Homework Assignment 4: Steganography Lab Purpose: The goal of this lab is demonstrate one of the many ways that terrorists, hackers, or other criminals can covertly pass information within files on...

Homework Assignment 4: Steganography Lab


Purpose: The goal of this lab is demonstrate one of the many ways that terrorists, hackers, or other criminals can covertly pass information within files on the Internet, Facebook, or other public forums. It is designed to raise awareness among network administrators and security officers so that they can acquire tools such as StegDetect or Camerashy that can look for hidden messages in images posted on corporate web servers.

Files needed: Quick Stego software by Quickcrypto.com and a very large bitmap file (.bmp).
Objective: Use steganography to effectively hide one file within another one such that the file system/operating system doesn’t detect it.

1. Create a file on your desktop using Notepad that will be hidden in the image.


2. Identify a large image (.bmp file) that will be used as your “carrier” file to hide your other file in. If you don’t have one, open up a .jpg file in Paint (Accessories) and save it as a bitmap file (.bmp).


3. Record the file size of both bitmap.bmp file and your text document that you will hide in your carrier file.


4. Install Quick Stego onto your PC, a free download is available from: http://quickcrypto.com/free-steganography-software.html


5. After installing, Run the program by clicking on the icon.


6. Click on Open Image and find your carrier file.


7. Click on Text File and Open Text – find the document your created and click on it. The text that you want to hide should be present in the right-hand window.


8. Click on the Hide Text button. You will see a message at the bottom of the window that says “The text message is now hidden in image”.


9. Click on Save Image and name it
   hiddenfile.bmp.
   


10. Open up hiddenfile.bmp by double-clicking on it. Can you tell that you have this file hidden within the other one?


11. Compare the original with the stego copy Is there a discernible difference in resolution? Is there a difference in file size?


12. Now Run the Quick Stego program again and open up the hiddenfile.bmp. Do you see the text?


13. Perform an MD5 hash on the two files (your original .bmp file before you embedded the file and hiddenfile.bmp that you hid the document in) using the Advanced Checksum Verifier (avcsi.exe – from http://www.irnis.net/ - demo software ) or HashCalc from LavaSoft (freeware)
    – are the hashes different?
    


14. 
    Download and use Camerashy to attempt to analyze hiddenfile.bmp. Was it successful?
    

Questions to answer:

1) What tools can you locate on the Internet that can help you detect files hidden in other files?
2) Why did, or didn’t, the file size differ between the original file and the file with the document hidden inside?
3) Were you able to successfully identify the file hidden in hiddenfile.bmp with Camerashy or another tool?
Summary
I hope that you all have downloaded FTK 1.81.6 by now. I would like for you to spend some time learning a little about it, especially the search capability. Assignment 4 will be related to the final, and will require the use of FTK. I will post an image for Assignment 4 that will include a version of the final exam questions, and I hope that everyone will find the questions on the image. If you do, you can use these questions to study for the final. If you do not, the final will be posted on time and you will have the entire final period to finish it. So, the mission for this week is to play with FTK 1.81.6. This is the up to date version of FTK 1.81.6 as of July 13: http://accessdata.com/downloads/current_releases/ftk/FTK-Forensic_Toolkit-1.81.6.exe in case you have not yet downloaded it.