At 12:49 PM 2/17/01 -0600, William Knowles wrote:
>Can you tell by statistical or other fiddling with a file whether it
>has stuff embedded in it?
Not if the stats on the stegodata match the stats of the coverbits
they replaced.
1. Measure at the stats on the least significant bits from your cover
source.
2. Shape the uniform distribution you get after encryption into
the form you observe from your coverbits.
3. Replace.
Of course, dudes with beards and turbans posting nudie images
from Afghanistan is kinda suspicious... but properly done stego
is invisible.
The other way to detect possibly stego's images (besides this
traffic-analysis-sociology) works only if the cover image was already
published ---if you stego a Playboy image copied from playboy.com any fool
can detect that the 'copy' is different from the original. If you scan a
paper image each scan is unique. Similarly, stego'ing an .mp3 ripped from
a CD is a bad idea; stego'ing a .mp3 you made from a signal that was
analogue at some point works. So dust off that vinyl.
.......
"What company did you say you were from, Mr. Hewlett?"
---Walt Disney to Bill Hewlett eetimes 22.01.01 p 32
