now I don't spend a lot of time on sort of depth up the nuts and bolts of encryption just because we do that next semester at 6418 we really sort of get into you know the mechanics of encryption here we're just going to be showing how to encrypt and use that for for data hiding after that we spend a good bit of time on steganography and more specifically we're going to talk about image steganography now when we talked about images and when we talked about images in the data carving section I spent a good bit of time talking about how limits laid out in the architecture of images so we're going to kind of review that because that turns out to be really important for the topic of image steganography there's understand geography we'll talk about too and we'll sort of allude to that maybe give a few examples and lastly we're going to take the subject to file slack data hiding and revisit it and talk about how forensics investigators can can actually do a comparison of the entropy of files file slack than the entropy of the file data itself and in this way they can sort of make a match between slack space that really doesn't belong to the file but if you use steganography there's a way that you can take the original file data and steganographic Lee hide the data within it not to write back to the original data but then take that data and put it in the slack space and we'll talk a good bit about that so why is data hiding important well if an investigator doesn't know that data is there then encryption or obfuscation or whatever we've already talked about both of those doesn't even matter because it can easily be missed and many times once data is hidden especially if it's carefully hidden and expertly hidden it prevents casual inspections such as during a directory or something else it prevents casual inspection from discovering hidden data so this is a really excellent way to to put data somewhere where nobody's gonna even know it's there it does make data recovery of stuff that's hard now next week we do recovery of deleted files well this is better than even delete files because deleted files can be most of the time recovered but if the data is a lot of times there's no way you can even get it back because you don't know where it is so what types of data can you hide or should you hide or what types of data are people hiding today well there's no definitive list because it can be really anything that can be imagined some of the things I've seen are as follows secret information this is a real interesting thing this has a lot to do with say industrial espionage I've worked on cases where employees within a company were actually hiding data that was company intellectual property in order to sneak it out the reason they do that is either they're their competitors or they're selling to competitors or they have their disgruntled and they want to do some damage to the company so secret information is is really common to hide secret information also might be say credit card lists of credit cards or even just one credit card you know sometimes we think of hidden data as being this big voluminous set of information a single credit card along with its expiration and code is gonna be like 22 bytes so you don't need a lot of space to hide really useful and valuable information passwords can be hidden for instance you might know what a password is and you might want to hide it so someone coming behind you knows where to look for it or you might have a list of passwords your passwords and you might say have a list of 20 or 30 passwords and put them into some sort of hidden area maybe the secret formula is some scientific convention or something I know I've had software inventions and they didn't necessarily have formulas but they had short pseudocode and short code snippets that that I had to protect and so you could hide you could hide similar data and and that way people can't find it very easily plans plans for like bombs plans for new Claire raucous plans for whatever maybe plans for say some maybe plans for say some illegal thing that you're planning some conspiracy that you and a group of people are planning and you hide the data so that everybody in the group knows where to find it and can sort of participating the plans you know read the current plans or maybe amend them but nobody else knows where the where the data is so they're not privileged to the plans messages for instance if you do steganography on an image you could actually post it to a to a web site and then and then someone could just visit your website do a right-click and copy the image and then and extract the steganographic lis hidden message from within the image and we definitely cover that in this section contraband contraband would be things like maybe a link to that Silk Road or most most commonly we think a contraband to say like child porn or something that's illegal so you can hide that somewhere obviously people who have it are going to want to hide it and finally malware can be hidden and is normally in that way your operating system or your antivirus or your anti spyware isn't going to necessarily find it this is just sort of a high-level view of the types of data that get in there are lots more and I do encourage you to talk about other types of data in the forum this week okay so let's talk about data hiding with a really really simple technique however it's a simple technique that is still many times overlooked and we've already done this so this this won't be new for you this will just be a review but so I've got five files here and I am going to append append data to these files in order to hide it for instance if I say copying /b and /b means binary otherwise if you don't use the binary you run into an issue that potentially potentially two bytes 13 and 10 could could be misinterpreted so I'm gonna say main menu dot BMP Plus D o IG XT okay and those are the source those are the source files and so it's going to put main menu dot BMP first and then it will append DOI to it DOI is a declaration of independence and now we're gonna say new file TMP and we're gonna make sure we keep that BMP extension because that way the operating system or any kind of programs that open it will we'll know where it is okay so now we have this new file dot BMP okay so here I've got my folder and you can see that Windows thinks that new file dot BMP is just simply at the NP file and by double-click I should get a file viewer to display it there you go okay you've seen that picture before it has no idea that the Declaration of Independence is appended to the end of that file so that's a really safe way to hide data so let's go and open that up in Winx everything looks normal here no problems there but if we go ahead and go to the end of this file we can obviously see that this is not BMP data this is text data there's binary data so the BMP actually ends here remember a txt file does not have any kind of a header or signature or anything like that so the only way you can really know that it's a txt file is it's just that it's text data so I can actually data carve this which you're already really good at mark the beginning mark the end and now go to edit copy blog into the file carved text EST and there we go so once again this is nothing new but I'm talking to you I'm presenting this in the in the context of data hiding but it gets a little more convoluted when we do it the opposite way for instance I could try this I could say do i dot txt plus main menu bmp-2 new file to dot txt okay and that actually worked my go-to program for viewing txt files is notepad so new file to dot txt it's taking a while cosa BMP is actually so large it's five Meg's no pet is actually not very good at viewing binary data okay so this looks really perfectly normal remember with the BMP viewer it looked normal to it just look like a regular BMP file so this also looks normal looks like a normal txt file but as we scroll through it you can see it's binary data and you can even if you're really paying attention you can see it starts with BM which obviously is a bitmap but you might not notice it because that looks kind of like text but you do notice that's a lot of binary data so the order in which you append these files is going to be really important I would never suggest appending anything to a txt file because the data you append will be so transparent when you run notepad or any other text viewer that it will almost be worthless to hide data like that so with regard to hiding file data when you hide file data using the append method consider the following you want to append to a file for which viewers always stop after the first file is interpreted remember when we append it to a BMP file the BMP viewers would just they'd load in the BMP data and they'd stop right there because that's all there because that's all there really program to do don't attend to some something such as a txt file where it's going to be totally obvious at the end of the text data that binary data follows another example of this would be say it dot CSV file or anything that it's gonna be like totally transparent to evap ended up binary data when you do look for hidden files you need to really check for two things first you need to check for file signatures such as PNG a jiff 89a BM and so forth Japheth um we've already talked about that you also need to take a look and see that data is either characteristic or uncharacteristic remember when we appended a BMP to a text file we eventually got to a point where it was obvious of this binary data or when we did the reverse when we appended a text file to a BMP at a certain point it was obvious that it was obvious that there was text data there and not binary BMP data so now let's talk about hiding some pretty some pretty simple data within image files and image files actually contain metadata called exif exif so if you right-click on an image and you go to details you actually come see that this title and subject have been set now this is a mountain comments I love UCF authors require copyright and so forth okay so this is metadata that is contained within this jpg file now you could actually go and use win hex to edit the metadata in a file however it's a very dangerous thing to do because when a jpeg file is saved if there's nothing in one of these fields it doesn't save space for it so you can actually end up really messing up the jpeg file if you use winx to edit these nice obviously you can go in and edit a string like that in with winx but you couldn't you can say add say say tags here you would definitely end up messing up your jpeg file okay so there is a way to do this pretty easily there is a website that you can go to and if you just go to color pilot comm slash exif exif HTML there's a free program that you can download that will allow you to edit exif data in PNG and JPEG files okay so let's go ahead and run this program mountain jpg that's what I showed you and remember we right clicked on it which properties details so you see everything here artist that's exactly what we saw here but let's change yours to quasi modo and I really love UCF and this is a cool mountain okay well then save that okay now let's go back to properties details and you can see that the exif data has been changed so with that program it was legally or safely i'm able to edit the exif data so this is a really nice way to hide data i want to show you one more thing about the exif data that would be really interesting so here you can actually put GPS locations there and obviously nobody nobody thinks to look for GPS in an image GPS locations that is okay so the reason that these GPS locations are there is because from your phone or whatever you might take a picture and you know there might be some interest in saving the GPS location within the exif data but let's say you had some buddies and you're involved in some sort of a conspiracy of some sort so you could actually take a JPEG or ping and put GPS data in where your next meeting is going to be and then you could actually go ahead and then you can actually go ahead and post it the internet and the information would be of the entire world but nobody would know to look for it and then you could go here and say 2:00 p.m. this moment and then they would know to meet you at that that GPS location at 2:00 p.m. so this could actually be a useful tool so there's a really fairly easy and crude way to edit BMP files so that you can hide data in them so here I've opened up a BMP file club main menu BMP and the blinking cursor is at the beginning of actual data the bitmap file header and the bitmap information header both of those together take up 54 bytes so to find the actual data where though so to actually find out where the data starts you have to skip 54 bytes but if I go ahead and click over here in in the ASCII you won't see much really and please note that this image please note that this is a busy image and one more technical detail is that BMP image is actually when they're stored on disk or in memory they're actually reversed so when we actually are starting at at the beginning of the file we're not really up here at the top we're really up at the bottom okay I know that's that's a weird thing I don't know why they decided to store store the data on disk upside down but they did when I first started decoding BMP files you know many years ago took me a while to kind of come to grips with that and have all my code deal with it now it's automatic for me when I do BMP decoders but now one really interesting thing notice down here at the bottom everything's pretty much some sort of shade of blue and another really interesting thing about BMP files we normally think of pixels this be an RGB okay we think of the red we think of the red channel the green channel from the blue channel here again stored store on disk it's not that ways when it's stored on disk assessing BG are stored in reverse order how that happened over the years I have no idea it's probably some interesting story that has a lot of history so now let's go back to Windex and if we take a look here you'll notice true enough this the blue value remember it's not RGB it's G it's it's BG R so this is the blue value skip to that screen red blue volume green red and actually so if I took over here and I went ahead into the asking and I said R I skip three there's three c k i just put my name in there and i'm gonna go ahead and save this and let's go ahead and show that again and you're never gonna see it you're never going to notice that those blue values were slightly different than the old blue values in fact I don't think I changed them more than 10 or 15 and we do steganography soon please don't confuse this was tagging ography because it does not stick an honor fee however it has similarities to steganography this i would consider would be a very naive way of hiding data within the actual BMP data if you had mostly red data you would edit the red bytes if you had mostly green data you would at the green bytes you might have some sort of grayscale where you can edit all three or something you know similar to greyscale or brighter like whites but it's safe down here to go ahead and edit the blue values so this morning I went on a long walk as I normally do in the morning and while I was thinking about this class data hiding I came up with a new method of hiding data within BMP files that's fairly robust so I came home and wrote a proof-of-concept program and the old behold it worked just fine so now I'm going to share that with you in this class and uh who knows maybe it'll turn it into something really good so this is a novel way of editing BMP files to embed information in them and here again as with the things before you can actually use the BMP for editing and convert it to a PNG file okay suppose that you have an image with relatively full colors and an image that's fairly busy the only reason that these two things are desirable is because full colors give you lots of room to play where people aren't necessarily going to see the changes you made and a busy picture is actually going to also make it unobvious make it much more easy to hide data that you've inserted so if we showed before when a color channel has a value close to ASCII values you can usually change them and not notice a difference remember what we did before when we did that really naive BMP editing so the first thing we have to do is we're going to consider groups of pixels before we were just editing the blue values okay and that that's a pretty pretty simple and as we already said naive way to do things but in order to adjust the data so that there's less of a change for each color channel or each pixel what we want to do is we want to use groups of pixels not a single pixel or not a single color Channel so what we're going to do is we're going to choose a number of pixels and then multiply that by three and that's many bytes we have to work with okay so for this example we're going to use four pixels or twelve bytes now I would definitely not suggest that you hard-code that into a program because as soon as you do that and No or people are used to four pixels 12 bytes then it's a lot easier to go ahead and decode it so what you want to do is make sure that that's a variable amount now in my example is hard-coded in terms of defines but it's just a proof-of-concept program so just make sure just make sure that those two values would vary so now suppose we have a message to hide for this program an example the message is my name is Rick line occur it's just an ASCII string it could be any string and could be any sort of buffer of symbols this supposes all of our messages are going to be in terms of bytes so for each symbol in the message we do the following so we get a total of the date so for my programming examples we're going to total up the four pixels or 12 bytes now I have group size defined as 12 but it can be anything for this example it's 4 pixels and three colour channels totalling 12 so here you can see how I just get a total for the data in the group and now I've got that total I actually created a function in my programming example so this is just a so this is just kind of an example of what I did so we have to select a mod number and this mod number what we're going to do is we're going to take our total and mod it with this mod number and that is going to be kind of our target character and we'll talk about that in just a minute I know that might not make a lot of sense but but it will shortly here again I would not hard code the number although my programming proof-of-concept example is hard-coded if everybody knows that the if everybody knows the value of that mod number this can be really easy to sort of get in there and detect the message so for my example I use 127 and the reason I picked that was because it was right there between 0 and 255 I could have picked like 128 or 126 by I just pick 127 and I think the real reason I picked that was because it's at the top of the ASCII value range and the messages I planned tied for this proof of concept we're all gonna be asking messages so that would actually give me a so that would actually make make things sort of come together a little bit faster if you had the full range from 0 to 255 say for some binary data you know you might pick something a little bit higher so the goal is to have the total for the group size data when modded with the mod number equal to the next message character okay let's say my total is a thousand a thousand modded by 127 you would get the value for that and let's go ahead okay so let's say a thousand mod 127 is a hundred and eleven okay that's an uppercase letter and that may or may not be what we're looking for but what we were trying to do is get that number to match what the next character in our messages okay so here's the code or it's not really the full code is the pseudo code for what I just described you so we have this J number and the reason we have J number is we could inside of this way loop we could have a for loop for the count from zero to group size however we might have to go more than that we might have to go more than 12 we might have to continue to to adjust each one so the first time through we might add one to each byte then we might add another tweens bytes we do that until we get to where where the mod value is correct so I have this get total function and get total just takes the data and gets the total of whatever that group size is in this case twelve mods it with a mod value and we check to see if it's equal to the next message character if it isn't we keep doing this if it's equal we bailout so here I have a method adjust which I actually don't have in the road program but just keep things simple then I increment my J variable so I don't go to the next one notice I'm doing data sub J mod group size that way I always keep in the range of 0 to 11 0 to 11 no matter how many J's they iterate to I still have values of 0 to 11 so now we're going to take a look at the source code and run through the actual nitty-gritty here is my source code it's a C++ program written in Visual Studio 2013 and I'm going to go through and explain it to you and then I'll go through and run it you bugger okay so group size is 12 that's 4 pixels x 3 color channels here again this is the define which means it's hard-coded but it it should not be mod number is 127 and I just define that for convenience i here's my count total function it takes a pointer to whatever the next group chunk is going to be in this case will be 12 bytes set so 0 and loop through and adds everything up returns the total so that's just a matter of convenience because I use it a couple of times he's actually a really bad idea I've got a BMP file hard-coded but I wanted to make this program as easy to create as possible so I did that I hard-coded that but you really need some sort of command line parameters or maybe a file selector or something so I get the file link allocate the buffer read the data and close the file so there we go now I have my message and as an explanation there are two blank bytes here that are not actually part of the message here is the dilemma you can you can decode a message but a BMP file is going to be a lot longer than the messages so then you'll go on and on and on to the end of the BMP file trying to decode a message so I left these two bytes here so I could put the message size in now for a real program what I would do is I would make this like that and I do a sprint F message to store % 0-5 new so it would have a would be padded with um so that would actually store a store that would be big enough to accommodate almost every message we'd be using but I didn't do that um I just sort shortcut this so that I only have two blank spaces but here I actually filled in the blank spaces with ASCII values for the string length I think it's 27 I'm pretty sure this okay so so the point of all this is actually put this up here corner this is better yes um the point of all this is that in the first part of the message I actually need to have the length of the message because otherwise when you go to extract the message you'll never know here's my data pointer now I load it in a BMP file and remember that a BMP file has two data structures at the beginning one is the bitmap file header and the other is the bitmap info header and altogether those are 54 bytes but rather than hard coding 54 bytes and I went in let the compiler guilty' for me and I added that the size of both of those that's actually a better programming pattern than putting 54 even though it's always going to be the same so when a compiles little compiled to sub 54 however it's just easier to read some people who come behind you know what the 54 what the meaning of the 34 is so now I start at the beginning of the message now bear in mind even though those first two bytes are just sighs I still need to encode those into the data I call my method to encount I call my method to count up to total in this particular chunk now I'm going to start my data direction meaning I'm going to add all bytes that one just by default and what I want to do is I want to make sure that for brighter pixels I'm going to add because it won't be noticed as much if you brighten in the midst of other bright pixels and won't be noticed as much however if you have darker pixels and you you dim it won't be noticed as much this is a safety though because there's a possibility that the pixels can be so bright that you don't have enough room and you'll see lean out at 255 and then you'll get stuck in Calallen if I'm less than halfway and also here here's a just a check just to make sure that I care again I could bottom out and get stuck in the while loop so my direction is negative 1 there ok so that means I'll be subtracting and said that so while my total mod the mod number remember we said we could take whatever our total was and model with a mod number well it doesn't equal the message to store well it doesn't equal a message the store I am going to adjust the data okay my delts Direction is greater than 1 that means an ad so I got to make sure I don't exceed 255 so I add to the data itself and I had to the total otherwise I'm gonna subtract making sure that I'm not at rock bottom I subtract nice and cracked j + + I go to the next in the group and notice I'm doing Jane mod group size so I never get past 0 through 1111 would be the highest value then I go to the next group of pixels which is the group size of bytes for the next round so that's all that's involved in concerning the message data into the BMP data so now what we're going to do is we're going to test it we're gonna test to make sure we got it right so here's a local buffer we point back to the beginning and the BMP file I would count the total and the total modded the mod member should be the first character okay during the next group count up the total here again so that should be twenty seven two and seven because that was that was the signs crate just for the retrieved message so we're gonna go through the size and we could actually take the string length of the message to encode but we take the integer value of that ASCII character set so for each character we count the total for the next group we put the modded value into the retrieved message and this is just an Ultraman Demian of each time we print it out and here I've gone ahead and written this BMP out just to show you that the quality perceived quality is no different let me just show you the original main menu okay a menu to you can't tell the difference okay okay so let us use the debugger and walk through this program and here I have my breakpoints set let's see what it sets the first two bytes here okay you'll see it says 27 my name is Rick Linacre so 27 is length of the string and that by the way it includes the two that includes the two size bytes point to the beginning of the point of beginning of the BMP data now what we're going to do is we're going to walk through the strength the message stream you should count the total total snow a fairly big number 220 but here we calculate the the direction we adjust the data that's pretty long just set a break point let me set a break point here yeah there's already a break point okay so now inside of the BNP we've encoded or hidden on message so now we're going to do a sort of reverse process and just make sure we got it right okay point to the back to the beginning of the BNP data okay count the total now sighs should the size of zero should be two and and it is okay so actually a lot easier to decode than to encode right size so one should be seven now we actually have to null terminate this string so we put a zero there so now 27 what we're going to do is we're going to loop through -2 because we don't have to we've already got the first two bytes so we don't need to worry about that so we loop through and I'm actually going to go ahead and set a breakpoint here so we can go through a few iterations so let's see continue continue continue so far and retreat message we have my blank space can you continue and so forth that break point there's another breakpoint else just get to there we go retrieved message my name is Rick lion occur so that's that's all there is to it so I am actively looking for some help to work on a project in fact you just looked at the project that I'd like to develop I think since it's such a new and novel idea is probably worthy of an academic peer-reviewed article so I am planning to write a peer-reviewed academic article on the previously demonstrated methodology for data hiding it is kind of a big job to do that and I know a lot of you are looking for extra credit and would like to sort of be involved in something so what I'm asking for is your help with any of the following and I can I can use the help of one person or 10 people or 20 people it's fine if I have a lot of people it's fine and I only have a couple but here's what I need help with so the code testing and cleanup and commenting and you know you just need to go someone would just need to go through and test the code under different situations with different files accept different BMP files different messages maybe create something where you know stuff is a hard coded and it could take some command-line parameters to set say the mod value and the group size and the file name and the file name and the message of course the message should actually either be something in quotes from the command line or maybe a text file with the message then I need someone to do research and just look up in amongst the other academic journals and just see if there's anything similar or you know just see what's out there I need someone to create charts and graphs so these these journal articles always look a lot better in the churchmen graphs actually break stuff up so maybe taking Visio and making sort of maybe UML diagrams for the process or or even just flow charts or something would be fine then someone needs to look for the right journal to submit this to there are lots of academic peer-reviewed journals but what we want to do is submit to the correct one so we have a better chance of getting accepted they need someone to do editing on the article I'm planning to write the article self but I need someone to kind of do a technical edit and someone to do grammar edit all so now I can pay to have a grammar edit done but the more you get done in advance the better off you are and then there might be other things that I haven't even thought of yet so you're interested in any of the following what I'd like for you to do is send an email to my UCF address and just let me know which of those are you're interested in another thing go ahead and tell me when you're available for meeting because somewhere along the way we'll have to meet as a group and then I'll try to put it together in a week or so and I think the goal would be to have this submitted by Thanksgiving so we're not a big huge rush but at least that gives us kind of a goal to have in mind then your names will get added to the article byline so this could actually really be a tremendous boost for you if you're going into academia or just even as a resume item