{"id":122,"date":"2011-07-11T21:47:32","date_gmt":"2011-07-11T21:47:32","guid":{"rendered":"https:\/\/www.cores2.com\/blog\/?p=122"},"modified":"2011-07-11T21:47:32","modified_gmt":"2011-07-11T21:47:32","slug":"steganography-where-obfuscation-might-be-a-good-idea","status":"publish","type":"post","link":"https:\/\/www.cores2.com\/blog\/?p=122","title":{"rendered":"Steganography – where obfuscation might be a good idea!"},"content":{"rendered":"

Security through obscurity is one of the worst approaches someone might take when it comes to computer \/ network security. I’ve heard in real-world situations between students and professional\u00c2\u00a0programers\u00c2\u00a0say “Sure, the passwords are saved as plaintext, but the database table names are all obfuscated; no hacker will find them!”.\u00c2\u00a0Though I’m sure this isn’t the average case, it bothers me\u00c2\u00a0enormously that many\u00c2\u00a0universities\u00c2\u00a0and companies don’t do formal security training. Giving your programmers Code Complete<\/a> is a great idea, but I don’t think it’s enough – programmers have to have it beat into us that obfuscation is NOT<\/strong> a valid security approach!<\/p>\n

I won’t talk about how to fix this, there’s plenty of tools, academic resources, training programs, etc. to help programmers learn and improve their designs. What I will talk about is\u00c2\u00a0steganography<\/a>. I heard some not-so-reputable\u00c2\u00a0sites such as 4Chan were encoding data and adding it to meta-data in images. At first I thought it was kind of silly; everyone could just open the file and see it… but then again, we live in the golden age of media-transfer on the web: who sees images on the web and thinks “Maybe there is something hidden in here” outside of what you actually see<\/strong>. Stenography is a method of obscuring data transmission by adding it through mediums one wouldn’t think acceptable for data. The GIF file format has an interesting structure such that there is a single or double byte pattern that declares the end of the file. If you put text after that, most image viewers and browsers would see the image and never report a corruption because nothing changed the formal structure; yet the hidden data is there and never seen by the image viewer.<\/p>\n

So, to learn more, I hid some data through several levels of encryption, obfuscation, and stenography. In the following steps we will be taking a funny GIF image, and we will follow the white rabbit down the hole to wonderland. (Pardon the cheesy quote, I had to, ha)<\/p>\n

    \n
  1. \u00c2\u00a0Check out this funny GIF of some ninja-wrestling\u00c2\u00a0moves<\/a>; millions must exist on the web, and such technology is nothing new, dating back from the late-80s. You wouldn’t do\u00c2\u00a0anything\u00c2\u00a0with this file other than smirk, right? Well, lets dive in…<\/li>\n
  2. Download the gif and open it in any text editor<\/strong>\u00c2\u00a0of your choice; notice at the end there is\u00c2\u00a0constant\u00c2\u00a0ASCII strings?<\/li>\n
  3. Copy this string data (it’s a GnuPG message) and decrypt; password is “png”<\/li>\n
  4. The result is a png file (change file extension if needed)<\/li>\n
  5. Open png file, it is a multi-color QR code; if you attempt to decode it, you get junk data<\/li>\n
  6. Individually process each color channel in RGB order, meaning do a QR decode on the red channel first, then green, and finally blue<\/li>\n
  7. Put the QR decoded text together, you get a new GnuPG block; password is “steganography”<\/li>\n
  8. This result is the final data, i.e. the original message that was encoded<\/li>\n<\/ol>\n
    I’ll leave it up to the reader to find the quote – it’s somewhat applicable, and around 200 characters. This is actually one of the biggest down-sides of this multi-level approach I did: The deeper you go, the more bloated the size becomes. that 200 character ASCII text bloated to around<\/div>\n

    So what I learned is there are some serious ways and methods of hiding data easily through obfuscation tied with true security (i.e. PGP encryption); though I can’t imagine any use for this and general stenography for industry-level products and services, this is 100%\u00c2\u00a0legitimate\u00c2\u00a0spy-level information\u00c2\u00a0transfer. Stuck in North Korea and need to send a secret message?\u00c2\u00a0Attach\u00c2\u00a0the encrypted data to an innocent picture that will get past the censures and tada! Secret 007 mission accomplished.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Security through obscurity is one of the worst approaches someone might take when it comes to computer \/ network security. I’ve heard in real-world situations between students and professional\u00c2\u00a0programers\u00c2\u00a0say “Sure, the passwords are saved as plaintext, but the database table … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-news_updates"],"_links":{"self":[{"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=122"}],"version-history":[{"count":0,"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/122\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cores2.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}