Credit: ©Zbigniew Zdziarsk / http://zbigatron.com
Hidden messages in seemingly innocent videos, photos, audio or text. Criminals can use these messages to notify others in which container they have concealed drugs or display child sexual abuse material on a public platform. The hidden messages are hard to spot with the naked eye. The Netherlands Forensic Institute (NFI) is participating in the European UNCOVER project, which entails law enforcement agencies working with universities and businesses to develop tools to detect and read hidden messages in videos and images.
The art and science of hidden messages is called steganography.
“It’s an art form because it’s creative, but it’s a science because you need to know how to hide the message in digital images or videos,” said Meike Kombrink, who is working on steganalysis (hidden message detection) at the NFI. You need to know how it works.”
Examples
Al-Qaeda supposedly used steganography to plan the 9/11 attacks, as revealed by a scientific publication (Dalal and Juneja, 2021). The paper also mentions that Russian agents used steganography in 2010 to send secret messages to Moscow. The method was discovered by the FBI. Child sexual abuse material was concealed in seemingly innocent images in the Shadowz Brotherhood case. International scientists are warning that steganography has been rising in popularity since law enforcement agencies demonstrated that they can crack encryption using EncroChat (O'Rourke, 2020).
Several criminal cases in the Netherlands have involved suspects using steganography. In those cases, the NFI was able to read the messages.
Steganography was used in an extortion case back in 2003, for instance. The suspect asked to receive hidden bank details via an image posted on a certain website, otherwise the extortionist would follow through on threats.
“We suspect that it’s being used,” said Kombrink. “You can’t spot it with the naked eye. It’s probably a lot more common than we’re seeing. That is why we keep raising awareness and drawing law enforcement agencies’ attention to it.”
Adjusting the color intensity of images
An object containing a hidden message is called a cover. There are three commonly used ways of concealing messages in images, each of which also has several variations. The first way is to modify the binary values of the colors in images. This involves adjusting the color intensity of a pixel, for example.
“You add a tiny drop of red, as it were, to the color code. You can’t see the difference just by looking at the photo. You can sometimes spot it when looking at the binary values. Again, the modified values can indicate the presence of a hidden text,” explained Kombrink.
Another method of concealing messages is by means of transformation, a different way of displaying the image. One example is to compress the file, i.e. reduce it in size in order to save it.
“That involves creating a kind of summary of the image, as it were,” explains Kombrink.
There are various ways of summarizing an image. The most important numbers for the image end up in the summary. If you know where they are, then you can conceal a message there.
“You won’t see the message in the full-sized image. It only becomes visible once you have made a summary of the image and know where in the summary the message will be hidden,” says the stenography researcher.
The third way is to use AI to generate images, audio or text concealing a message. Ordinarily, you will have an original image in which a message is concealed by making some adjustments, which means you need to have a good idea as to where you can conceal the message without changing the way the image looks. You do not need such knowledge for the third method.
“Here, you don’t have an original; the neural network itself produces an image with the hidden message pre-concealed,” said Kombrink.
Detecting steganography
The NFI is currently investing in automated systems to detect steganography in conjunction with European partners. The NFI is researching whether neural networks are effective at detecting concealed messages. In terms of their structure, neural networks were inspired by the human brain. The models learn in a similar way to human learning, i.e. through looking at lots of examples.
Mart Keizer, a student from Eindhoven University of Technology, recently studied whether neural networks are capable of discovering concealed messages in video files (video steganalysis). Keizer was commissioned to do so by NFI in the context of an internship.
For the purposes of the study, Keizer produced a large data set containing videos that did or did not contain concealed messages. Giving the neural network an ample quantity of videos and informing it as to whether or not they contained a concealed message enabled the network to discover a particular pattern for itself. This allows it to detect whether a video contains a concealed message. Once the network has been “trained,” it can be used to ascertain whether or not there is a concealed message in a video file. Further research is needed, but the initial results were promising, with the detection rate for two researched types of steganography being 99.96%.
Message reading tool
It is not enough to just develop detection tools, says Kombrink.
“Steganography in itself isn’t a criminal offence at present,” he said. “You could also conceal perfectly innocent messages. Hence, you need to know the content in order to identify a less innocent message. And so I’m also keen to train neural networks to automatically read messages.”
Kombrink suspects that steganography is not currently being used in straightforward crime.
“You still always need to communicate the method that is used to hide the message and thus is needed to extract the message. It is therefore more likely to be used for high-impact crimes.”
Once the tool is ready, Kombrink thinks it would be a good idea to add it to the Hansken digital search engine, which can be used to examine vast quantities of digital data in criminal cases.
“It’ll be interesting to see,” he said. “Only once the tool is up and running will we find out on what kind of scale steganography is being used in the Netherlands. Until then, we need to stay alert when performing manual searches.”
Republished courtesy of NFI.