First of three parts
Geek frat boys use it to smuggle exam answers around campus. Authors use it to create watermarks in digital files so ownership of intellectual property can later be substantiated.
But not all applications of steganography are so benign. Steganography-the ancient art of hiding information by embedding a message within another, seemingly harmless, message-is beginning to attract more and more forensic attention. (Steganography is not to be confused with encryption. Encryption relies on ciphers or codes to scramble a message, and a corresponding key to unscramble it.)
The practice of steganography is nearly as old as crime and intrigue themselves. Ancient Greeks tattooed messages on the shaved heads of messengers. Then, once the hair grew back, the messenger was dispatched. During World War II, messages were written in a substance that would darken when heated, such as lemon juice, milk, or urine. Upon receipt, the recipient would know to heat the paper so the secret message would appear.
In the digital age, steganography allows someone to hide any type of binary file inside any other binary file. Image and audio files are common carriers. A digital image of the sunset, for instance, might also contain an invisible message or a map. Hidden in an MP3 music file might be blueprints of the Hoover Dam.
It has been reported that steganography may be one of the ways al Qaeda leaders communicate with terror cells around the world, as claimed by USA Today (Feb. 5, 2001).
It might go something like this. Every Friday morning, the leader of a West Coast terrorist cell offers a different framed Golden Gate poster for sale on eBay and posts a corresponding digital image. Bids commence, money exchanged, items shipped. So far so good.
Then, precisely at noon local every Sunday the original photo is swapped for a higher-resolution version containing a secret message hidden in the image file. By prearrangement, cell members know when to download the new version. Thus, the weekly message is delivered.
Detection of illicit uses of steganography therefore is becoming a necessary forensic skill. While some doubt that terrorists would need to be that technically savvy to communicate with each other, there is evidence that steganography is exploited by domestic entities such as organized crime to conceal financial secrets or by those engaged in corporate espionage. It gets worse.
"I know of a case where steganography was employed to conceal child pornography," says steganography expert Neil F. Johnson, an associate at Booz Allen Hamilton, and author of several papers that examine steganography. Using patterns Johnson had published in earlier papers, forensic investigators were able to determine the existence of hidden images and the steganography tool used to produce them.
Johnson says forensic investigators should learn to look deeper into seized or recovered computers to find what evidence may be lurking, hidden behind seemingly innocuous files. He says steganography goes beyond the challenges of encrypted data in that an investigator must now be able to determine whether hidden data exists.
"Investigators should become familiar with steganographic tools and the impact they have on computer systems, as well as the media that contains the hidden information," Johnson says.
Next week: "Under the radar"
