David Honig
Sat, 17 Feb 2001 14:59:00 -0800
At 12:49 PM 2/17/01 -0600, William Knowles wrote: >Can you tell by statistical or other fiddling with a file whether it >has stuff embedded in it? Not if the stats on the stegodata match the stats of the coverbits they replaced. 1. Measure at the stats on the least significant bits from your cover source. 2. Shape the uniform distribution you get after encryption into the form you observe from your coverbits. 3. Replace. Of course, dudes with beards and turbans posting nudie images from Afghanistan is kinda suspicious... but properly done stego is invisible. The other way to detect possibly stego's images (besides this traffic-analysis-sociology) works only if the cover image was already published ---if you stego a Playboy image copied from playboy.com any fool can detect that the 'copy' is different from the original. If you scan a paper image each scan is unique. Similarly, stego'ing an .mp3 ripped from a CD is a bad idea; stego'ing a .mp3 you made from a signal that was analogue at some point works. So dust off that vinyl. ....... "What company did you say you were from, Mr. Hewlett?" ---Walt Disney to Bill Hewlett eetimes 22.01.01 p 32