News for hackers. Stuff that matters.
Re:PNG and Hidden Pixels by onion2k on Tuesday September 01, 2020 @03:59AM (#24339528)
does adding extra data at the bottom of the image count as steganography

"steganography" is simply the act of hiding messages, so I don't see why this wouldn't count.

What term for hiding information outside of the bounds of the image would you propose instead?

Re:PNG and Hidden Pixels by 082349872349872 on Tuesday September 01, 2020 @04:15AM (#24339584)
I'd say communicating outside normal means would be "using a covert channel", and reserve "steganography" for such communication as has been whitened to resemble noise[1].

Obviously tastes may differ, so someone else might call the former "steganography" and distinguish the latter as "deniable steganography", or at least "near-noise steganography".

(with a little information theory, one can even communicate reliably via sub-noise steganography)

cryptography vs. steganography?

[1] compare Bacon (1605): https://archive.org/details/advancementofl00baco/page/256/mo...

"... a method of expressing and signifying one's mind to any distance by objects that are either visible or audible — provided only the objects are but capable of two differences ..."

Re:PNG and Hidden Pixels by onion2k on Tuesday September 01, 2020 @04:33AM (#24339664)
I'd say communicating outside normal means would be "using a covert channel", and reserve "steganography" for such communication which has been whitened to resemble noise[1].

Ah. I think I see where the confusion is coming from. You're saying this isn't steganography because the information isn't hidden in the image data. It's there in the 'plaintext'. I thought this is steganography because the image is hidden in the file data by exploiting the fact that PNG renderers don't display it.

I'm going to change my mind and say that your definition is actually better than mine. The information itself isn't hidden. You don't need a trick, or a key, or any special knowledge to view it. The fact that common PNG libraries don't display it isn't really enough to say that it's enciphered at all - you can't really say a message is definitely hidden if you assume something about the PNG library the attacker is using to view it. I don't know what the right term is, but it probably isn't steganography.

Re:PNG and Hidden Pixels by 082349872349872 on Tuesday September 01, 2020 @05:00AM (#24339780)
security per obscurity? (skotadigraphy?)
Re:PNG and Hidden Pixels by HelloNurse on Tuesday September 01, 2020 @09:49AM (#24341674)
More "security by hoping they don't look". And in fact, the suggested uses of overlong PNG chunks in the linked article aren't particularly secure ones.
Re:PNG and Hidden Pixels by hombre_fatal on Tuesday September 01, 2020 @06:28AM (#24340219)
It's hard for me to see how splitting hairs gets you any farther from calling it steganography when you find a place in a binary format where you can write arbitrary bytes. The covert channel is the payload handed over in broad daylight. How the secret is encoded or not is just impl detail.

There's obviously a spectrum of how hidden the message is. e.g. tacking bytes onto the end of the image blob vs encoding your message by inc/decrementing rgba values away from the original.

The former is trivial to remove in this case (can just diff images with different messages or run the image through an optimizer), the latter is impossible to remove though you can ruin the encoded message, but surely they both check the high level definitions of steganography.

Re:PNG and Hidden Pixels by 082349872349872 on Tuesday September 01, 2020 @08:00AM (#24340823)
I agree on the spectrum, the distinction I'm trying to make is one that Bacon wrote about in the seventeenth:

https://archive.org/details/advancementofl00baco/page/254/mo...

> "For if a letter should come into the hands of such as have a power over the writer or receiver, though the cipher itself be trusty and impossible to decipher, it is still subject to examination and question, unless there be no room to suspect or examine it."

I doubt many slaves' heads were shorn looking for messages (and if they had been, the eavesdropping would be, as in QE, obvious), but overlong images are begging to be flagged by a linter https://news.ycombinator.com/item?id=24341108 , and anyone who naively stuffs plaintext there should hope no one ever runs strings(1).

Anyway, as mentioned above, I don't care if the general case is called steganography, I'm just curious what then the specific case (of writing that has a "cover story") would be called?

Re:PNG and Hidden Pixels by yodelshady on Tuesday September 01, 2020 @08:58AM (#24341259)
Wouldn't I call the latter "encryption"?

Nothing stopping you encrypting a steganographic message. Denying message existence isn't going to be possible in a system that also compresses data and leaks file size - the latter rules out having null states (all RF communication?) or large blocks of zeros (most, if not all, storage?).

You could do something to avoid that, by doing a LOT of padding with random bits - but again, that's back to encryption, isn't it? Except encryption is something you can apply in the real world, where constant broadcast is usually impractical.

Re:PNG and Hidden Pixels by steganograaf on Tuesday September 01, 2020 @05:01AM (#24339788)
This might be how the term steganography is mostly used these days, but I disagree that it's the definition of steganography.

An early example of steganography is writing on the scalp of a person and concealing it with the regrowth of hair: https://en.wikipedia.org/wiki/Steganography#History . The message is clear-text, you just have to know where to look for it. Which is the same as in the blog post.

Some other non-computer examples: https://www.commonlounge.com/discussion/4bc16dbc2c7145ff87ad...

At the risk of "appeal to authority", my field of study is cryptography, and we used steganography in this broad sense.

tl;dr: I agree with the blog post in that it is steganography.

Re:PNG and Hidden Pixels by HelloNurse on Tuesday September 01, 2020 @10:01AM (#24341781)
If it includes a marginally hidden container with an obvious structure this sense of "steganography" seems formally correct (secrecy without a secret key) but overly broad in practice.

Consider, for example, that you can apply "normal" steganography to the image data in the overlong PNG content (claiming, for example, that you just "hid" a porn picture at the bottom of a cute kitten while there's a secret message in the whole composite picture).

Re:PNG and Hidden Pixels by 082349872349872 on Tuesday September 01, 2020 @11:46AM (#24343036)
Applying that scenario to Kabbalah, you may have just come up with an explanation for the canonical status of the Song of Songs.
Re:PNG and Hidden Pixels by HelloNurse on Tuesday September 01, 2020 @08:29AM (#24341065)
Steganography is usually meant to refer to covert, deniable information encoding, while extra data is too unsubtle to be hidden from an adversary. It's a simple and convenient trick to hide data from unsuspecting users who don't look for secrets, a weaker threat model.

Actual image-based steganography schemes, as used e.g. for watermarks, usually alter pixels in a way that is approximately (and hopefully) undistinguishable from plausible noise.

Re:PNG and Hidden Pixels by mc32 on Tuesday September 01, 2020 @07:26AM (#24340620)
Does that mean ADS is a form of steganography since ordinarily you will not see the alternate stream?