pappine/blog-contributions
1
0
Fork 0
forked from nihilist/blog-contributions
Code Pull Requests Activity

pre-release tidying

Browse Source
This commit is contained in:
Zesc 2024-09-25 19:26:40 +02:00
parent 37a4e4297f
commit 8d167abe76
2 changed files with 44 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
opsec/steganography/index.html
View File

@ -106,8 +106,8 @@
</div><!-- /col-lg-4 --> </div><!-- /col-lg-4 -->
<div class="col-lg-4"> <div class="col-lg-4">
<h4>About nihilist</h4> <h4>About Zesc</h4>
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p> <p style="word-wrap: break-word;">TBD</p>
</div><!-- /col-lg-4 --> </div><!-- /col-lg-4 -->
</div> </div>

86
opsec/steghide/index.html
View File

@ -62,18 +62,27 @@
<div class="col-lg-8 col-lg-offset-2"> <div class="col-lg-8 col-lg-offset-2">
<h1>Hiding files in images with steghide</h1> <h1>Hiding files in images with steghide</h1>
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>Zesc - 2024-08-30</ba></p> <a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>Zesc - 2024-08-30</ba></p>
<p>steghide is a mature GPL-licensed CLI tool for hiding arbitrary data inside of of image files (and some archaic audio formats). Its official web presence is located at <a href="https://steghide.sourceforge.net/">https://steghide.sourceforge.net/</a>. it conceals data inside a larger coverfile in a way that is indistinguishable to first-order statistical analysis. This means there is are anomalies in the file histogram, making most pictures innocuous without an original to compare to.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon3">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Basic Use</b></h2> <h2><b>Basic Use</b></h2>
<p>steghide is a mature GPL-licensed CLI tool for hiding arbitrary data inside of of image files (and some archaic audio formats). Its official web presence is located at <a href="https://steghide.sourceforge.net/">https://steghide.sourceforge.net/</a>, but it is ubiquitously mirrored in various repositories and package managers (<a href="https://github.com/StegHigh/steghide"></a>. If you use APT, simply install it with</p> <p>steghide is ubiquitously mirrored in various repositories and package managers. You can also find a clone of the sourceforge repository <a href="https://github.com/StegHigh/steghide">on GitHub</a>. If you use APT, simply install it with</p>
<pre><code class="nim"># apt install steghide</code></pre> <pre><code class="nim"># apt install steghide</code></pre>
<!-- <p>steghide conceals data inside a larger coverfile in a way that is indistinguishable to first-order statistical analysis. This means that without comparing to exact copy of your original coverfile, there are no anomalies to it.</p> --> <p>steghide uses subcommands, and the three most important ones are <code class="nim">info</code>, <code class="nim">embed</code> and <code class="nim">extract</code> which will be explained in sequence. For this tutorial, we are going to use the <a href="https://apod.nasa.gov/apod/ap240824.html">Astronomy Picture of the Day of 2024-08-24</a>, a beautiful image of the anti-twilight arch:</p>
<a href="apod20240824.jpg" style="text-align: center"><div><img src="apod20240824.jpg" style="width:250px;"></div></a>
<p>steghide uses subcommands, and the three most important ones are <code class="nim">info</code>, <code class="nim">embed</code> and <code class="nim">extract</code> which will be explained in sequence. For this tutorial, we are going to use the <a href="https://apod.nasa.gov/apod/astropix.html">Astronomy Picture of the Day</a> of 2024-09-08, a beautiful image of the Andromeda galaxy:</p>
<div style="text-align: center"><img src="apod20240824.jpg" style="width:250px;"></div>
<p>Our example file to hide is going to be <a href="https://bitcoin.org/bitcoin.pdf">Bitcoin: A Peer-to-Peer Electronic Cash System</a>, the original paper by Satoshi Nakamoto.</p> <p>Our example file to hide is going to be <a href="https://bitcoin.org/bitcoin.pdf">Bitcoin: A Peer-to-Peer Electronic Cash System</a>, the original paper by Satoshi Nakamoto.</p>
<p>As mentioned above, the cover image must be larger than the file you wish to embed, <b>as a rule of thumb your coverfile should be 20 times larger</b>. We can check how many bytes steghide can embed by using <code class="nim">steghide info <i>file</i></code>. In our case, it tells us that it can embed 232 KB and asks whether an attempt should be made at reading embed data without extracting. As there is nothing embedded yet, we decline with <kbd>n</kbd>.</p> <p>As mentioned above, the cover image must be larger than the file you wish to embed, <b>as a rule of thumb your coverfile should be 20 times larger</b>. (Hint: you can split larger files with tools like tar or 7z into smaller fragments to embed into a whole collection of cover files.) We can check how many bytes steghide can embed by using <code class="nim">steghide info <i>file</i></code>. In our case, it tells us that it can embed 232 KB and asks whether an attempt should be made at reading embed data without extracting. As there is nothing embedded yet, we decline with <kbd>n</kbd>.</p>
<pre><samp>"apod20240824.jpg": <pre><samp>"apod20240824.jpg":
format: jpeg format: jpeg
@ -82,11 +91,11 @@ Try to get information about embedded data ? (y/n)
</samp></pre> </samp></pre>
<p>The PDF is only 180 KB, so it fits. Next, we use <code class="nim">steghide embed -cf <i>coverfile</i> -ef <i>embedfile</i> -sf <i>destination</i></code> and get asked for a passphrase (make sure to remember it or safe it in a password manager). After re-entering the passphrase (you can set it beforehand with the <code class="nim">-p</code> option) it will write the processed file to the specified destination. You can also leave out the <code class="nim">-sf</code> option, in which case it defaults to overwriting the coverfile. Look at it and try to find a visual difference to the original:</p> <p>The PDF is only 180 KB, so it fits. Next, we use <code class="nim">steghide embed -cf <i>coverfile</i> -ef <i>embedfile</i> -sf <i>destination</i></code> and get asked for a passphrase (make sure to remember it or safe it in a password manager). After re-entering the passphrase (you can set it beforehand with the <code class="nim">-p</code> option) it will write the processed file to the specified destination. You can also leave out the <code class="nim">-sf</code> option, in which case it defaults to overwriting the coverfile. Look at it and try to find a visual difference to the original:</p>
<div style="text-align: center"><img src="output1.jpg" style="width:250px"></div> <a href="output1.jpg" style="text-align: center"><div><img src="output1.jpg" style="width:250px"></div></a>
<p>It's completely lost in the visual noise. As an experiment, let's try taking the difference of both images with a program like GIMP. This is what it looks like:</p> <p>It's completely lost in the visual noise. As an experiment, let's try taking the difference of both images with a program like GIMP. This is what it looks like:</p>
<div style="text-align: center"><img src="difference.jpg" style="width:250px"></div> <a href="difference.jpg" style="text-align: center"><div><img src="difference.jpg" style="width:250px"></div></a>
<p>A difference of zero means a fully black pixel. Try zooming in and you'll see that only a few pixels are slightly lighter than black. These are the pixels that contain parts of your embedded file in their least significant bits..</p> <p>A difference of zero means a fully black pixel. Try zooming in and you'll see that only a few pixels are slightly lighter than black. These are the pixels that contain parts of your embedded file in their least significant bits.</p>
<div><b>WARNING: changing the output file in anyway will make the embedded file irretrievable. This is especially important for every form of lossy compression!</b></div> <div><b>WARNING: changing the output file in anyway will make the embedded file irretrievable. This is especially important for every form of lossy compression!</b></div>
@ -102,55 +111,40 @@ d56d71ecadf2137be09d8b1d35c6c042 output.pdf</samp></pre>
</div> <!-- /container --> </div> <!-- /container -->
</div><!-- /grey --> </div><!-- /grey -->
<!-- +++++ Second Post +++++ -->
<div id="anon3">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Advanced Use</b></h2>
<h3><b>Changing the encryption</b></h3>
<p>As you've seen, steghide needs a passphrase to embed and extract data. (Note: using an empty passphrase can lead to issues extracting.) This passphrase is used to both encrypt your file before embedding and to seed the PRNG by which it selects pixel positions for embedding data. By default, it uses AES-128. You should not rely on steghide for securing your data cryptographically (see the <a href="../index.html">introduction to steganography</a>), and when in doubt you can separately encrypt the file before embedding, but you may still want to change the used algorithm. For this, simply use <code class="nim">-e <i>algorithm</i> <i>mode</i></code></p>. You can list all available modes with <code class="nim">steghide encinfo</code>. So as example, to embed our previous picture using AES-256 in cipher feedback mode, you would use this:
<pre><code class="nim">$ steghide embed -cf apod20240824.jpg -ef bitcoin.pdf -e rijandael-256 cfb </code></pre>
<h3><b>Use steghide recursively</b></h3>
<p>Since steghide works on arbitrary binary data, you can embed steghide's output into another picture, provided the size is sufficient. The 4.8 MB picture below contains a 260 KB waveform audio file which in turns contains 2.7 KB UTF-8 encoded text file. (The passphrase is <kbd>moon</kbd> for both.)</p>
<div style="text-align: center"><img src="apollo11.jpg" style="width:250px"></div>
<p></p>
<p></p>
<p></p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ --> <!-- +++++ Second Post +++++ -->
<div id="anon1"> <div id="anon1">
<div class="container"> <div class="container">
<div class="row"> <div class="row">
<div class="col-lg-8 col-lg-offset-2"> <div class="col-lg-8 col-lg-offset-2">
<h2><b>Setup</b></h2> </br> </br> <h2><b>Advanced Use</b></h2>
<p></p> <h3><b>Common Pitfalls</b></h3>
<pre><code class="nim"> <p>There are a couple of things you shouldn't do with steghide. Here a quick overview:</p>
<ol>
<li><p><b>Use strong passwords:</b> Always a given. The password to steghide can be brute-forced like every other password. <a href="https://github.com/RickdeJager/stegseek">stegseek</a> can brute force 14 million passwords in under 2 seconds.</p></li>
<li><p><b>Use original images:</b> Known images can be easily double-checked against your cover files. If for example the Monero icon on your website is different to that included in the official press kit, that's suspicious, defeating the purpose of steganography. Make sure to only use this with originals only you are in possession of - in a pinch, adding an in-picture caption, resizing it, etc. offers plausible deniability, as different image editing programs are notoriously variant in handling pixel-level details.</p></li>
<li><p><b>Avoid images with little detail:</b> Images without pixel-level visual noise (e.g. diagrams, images of text, etc.) will have less hiding space, and become visible deteriorated when files are embedded. For demonstration purposes, compare <a href="map.jpg">this map</a> with its <a href="map_orig.jpg">original</a>, then look at <a href="map_diff.jpg">their difference</a>. The embedded file was a mere 4286 B in size, yet these two files differ by 6693 B in size! (The password is left as a brute-forcing exercise for the reader.)</p></li>
<li><p><b>Avoid format conversions:</b> Even "lossless" conversions from one image format to another tend to be non-reversible, making it impossible to retrieve the hidden data. Remember that many popular websites compress all images uploaded to them to save on bandwidth, making them unsuitable for our purposes.</p></li>
</ol>
<h3><b>Changing the encryption</b></h3>
<p>As you've seen, steghide needs a passphrase to embed and extract data. (Note: using an empty passphrase can lead to issues extracting.) This passphrase is used to both encrypt your file before embedding and to seed the PRNG by which it selects pixel positions for embedding data. By default, it uses AES-128. You should not rely on steghide for securing your data cryptographically (see the <a href="../index.html">introduction to steganography</a>), and when in doubt you can separately encrypt the file before embedding, but you may still want to change the used algorithm. For this, simply use <code class="nim">-e <i>algorithm</i> <i>mode</i></code>. You can list all available modes with <code class="nim">steghide encinfo</code>. So as example, to embed our previous picture using AES-256 in cipher feedback mode, you would use this:</p>
<pre><code class="nim">$ steghide embed -cf apod20240824.jpg -ef bitcoin.pdf -e rijandael-256 cfb </code></pre>
<h3><b>Using steghide recursively</b></h3>
<p>Since steghide works on arbitrary binary data, you can embed steghide's output into another picture, provided the size is sufficient. The 4.8 MB picture below contains a 260 KB waveform audio file which in turns contains 2.7 KB UTF-8 encoded text file. (The passphrase is <kbd>moon</kbd> for both.)</p>
<a href="apollo11.jpg" style="text-align: center"><div><img src="apollo11.jpg" style="width:250px"></div></a>
</code></pre>
<p></p> <p></p>
<pre><code class="nim">
</code></pre>
<p></p> <p></p>
<pre><code class="nim">
</code></pre>
</div> </div>
</div><!-- /row --> </div><!-- /row -->
</div> <!-- /container --> </div> <!-- /container -->
</div><!-- /white --> </div><!-- /white -->
<!-- +++++ Footer Section +++++ --> <!-- +++++ Footer Section +++++ -->
<div id="anonb"> <div id="anonb">
@ -174,8 +168,8 @@ d56d71ecadf2137be09d8b1d35c6c042 output.pdf</samp></pre>
</div><!-- /col-lg-4 --> </div><!-- /col-lg-4 -->
<div class="col-lg-4"> <div class="col-lg-4">
<h4>About nihilist</h4> <h4>About Zesc</h4>
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p> <p style="word-wrap: break-word;">TBD</p>
</div><!-- /col-lg-4 --> </div><!-- /col-lg-4 -->
</div> </div>