I think they are sticking the encrypted message into a jpeg metadata field?
I've been thinking for a while that a subtler version of this -- where the encrypted message is overlayed into the picture data -- would be very hard to detect.
I'm thinking down a path where using strong encryption would be illegal and all communications are monitored, so hiding the fact that an encrypted message even exists is important.
The idea is that the encrypted signal would be essentially indistinguishable from random noise so as long as the message isn't very dense relative to the picture it would be hard to determine it was even there. Also, people naturally and normally send all kinds of inane pictures back and forth so it seems like it would be hard to even infer the existence of an encrypted conversation from data sharing patterns.
And, as long you're using a lossless format, it's trivial to encode arbitrary data with imagemagick. You do have to calculate the size beforehand, 14 bytes as a 7x2 image in this example:
$ echo -n "this is a test" | convert -size 7x2 -depth 8 GRAY:- output.png
$ convert output.png GRAY:-
this is a test
So, you create the png with your data (encrypted first if you want), then use the IM stegano option to embed the noisy png into a larger image so it's not so obvious.
Indeed, yes. That is exactly what I expected to find here. Encode the message in high-frequency image components. I think the challenge is making that robust against image manipulation, so perhaps add some kind of LDPC code for forward error correction.
This is what I remember and it was a really classic example even in Schneiers book. But yeah easy overlay method was just picking a picture with the number of pixels >= number of encrypted message bits.
Make the LSB of each pixel equal to a bit value of the message. EZPZ lemon squeezy and it doesn't affect the image visually. If your message was encrypted well then also the bits would appear randomly so no one would be able to be certain a message was contained as you said.
It hides data in the least significant bits (at locations defined by a passphrase) of the image or audio data itself. This doesn't survive re-compression, though (there are methods that do).
Agreed, though that would require a lossless format (e.g. png) and would limit exchanges to sources that don't change the image (e.g.as email attachment) but not social networks that resize or otherwise reprocess the image
I've been thinking for a while that a subtler version of this -- where the encrypted message is overlayed into the picture data -- would be very hard to detect.
I'm thinking down a path where using strong encryption would be illegal and all communications are monitored, so hiding the fact that an encrypted message even exists is important.
The idea is that the encrypted signal would be essentially indistinguishable from random noise so as long as the message isn't very dense relative to the picture it would be hard to determine it was even there. Also, people naturally and normally send all kinds of inane pictures back and forth so it seems like it would be hard to even infer the existence of an encrypted conversation from data sharing patterns.