“What sending letters with more letters contacting different

“What a Digital Forensics Investigator should know about Least
Significant Bit Steganography in Electronic Communications”


DFCS H3011 – Computer & Network Forensics

Michael Hegarty


Piotr Mitka B00092937

Word Limit:3500

Word Count:3500

Due Date: 13/12/2017









Table of Contents



History of Steganography


Steganography in text

Method Based on Format

Types of Steganography

Steganography in the picture

Steganography in the Audio

The Technique of coding Bit

Spectrum Distribution method

Echo hiding

Video Steganography

Network Steganography

LSB Technique


Technique basics

Data Rate


The LSB algorithm

















History of Steganography

History of Steganography goes back and is old as much as
history of writing. Steganography has been used in different forms. The word
Steganography comes from two Greek words: 1 “Steganos” meaning “covered,
concealed, or protected” and “Graphein” meaning “writing”. One of the examples
happened during world war II. Steganography experienced a real boom during
World War II. In December 1940 one of the inspectors came up with suspicious
looking letter signed “Joe K”. Attention returned to him from seeing unusual
expressions for example the word “cannon” was used instead of “gun”. This
letter was subject thorough analysis and chemists who applied iodine vapor to
test for a hidden message. On the back of the letter there was a secret letter.
They have captured the guy that was sending letters with more letters
contacting different information’s, list of ships at the time in New York, the
number of British Soldiers sent to Iceland etc. This letter was written with
piramidonu, which is a powder used as a cure for headache and available in most
drugstores.  So even looking back at the
History we can see that Steganography was used way before, and it is still used
to this day.


To understand Steganography, we need to know what happens,
Steganography allows to cover or hide message in a file, unlike encryption,
only the sender and receiver know a communication exists. The existence is
hidden from a third party. In This research paper I would like to discuss
importance of “What a Digital Forensics Investigator should know about Least
Significant Bit Steganography in Electronic Communications”. We will dive in
into implementation and tools that can be used for steganography.

An example of a steganography in a text would be like this

Where every single letter makes up a new sentence.




We can hide messages and different information in different
files or data types. We have an equation for the steganography implementation
which is

covering medium + data to be hidden + steganographic key
= steganographic message



in text

Steganography in documents focuses only on changing some of
its characteristics. This may include text features, and even the text
formatting. Hiding information in plain text can be done in many ways. One way
is to simply add a white space and tabs to the end of the line of the document.
The last technique was successfully applied in practice, and even after the
wagering requirement of printing and copying the text, the secret message could
be further recovered, setting the background colour and font colour is one of
the most widely used approaches in steganography. This method focuses in
Microsoft word documents. Select the colour of the font and background colour
setting, invisible characters, such as space, add, undo.


Based on Format

This type of method physically hides the text. Entering a
space, intentionally misspell words and use different font sizes is a popular
technique based on formatting


Types of

in the picture

Digital images are most commonly used objects to
Steganography. Due to the availability of a variety of a file formats for
various applications of the algorithm used for these formats is different
respectively.  It is considered also as a
set of bytes that contains the different light intensity in the different areas
of the image. In the case of digital images are typical 8 and 24-bit pixel
image files. Both have advantages and disadvantages of the 8-bit images are the
perfect file extension to be used due to their relatively small size. The
disadvantage is that it can be applied to 256 possible colours, which can be a
potential problem when encoding. Several types of Steganography in images are:

The least significant bit

Inserted masking and filtering

Redundant encoding model


1.  Inserting least
significant bit (LSB) is the most famous image steganography Algorithm. In this
technique, the message is saved in the LSB pixels, which can be considered as
random noise. Therefore, change does not have any obvious effect on the image.

2.Masking and filtering techniques work better at 24-bit
images and grayscale images. Hiding information in a manner like a watermark on
a real paper are sometimes used as digital watermarks

3. Redundant encoding is to some extent like the technique
of distributed spectrum. In This technique, the message is scattered around the
image based on the algorithm. This technique makes the image ineffective for
cutting and rotating.


in the Audio

Hiding information in AVI works on the same principle as in
images, with the difference that we can encrypt a lot more information. We must
note, however that the use of any compression can destroy part or all the
hidden information.


Technique of coding Bit

Parity Bit or Checkpoint Bit is a bid added to the binary
code, to ensure that the total number of 1-bits in the chain is even or odd.
Parity bits can be used as the easiest format of error-finding code.

You can have two alternatives of parity bits, even and odd. Even
parity for a given set of bits are calculated examples of bits whose rate is 1.
If this number is odd, the value of the parity bit is set to 1, which causes
the total number of instances 1 the entire collection (including beating party)
is an even number. If the number of 1 in each set of bits is even, the value of
the parity bit is 0.



Distribution method

Secret message is sent across the frequency spectrum of the
audio signal. In this technique, the secret message bits are randomly assigned
an audio stream Direct sequence spectrum is a method in which the secret
message is distributed based on frequency chips and controlled by a random
number and attached to the signal coverage.





Echo technique is added to a discrete signal. This type of
method is also reliable and provides high speed data transmission. Because the
bits are coded one by one, the original signal is broken into blocks, encoded
with secret bits and are combined. The echo signals are placed according to
their values. The value of a binary signal offset of 1 will contain only the
digits 1, and signals from the binary correction equal to 0 will contain only
the number 0.



This technique is for hiding all kinds of files to transfer
the video file. The separation of sound and video images or result in an effective
method for hiding data. The use of video as a medium for Steganography is more
suitable when compare to other techniques, due to the size and memory
requirements for video is very similar to the images. However, there is much
difference between hiding data in pictures and video. One of the differences is
the size of the media. Because video provides higher capacity than the photo,
more secret messages can be embedded in a video file.




There are three main basic functions when it comes to
network steganography, services, applications, transport information and
control the flow of information. In traditional networks PSTN ISDN, circuit
switched data network, services, applications are generally provided by the
network transport is done through transparent channels, and control functions
and transport are virtually segregated. When the connection from end to end and
the transport channel information voice or data are sent over the network
without interference, User has little effect on the services provided by the
network and does not affect the flow of information. The internet, Packet
switched network, significantly changed the traditional paradigm of circuit
switched data network. Services applications are created by the users of the
network, and not by the same network and the transport and control functions
are not separated and you can affect them by the user.


In this technique, each binary sequence audio file is
replaced with the equivalent sequence of binary secret messages. To implement,
analogue audio signals must be converted into digital binary. The advantage of
this technique is very high throughput of water channel.



Digital data is calculated in binary format, and likewise
to mathematical representation, the right number is considered the lowest digit
where the left is considered the maximum digit. Due to the positional representation,
the least significant bit is called the rightmost bit. Least significant bit is
the opposite of the most significant bit, which transmits the highest rate in a
multiple-bit binary number which is farthest to the. In a multi-bit binary
number, the implication of a bit cuts as it comes closer to the least
significant bit. Because it is binary, the most significant bit can be either 1
or 0. When we are
trying to get a transmission of binary data it is done with the least
significant bit first technique, the least significant bit is the one which is
transmitted first, followed by other bits of increasing worth. The least
significant bit is often active in hash functions, checksums and pseudorandom
number generators.

LSB is the lowest bit in a series of numbers in
binary. e.g. in the binary number: 10110001, the least significant bit is far
right 1. The LSB based Steganography is one of the steganographic methods, used
to embed the secret data in to the least significant bits of the pixel values
in a cover image. e.g. 240 can be hidden in the first eight bytes of three
pixels in a 24-bit image.


00100111 11101001 11001000 00100111 11001000
11101001 11001000 00100111 11101001

Here if we want to hide 240 in a digital image
the first step is to convert 240 into a binary number that is 011110000 then
this 9-bit data is replaced by each least significant bit of the pixels of the


00100110 11101001 11001001 00100111 11001001
11101000 11001000 00100110 11101000


Nowadays, when we try to convert an analog image
to digital format, we have three different ways of representing colors 24-bit
colors are represented with every pixel that have one in 2^24 colors, and they
are represented by: red, green, blue, given by 8 bits in 256 values Examples:

The letter ‘A’ in ASCII code is represented as 65,
which is 1000001 in binary. It will need 3 pixels for a 24-bit image to store
an ‘A’: the pixels before changing are

10110101.11110011.10110111, 11100111.10110011.00110011

Then when we do insertion it will become this

10110100.11110010.10110110, 11100110.10110011.00110011

We can do same example for 8 bits

10000000, 10100100, 10110101, 10110101, 11110011,
10110111, 11100111, 10110011

Then by doing insertion it becomes this

10000001, 10100100, 10110100, 10110100, 11110010,
10110110, 11100110, 10110011

By looking at this numbers above we can conclude
that one least significant bit insertion usually has a 50% chance to transform least
significant bit every 8 bits, therefore adding very little noise to the
original picture or a message. For 24-bit images the change can be lengthy to
the second or even the third least significant bit without being visible. 8-bit
images as an another have additional limited space where to preference colors,
so it’s likely to change only the least significant bit without the adjustment
being visible.

Data Rate

Easiest method of LSBs insertion for 24-bit
pictures is to insert 3 bits for every pixel. As we know every single pixel is
24 bits, so it is possible to hide 3 bits in 24 data pixels, so it is 1 in 8th,
so what happens is that we hide 1 bit of hidden message for every 8 bits of the
cover image. So, by adding another insertion to include another Least
Significant bit our formula will change and there will be 6 hidden bits in 24
data pixels, so it would be 2 in 8th and we will be able to hide 2
bits of the message for every 8 bits of the cover image. So, going down this
road we can add a third insertion, so this time we end up with 9 hidden bits in
24 data pixels, so it works out 3 in 8th bits and we manage to
acquire a rate of 3 embedded bits in 8 bits of the image. Our rate for
insertion in 8-bit images is like one Least significant insertion in 24-bit
images, or in one embedded bit every eight bits. Problem we need to ask
ourselves is how many cover bytes do we need to have to send an embedded byte.
So, following our examples for one least significant bit in 24 bit-image or in
8-bit the value will be 8 divided by 1 multiply by 8 which is 8 byes, for two
LSB’s insertions in 24-bit picture would be 8 divided 2 multiply by 8 which is
4 bytes, and for three least significant bits is 8 divided by 3 multiply by 8
which works out roughly to 21.33 bytes.




Least Significant bit insertion is weak to a lot
of alterations, even the ones that are meaningless and common ones. Lossy
compression, which works on JPEG can destroy it completely. What’s most tricky
about it is the “holes” in the Human Visual System that least significant bit
insertion wants to exploit it, adding bit of sensitivity to added noise works
same as lossy compression algorithms that rely to reduce data rate of the
images. Moving onto geometrical transformations, we need to take the pixels and
scatter them around from the original grid, to destroy the embedded message,
and one that lets you recover is a simple translation. Doing a different
picture transformation for example blurring or other effects will most likely
destroy the hidden data. Least significant bit insertion is very tiny robust
technique for data hiding. It is easy to detect it or extract it. You don’t
have any theoretic outstanding mark of least significant bit insertion, only
thing that will be noticeable is little increase of background noise. It is
very simple to take least significant bit and extract it using different
programs that are widely available on internet, and be able to check if they
have something hidden or not. We can then check if its suitable for
steganography or watermarking, this is very vulnerable technique for
processing, least significant bit insertion is unusable for digital marketing
because it must face malevolent attempts at its own destruction, and on top of
that normal transformations which are compression or decompression or trying to
converse it to analog or conversion to digital. Moderately high data rate can
show as a good technique for steganography, where robustness its not important
restriction at all. We have different problems and possible answers for least significant
bit insertion, the biggest major drawback that LSB has it’s the ease of
extraction, we can’t allow hackers to easily just read what we are trying to
send. So, if we want to keep this between the sender and receiver we need to
add some techniques, encrypt the message so whoever needs to read need to
decrypt the message before it will make any sense to help us do that
randomizing the bits around using a function that is scattering will make it
nearly impossible to reconstruct the message without knowing what original seed
for the random function is. By doing this our file or message we are trying to
send is protected by two diverse keys, getting more privacy than before.  This method helps to protect the integrity of
the message, from counterfeiting the message by third parties, but we don’t
want for our file to be encrypted and scrambled for the other person, so we
need to go back what we wanted to do at the start hide the message, so we can
communicate without others knowing. Two problems we have is we need to know
what choice of image format we want 24 bits or 8 bits and if we want it
compressed it or not. We need to make a cover image casual, so it needs to be
something that would be interested of both sender and receiver something that
looks like a normal image. Then we need to make sure that it has different
colours, it must be “noisy”, so when we add a noise it will be covered by the
one that is already there. Different solid colours areas will magnify the
amount of noise added to it. Second problem we might have will be the file
size, so we need to pick the right format, because if the file will be too big
it can lead to people thinking something is going on, arise suspicion that this
file is not what it is. So we need to calculate what is the common size for a
picture on internet, with different colours, so lets take a 24-bit color which
was 150,000 pixels multiply this by 24 pixel and divide by 8 bits which is
90,000bytes which is 440KB, same thing with 8-bit color or grayscale we do
150,000 pixels multiply by 8 divide by 8 which is 150,000 which equals to
146KB. So, by looking at these sizes we know that 24-bit uncompressed picture
is not a regular size, and it is strange that sender wouldn’t compress the
image. Because it’s a practice that is used a lot and it doesn’t worsened the
quality of the image nearly at all. So, what we need to do is to modify the
JPEG algorithm that inserts least significant bit into the lossless stages or
rounding of constants of the DCT that allows to compress the image to encode
the bits. We need small image file sizes, we should resort in the 8-bit image
if we want to use LSB communication technique, because their size will look
like its normal. Another tricky part with 256 colours images is that they use
indexed palette, and trying to change the least significant bit we need to swap
a pixel from a position to an adjacent one. So, when we get adjacent
contrasting colours, it can lead to that pixel changing the colour and
revealing the hidden message. To overcome this problem we have different
methods, one of them is rearranging the palette so the adjacent colours don’t
cover each other. But it is advisable to use the 8-bit grayscale images, as it
is hard for human eye to detect any changes.


The most common and popular method of modern day steganography is to make use
of LSB of pictures’ pixel information This technique works best when the fire
is longer than the message file and if image is grayscale  When applying LSB techniques to each byte of
24 bit image three bits can be  encoded
into each pixel If the LSB of the pixel value of cover image C(i,j) is equal to
to the message bit SM of secret message to be embedded , C (i,j) remain
unchanged; if not ,set the LSB of C (i,j) to SM

message embedded procedure is given below:
S(i,j) = C(i,j) – 1 if LSB (C(i,j)) = 1 and SM = o
S(i,j) = C(i,j) – 1 if LSB (C(i,j)) = o and SM = 1
S(I,j) = C(i,j) if LSB (C(i,j)) = SM
Where LSB (C(i,j)) stands for the LSB of cover image C(i,j) and ,,SM” is the
next message bit to be embedded. S(i,j) is the stego image.















In this research paper we have examined different
types of steganography but mostly the LSB which stands for least significant
bit, we have discussed how its done with examples, different tools that can be
used and how does it work. Hiding a message with stereography methods reduces
the chance of a message being detected. In and of itself steganography is not a
good solution to secrecy, but neither is simple substitution and short block
permutation for encryption. But if these methods are combined you have much
stronger encryption routines. Like any tool steganography is neither inherently
good nor evil it is the way I is used which will determine whether is it a benefit
or a detriment to our society. Keeping that in mind we know there is some advanced
techniques for steganography, and forensics investigator will need good tools
that some don’t cover everything, so we need people in this area of expertise,
and put extra time in it, as we can see from History of Steganography it has
been used widely everywhere.
























https://en.wikipedia.org/wiki/Steganography 1














Metoda najmniej znaczącego bitu





Historia – ostatnie lata