Re: nettime Pirate Utopia, FEED, February 20, 2001
Actually, dictionary attacks reveal about sixty percent of passwords, so for every six passwords you find on a dictionary attack, you can infer ten actual stegotexts times the ratio between your analyzed and discovered (possibly-false) positives. This presumes that people who use steganography in the real world right now are similar in their password security habits to the general computer user population. Steganography is an esoteric practice, and really only interesting in the real world to people who have much more serious security worries than the average computer user. So I think this is actually unrealistic - I would bet that close to 0% of encryption keys used to encrypt data sent in the real world using steganography (assuming steganography is being used by anybody but crypto researchers right now) would be susceptible to dictionary attack. _MelloN_ - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
Grant Bayley wrote: --- begin forwarded text Status: U From: Julian Dibbell [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: nettime Pirate Utopia, FEED, February 20, 2001 Date: Thu, 20 Sep 2001 08:37:20 -0500 Sender: [EMAIL PROTECTED] Reply-To: Julian Dibbell [EMAIL PROTECTED] Key concepts: steganography, encryption, Osama bin Laden, intellectual property, temporary autonomous zone, pirates. It's a shame that Niels Provos, one of the main developers of open-source Steganography software at the moment wasn't able to detect a single piece of information hidden steganographically in a recent survey of two million images... Sort of destroys the whole hype about the use of it by criminals. He did only look for one particular encoding technique (at least, that was true when we discussed it in April), so his failure to find anything cannot be considered to be conclusive. Cheers, Ben. -- http://www.apache-ssl.org/ben.html There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit. - Robert Woodruff - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
On Fri, Sep 21, 2001 at 06:19:43PM +0100, Adam Back wrote: My point was higher level. These systems are either already broken or fragile and very lightly peer reviewed. There aren't many people building and breaking them. To elaborate on this slightly. There are inherent reasons why steganography is harder than encryption: the arms race of hiding data in noise is based on which side (the hider vs the detecter) has the best understanding of the characteristics of the host signal. The problem is the host signal is not something with clear definition, what is known is primarily empirical statistical analysis. Manipulating signals with noise in them to replace noise with the stego text is not so hard, but knowing and modeling the signal and the source noise is not a solvable problem. There will be a never-ended stream of more refined and accurate models of the signal itself, and biases in the equipment that collects the signal. So there will be always a risk that the detecter gets the edge by marginally more accurately modeling the bias, or finding a some new bias not modelled by the hider. Or, they found existing stego software and evidence of it's use on seized equipment or even some 2nd generation, non-publicly available stego software on seized equipment. There have subsequently been news reports claiming the terrorists had non-publicly available stego software written by their own expert. This still conflicts with numerous other reports, so it's not clear what's going on. But either way none of this would help the signals intelligence special interest groups arguments to ban steganography, anonymity or encryption as if anything it would be proof by example of the argument that terrorists won't have difficulty obtaining software as they can in the worst case write it from scratch. Adam - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
-- On 22 Sep 2001, at 16:11, Adam Back wrote: There will be a never-ended stream of more refined and accurate models of the signal itself, and biases in the equipment that collects the signal. So there will be always a risk that the detecter gets the edge by marginally more accurately modeling the bias, or finding a some new bias not modelled by the hider. Since the genuine signal has many sources, with different, changeable, and idiosyncratic biases, the hider always has an advantage over the detector. If they have comparable skills, and invest comparable work, the hider will always win. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG i21IhXGvGRwJ+jgxo4KF7T2KEHyMQFN3oGBVwEVM 4h+lcypb/lRfbuL3ZD17GqGiA5h+Enw8aj9LUaShL - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
Hi to you all! A word on this thread. I think you are giving missleading assertions. It's just a subtlety I'd like to mention. Perhaps you should simply notice that getting a one-use-only webmail email account and sending the message the bird is flying home or any James Bondish message like that to another one-time-use-only webmail account is also steganography. You hide a message between millions of messages within millions of accounts! It is impossible to browse and identify all those messages as dangerous. And that is because they aint. However, having a particular message, photo, or any piece of digital information and trying to gain information from it is quite a different task. Here steganography as you speak could enter the scene. My feeling is that there is no generical tool for handling all the sensible inf traveling through the web and that it's construction should be dimmed (theoretically) impossible. However, practical solutions to specific and well defined problems can and are devided daily. I hope you see my point. regards, Ariel Waissbein - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
My point was higher level. These systems are either already broken or fragile and very lightly peer reviewed. There aren't many people building and breaking them. I did read the papers; my summary is the above, and from that I surmise it would not be wise for a terrorist to use current generation steganography systems. Probably more likely would be the other posters comment that they would use pre-arranged manually obscured meaning in inoccuous email, which if done with low enough bandwidth is probably pretty damn robust and secure. However unlike the other poster, I don't consider this stego in the sense of the news report being discussed -- they are talking up the idea of banning anonymity and steganography software -- where-as in reality the software is not being used, doesn't make sense to use due to the current state of the art. The lobbying by the signals intelligence community is mis-characterizing the technical reality to further their own special interest which is easy to do as both the public and the media are easy to manipulate as they have even less understanding of anonymity and steganography than they do of confidentiality. Adam On Fri, Sep 21, 2001 at 03:10:05AM +0200, Nomen Nescio wrote: No, Provos' own system, Outguess, www.outguess.org, is secure in the latest version. At least, he can't break it. It remains to be seen whether anyone else can. See the papers on that site. - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
nettime Pirate Utopia, FEED, February 20, 2001
--- begin forwarded text Status: U From: Julian Dibbell [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: nettime Pirate Utopia, FEED, February 20, 2001 Date: Thu, 20 Sep 2001 08:37:20 -0500 Sender: [EMAIL PROTECTED] Reply-To: Julian Dibbell [EMAIL PROTECTED] Key concepts: steganography, encryption, Osama bin Laden, intellectual property, temporary autonomous zone, pirates. Attention conservation notice: It's 3300 words that I wrote 7 months ago for the late, lamented FEED. In retrospect, it's possibly a little too lighthearted about the wiles of terrorism and a little too gloomy about the demise of Napster. But it's timely again, I think, all the same. Especially in light of the 9/11-inspired crackdown on crypto. FEED 02.20.01 PIRATE UTOPIA What does Osama bin Laden's Web porn infiltration have to do with Napster's fight for life? Julian Dibbell connects the microdots. Two weeks ago USAToday broke the shocking news that Osama bin Laden's terrorist organization has infiltrated the world's supply of Web porn, hiding messages for its global operatives deep within the digits of pictures posted on Godless Western triple-X sites. For historically minded readers, the article afforded a moment of wonder at the depths of the national-security establishment's Cold War nostalgia and the media's willingness to indulge it. There was the old familiar intimacy of the alleged subversion, the thrilling suggestion that the enemy might lurk among us everywhere, sneaking into our bedrooms and our cubicles under cover of cultural trash. You very well could have a photograph and image with the time and information of an attack sitting on your computer, and you would never know it, one cyberwar expert told USAToday's reporter. I confess, though, that I got a bit nostalgic myself when I read the story. Not for the Cold War -- I was born too late to enjoy it in the fullness of its Eisenhowerian heyday -- but for its Bush-era aftermath. Specifically, I found myself looking back with melancholy fondness upon the summer of 1992, a moment perhaps not equal to the summer of '67 in its hold on the memories of a generation but one which for me, at least, holds much the same sense of freedom and promise in the bubble of its recollection. It was a moment, after all, when radical political thought was just beginning to adjust to the reality of '89, just rising to the challenge of imagining the possibilities that that reality implied. It was a moment, as well, when the Internet, long a distant, reverie-inspiring rumor known firsthand only to military contractors and computer-science majors, was just starting to enter the lives of the rest of us. But most importantly, perhaps, and certainly not at all coincidentally, it was the moment when I first learned it was possible to do with digital communications what Osama bin Laden is now reported to have done. +++ The technical name for it is steganography, from the Greek for covered writing. It is the art of keeping communications undetected, and it is not to be confused with the related discipline of cryptography. Cryptography assumes that messages will be intercepted and uses codes and ciphers to make sure they can't be understood if they are. But steganography aims for a deeper sort of cover: it assumes that if the message is so much as found to exist, the game is over. Steganographic techniques are as old, at least, as Herodotus, who documented their use among the Greeks of the 5th century B.C. In Book Seven of _The Histories_, he writes that when Demaratus, a Spartan living in Persia, got wind of the emperor Xerxes' plan to invade Greece, he contrived to tip his compatriots off by sending them a stegotext: he took a pair of folding wooden message tablets, scraped the wax writing surface off them, wrote his message on the wood, then covered his message back over with wax. Persian counterintelligence never suspected a thing. Nor did the Persians have a clue when Histiaeus of Miletus sent a similarly subversive letter home tattooed onto the scalp of a trusted slave. The messenger arrived safely at his destination and said no more than what he'd been instructed to say: Shave my head and look thereon. In contrast with cryptography, a field long given over to high math and puzzle-making abstraction, steganography was always more or less a materials science, its history florid with the range of substances and gadgetry used at one time or another to conceal communications. Simon Singh's _The Code Book_ relates that in the first century A.D., Pliny the Elder explained how the milk of the thithymallus plant dried to transparency when applied to paper but darkened to brown when subsequently heated, thus recording one of the earliest recipes for invisible ink. The ancient Chinese wrote notes on small pieces of silk that they then wadded into little balls and coated in wax, to be swallowed by a messenger and retrieved, I guess, at the messenger 's gastrointestinal convenience. The 16th
Re: nettime Pirate Utopia, FEED, February 20, 2001
--- begin forwarded text Status: U From: Julian Dibbell [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: nettime Pirate Utopia, FEED, February 20, 2001 Date: Thu, 20 Sep 2001 08:37:20 -0500 Sender: [EMAIL PROTECTED] Reply-To: Julian Dibbell [EMAIL PROTECTED] Key concepts: steganography, encryption, Osama bin Laden, intellectual property, temporary autonomous zone, pirates. It's a shame that Niels Provos, one of the main developers of open-source Steganography software at the moment wasn't able to detect a single piece of information hidden steganographically in a recent survey of two million images... Sort of destroys the whole hype about the use of it by criminals. Details on the paper below: Date: Sat, 15 Sep 2001 17:36:36 -0600 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: Detecting Steganographic Content on the Internet Detecting Steganographic Content on the Internet Niels Provos and Peter Honeyman Steganography is used to hide the occurrence of communication. Recent suggestions in US newspapers indicate that terrorists use steganography to communicate in secret with their accomplices. In particular, images on the internet were mentioned as the communication medium. While the newspaper articles sounded very dire, none substantiated these rumors. To determine whether there is steganographic content on the Internet, this paper presents a detection framework that includes tools to retrieve images from the world wide web and automatically detects whether they might contain steganographic content. To ascertain that hidden messages exist in images, the detection framework includes a distributed computing framework for launching dictionary attacks hosted on a cluster of loosely coupled workstations. We have analyzed two million images downloaded from eBay actions but have not been able to find a single hidden message. http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.pdf http://www.citi.umich.edu/techreports/reports/citi-tr-01-11.ps.gz - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
Re: nettime Pirate Utopia, FEED, February 20, 2001
Also it's interesting to note that it appears from Niels Provos and Peter Honeymans paper that none of the currently available stego encoding programs are secure. They have broken them all (at least I recognise the main stego programs available in their list of systems their tools can attack), and it appears that all of the stego encoders are naive attempts. So either the FBI and NSA are unaware of and lagging behind Provos work and the media reports are unsubstantiated hype (images could have contained stego content) designed to further alternative agendas (nasty privacy software outlawing agendas, or perhaps pure media originated hype). Or, they found existing stego software and evidence of it's use on seized equipment or even some 2nd generation, non-publicly available stego software on seized equipment. I rather doubt this second possibility as we've also seen reports that the perpetrators didn't even use crypto. Adam On Fri, Sep 21, 2001 at 08:27:00AM +1000, Grant Bayley wrote: It's a shame that Niels Provos, one of the main developers of open-source Steganography software at the moment wasn't able to detect a single piece of information hidden steganographically in a recent survey of two million images... Sort of destroys the whole hype about the use of it by criminals. Details on the paper below: - The Cryptography Mailing List Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]
