BitmapSteganography:

AnIntroduction

BeauGrantham 20070413 COT4810: TopicsinComputerScience Dr.Dutton

I.Introduction Steganographyisdefinedastheartandscienceofcommunicatinginawaywhichhidesthe existenceofthecommunication[2].Methodsofsteganographyhaveexistedforcenturies,thoughwith theadventofdigitaltechnology,havetakenonanewform.Embeddingdatawithintheredundancyand noiseofmediafilesisamongthesedigitaltechniques.InthisarticleIwillexploreandimplementthe processinvolvedwithhidingmessagesandfileswithinuncompressedbitmapimagefiles.Itwillpresent theresultsofapplyingtheleastsignificantbitprocess,andexploreareasforimprovement. II.IntroductiontoSteganography Examplesofsteganographydateasfarbackas440B.C.,whereHistiuswassaidtoshavethe headsofslavesandtattoomessagesonthem.Oncethehairhadgrownback,themessagewaseffectively hiddenuntilthereceivershavedtheheadsonceagain.Anothertechniquewastoconcealmessageswithin awaxtablet,byremovingthewaxandplacingthemessageonthewoodunderneath.[1] Beingabletocommunicatemessagesbetweentwoormorepartieswithoutraisingsuspicionisa powerfultechnique.Thisisanimportantanddistinguishingfeaturefromthecloselyrelatedfieldof cryptography,whereplaintextmessagesaretransformedintounintelligibleblocksofciphertext.While cryptographyfocusonprivacy,steganographyisfocusedonsecrecy,andhasnointerestinthemessage itself.[4] Theabilitytocommunicatemessageswithoutraisingawarenesscanbeapowerfultechnique,and evenmoresowiththeconceptofplausibledeniability.Whenappliedtocryptographyandsteganography, thistermreferstotheabilitytoplausiblydenythatarecoveredmessagewaseverencryptedorhidden.In cryptography,thisconceptiscloselyrelatedtotheonetimepadcipher,whereamessagecouldpossibly transformedintoanyothermessageatheoreticallyunbreakablecipher.Insteganography,itisclosely relatedwiththerandomsamplingofbitsthroughoutpatternsinthefile.Beingabletoplausiblydenythe resultsofsomeanalysiscanbeusedtoonesadvantage.[4] Steganography in digital technology is often associated with files which require a human perspective toverifytheintegrityandquality.Thisincludestherealmofmediafiles(video, audio, images).Imagefileslendthemselvestoexploitationparticularlywell,whichwewillexplorethroughout thisarticle.Focuswillprimarilybeonbitmapformattedimages.[1] III.BitmapImages BitmapimagesarewereintroducedbyMicrosofttobeastandardimagefileformatbetweenusers oftheirWindowsoperatingsystem.Thefileformatisnowsupportedacrossmultiplefilesystemsand operatingsystems,butisbeingusedlessandlessoften.Akeyreasonforthisisthelargefilesize,

resultingfrompoorcompressionandverbosefileformat.Thisis,however,anadvantageforhidingdata withoutraisingsuspicion.Tounderstandhowbitmapimagescanbeusedtoconcealdata,thefileformat mustfirstbeexplained. IV.BitmapFileFormat Abitmapfilecanbebrokenintotwomainblocks,theheaderandthedata.Theheader,which consistsof54bytes,canbebrokenintotwosubblocks.TheseareidentifiedastheBitmapHeader,and theBitmapInformation.Imageswhicharelessthan16bithaveanadditionalsubblockwithintheheader labeledtheColorPalette.FollowingtheheaderistheBitmapData.[3] BitmapHeader TheBitmapHeaderisusedtoidentifythefileasavalidbitmapimage.Thisisdoneprimarilyby thefirsttwobytes,whichread0x42and0x4D(inASCII:BM).Thefollowingfourbytesexpressthesize ofthefile,andtheremainingeightbytesarereservedforapplicationidentificationandoffsetlengths.
0-1 2-5 6-9 10-13 Bitmap identifier 0x42 0x4D (in ASCII it reads BM) Bitmap file size Reserved Bitmap data offset

TheBitmapInformationiscomposedofthenextthirtybytesofthefile,startingatbytefourteen. Theinformationisdescribedasfollows:
14-17 18-21 22-25 28:29 26-27 28:29 30-33 34-37 38-41 42-45 46-49 50-53 Bitmap Bitmap Bitmap Bitmap Number Bitmap Bitmap Bitmap Bitmap Bitmap Number Number header size image width image height color depth of color planes color depth compression method data size image horizontal rule image vertical resolution of colors used of important colors used

Thecolorpaletteisnotusedwhendealingwithbitmapimagesof16bitorhigher. BitmapData TheBitmapDatablockofabitmapfilecontainstheactualimage,storedaspixels.Thisfile formatexhibitssomeuniqueproperties,oneofwhichlendsitselftoexploitationforsteganography.First isthattheimagestoresitselfinreverse.Thefirstlineofdatacorrespondstothebottomlineofanimage,

movingitswayup.Inaddition,thepixelsarestoredinreversebluefirst,followedbygreenandthen red.Thepropertythatisimportanttosteganographyisthefactthatthesepixelsareexplicitlywrittenout inthefilewhichallowsforeasyidentificationandmodification. FollowingisasnippetoftheBitmapDatablockofabitmapimage.

35 DB F5 4B D9 F1 42 D9 EC 3C D3 EB 35 CF EA 35 D2 EC 32 CA EF DA F3 48 CF EF 4B D3 F1 35 CF EE 35 D2 EE 38 CB EF 34 CB EB 37 F2 52 DE EB 41 DA ED 45 CF EE 41 D4 F0 34 CC EA 32 CC EB 32 C7 37 DA F3 47 D8 F2 3B DA EB 42 CD EE 3B D1 EA 3B CC EB 35 D1 EA D7 EF 52 DC EF 45 D3 F4 3D D3 EB 38 D1 ED 3A CE EA 30 CD EF 33 F2 4E DB F3 43 D1 F1 3D D6 F1 34 D1 EF 33 D1 EC 39 CC EB 31 CD 47 DC F0 4D D3 EE 46 D1 EF 3D D1 EC 3B CD EE 34 CC EB 37 D1 EB DC F3 4D DB F0 47 D8 EE 3F CD EF 36 CE EC 40 CB EB 32 D1 ED 31 F2 44 DA F2 46 D3 F2 3B D2 EB 39 D4 EC 3B D2 EB 3B CF EE 33 D2 46 DC F2 4A D6 EC 47 D2 EE 3D D0 EE 33 CF F0 30 CB EE 2F CE ED D6 F4 49 D8 ED 45 D5 EE 36 CB EB 41 CB EE 36 CC ED 31 CB EC 32 F2 4E D8 F3 49 D5 F0 3E CD EA 3C D3 E9 38 D0 EA 37 D2 EB 36 CE 47 D9 EF 4E D6 EF 3E D3 EA 39 CE EE 35 D1 ED 33 CE EE 34 CF EC D6 F2 51 DB EF 47 D5 EF 32 CE EB 31 CD EF 36 D2 EE 35 CD EC 38 EF 45 D6 F3 47 CE F0 39 D4 ED 34 C9 EC 33 D2 EF 3A D2 EC 39 D1 4F DE EE 46 DB ED 3A D1 EE 3F CF E8 39 CA ED 34 D0 EF 39 D2 EE 5..7..G..F..G..O ..R..N..D..N..E. .H..R..M..I..Q.. K..G..M..J..N..F ..A..C..F..I..G. .K..E..G..E..G.. B..;..F..G..>..: ..E..=..;..>..9. .5..=..?..6..2.. <..B..=..=..9..? ..A..4..9..<..4. .5..8..6..A..1.. 5..;..;..3..5..9 ..4..3..;..8..3. .8..:..@..6..6.. 5..;..4..0..3..4 ..2..9..;..7..:. .4..0..2..1..5.. 2..5..7../..4..9 ..2..1..3..6..9. .7..3..1..2..8..

Eachpixelofanuncompressed24bitbitmapimageisrepresentedby24bits,orthreebytes[2]. Eachbyteiscomposedof8bitswhichcorrespondtooneofthethreecolorplanes,red,green,orblue.A solidwhitepixelwouldberepresentedinbinaryas111111111111111111111111,andasolidblackpixel wouldberepresentedinbinaryby000000000000000000000000.Usingeightbitspercolorplaneallows for2^8possibilities,or256differentcolorsforaplane.With256possibilitiesforeachcolorplane,it equatesto256^3(16777216)possibilitiesforthecolorofeachpixel. Eachsuccessivecolornumber,130131132,isadifferentintensityoftheprevious.Thehuman eye is unlikely to detectthe difference between two successive colors in a single bit plane, and is definitelynotabletodetectthedifferencebetweentwosuccessivecolorsonascaleof016777216. Belowisascaledversionofanunmodified700x468uncompressed24bitbitmapimage.This particularfileiscomposedof327600pixels(700x468=327600),whichequatesto982800bytes. Typicallybitmapimagesofthissizearenotusedforpracticalpurposed.Thisimagewaschosenfor demonstrationbecauseofthehighlevelofnoiseitexhibits.Noiseisanimportantfactorinbeingableto hidedatawithoutperception,whichisdiscussedlater.

Figure1Animagewhichdemonstratesalargeamountofnoise.

This is the image, further scaled, and brokenintothreecolorplanes,red,green,and blue.Thisisdone zeroing outallbytesexcept thoseoftheplanebeingexpressed. Forexample,ifapixelwasrepresented in binary as 01001110 10110010 10000111, to representtheredplane,itwouldbemodifiedto 010011100000000000000000.Thegreenplane would be represented in binary as 00000000 1011001000000000.Thisisdoneforeachpixel intheimagetodisplaytheentireimageplane. Inrubycode,fortheredplane,itwould bedonebythefollowing:
out.push(((0b00000000).to_i).chr) out.push(((0b00000000).to_i).chr) out.push(((byte[i+2]).to_i).chr)

Itisimportanttorememberthatdataina bitmap image is stored in reverse, so the last byteofapixelisactuallytheredplane. Identifyingtheplanes,andhowtheyare accessed are important in understanding techniques to hide data. One of the popular methodsistoexclusivelyuseasingleplaneto modifybits,asnottodisrupttheentireimage. Different combinations of the planes are also usedwithvariousresults.
Figures2,3,4Thecolorplanes,red,green,andblue respectively,oftheoriginalimage.

V.Noise Themostimportantpropertyofabitmapimagewhichisconsideredhelpfulinembeddingdatais the amount of noise that exists. There are various definitions of noise, depending on the type of applicationitisbeingconsideredin,butforbitmapimagesitreferstotherandomsamplingoftheleast significantbits.[1] Letusconsiderthesameimage,andexaminethebitsampling. First we will extract the most significantbits. It is apparent that this image resemblesitsparent.Shapesareconsistent,and colorsareidentical,onlydifferinginintensity fromtheoriginal.Inimageswithrecognizable objectsorlocations,thegeneralideawouldstill bepresentinthemostsignificantbits.

Figure5Themostsignificantbitsamplingofanimage, demonstratinghowthebitsareimportantandshouldavoid modification,

We will now examine the least significantbit sampling. It is immediately apparentthatthenewimagehasnoresemblance totheoriginal,onlyexpressingarandomnoise pattern.Smallsolidportionsarevisibleinthe lower left portion of the image, which correspond to locations ofthe original image wherethepixelsareidentical,havinga0asthe leastsignificantbit.

Figure6Theleastsignificantbitsamplingofanimage, demonstratinghowthebitsexpressrandompatterns,making themusefulformodification.

Extractingthebitsamplingofanimageisdonebyrepresentingeachplaneofapixelaseither 11111111or00000000,dependingonthebitbeingsampled.Forexample,ifapixelisrepresentedin binary as 01001101 01101110 10101111, the leastsignificantbit pixel would be 11111111 00000000 11111111,andthemostsignificantbitpixelwouldbe000000000000000011111111. Inrubycode,itwouldbedoneasfollows:
def getLSB byte if ((byte.to_i % 2) == 1) return 0b11111111 else return 0b00000000 end end def getMSB byte if (byte.to_i > 127) return 0b11111111 else return 0b00000000 end end

Itisimportanttonotethatsomeimagesrepresentwhatisknownasselectivenoise,ornoise confinedtogeneralareas.Thiscanbeaproblemwhenembeddingdata,asitneedstobedoneinareasof noisetobelessdetectablebymethodsofsteganalysis.[2] For example,letusconsiderthefollowingimage.Whileit mayappearthattheobjectisasolidcolor,acloserlookrevealsthatis it expresses nice variation and gradient patterns. However, the probleminthisimageisthedistinctshape,surroundedbyassolid noiselesswhite.Itmayappearinnocent,butletustakealookatthe bitsampling.

The mostsignificantbit sampling is once again, representative of the original image. Modifying these bits would result in major areas of modification in the newly created cover image.

Theleastsignificantbitsamplingshowsthattheoriginalis indeedmadeofvaryingcolorsandradiantpatterns.Itisalsoapparent fromthissampling,theoriginalshape,possiblyidentifyingtheobject representedbytheoriginalimage.Thegoalistousetheareasof noisetohidedata,whichrequirethehidertoknowthegeometryof objectsinimagessuchasthis.Itcanbedone,butitrequiresalotof additionalcodeandcomputations.Wewillexaminehowitcanhurt theprocesswhenweexaminetheoutputofembeddedmessages.

Figures7,8,9Theoriginal, mostsignificantbit,andleast significantbitsamplingofanimage thatrepresentsselectivenoise.

Imagesmadeofsolidcolors,specificallyonlyblack(decimal0)andwhite(decimal255)are particularlybadcandidatesformodification.Thereasonforthis,isthefactthatnoisedoesnotexist.The leastsignificantbitsampling,mostsignificantbitsampling,andoriginalimagewillallappearidentical. Anymodificationswillmeimmediatelyapparent,perhapsnotbythehumaneye,butbyasamplingofthe newlycreatedimagebits. VI.HidingData Theamountofdatawhichcanbehiddenwithinacoverimageisdirectlyproportionaltoboththe sizeoftheimage,andthespecificmethodusedtohidethedata.Letusconsidera200x200pixelimage. Usinganuncompressed24bitbitmapimageformat,thedatasizeoftheimagewouldbe120000bytes,or 120kilobytes.Thisiscalculatedbythenumberofpixels(200x200=40,000)timesthenumberofbytes perpixel(40,000x3=120,000).Thisequatesto960,000bitswhichwecanpossiblymodify.The possibilitiesseemlimitless!However,thisisnotactuallythecase.

Moststeganographictechniquesuse1bitperbytetostoredata,andoftentimeslessthanthat. Alsorememberthathiding1bitofdataisnotverypowerful.Weusuallywanttohidecharacters,ordata, bothofwhicharemadeofmultiplebytes,eachbytewhichismadeof8bits.Thiseffectivelyreducesthe amountofdataweareabletohideto15,000bytesorcharacters(120,000/8=15,000).Ifthedatato embed is a plaintext message, this may be sufficient space, enough to hide the Declaration of Independence(8,044characters)twice,ifweremovethespaces.Ifthegoalistohidefiles,suchasother images,orencryptedinformation,15kilobytesissmallincomparison.[4] VII.HidingTechniques&Experimentation Thereareseveraltechniqueswhichcanbeappliedtothegeneraltechniqueofleastsignificantbit steganography.Intheexperimentationofthisarticle,wewillfocusinparticularonone,howeverthe theoryofotherswillbeintroducedforfurtherexperimentation. Letusconsiderthesimplesttechnique.Foreachbyte,wewillreplacetheleastsignificantbitwith abitfromthedatabeinghid.Thisallowsonecharacter(orbyte)ofdatatobehiddenwithinthreepixels (threebitsperpixel).Theeffectofthisisminimaltothevisualintegrityoftheimage,asisseeninthe resultsfollowing.Itmay,however,significantlychangetheleastsignificantbitplaneiftheoriginalimage expressesselectivenoise. Thissimpletechniquecanbeextendedtohidemoredatawithlittlechange.Insteadofreplacing theleastsignificantbitofeachbyte,replacethetwoleastsignificantbits.Thisdoublestheamountof data we areabletohide,andinmostcaseshaslittlemoredisturbancetotheresultingimage than replacingjustasinglebit. Herewecanseetheresultsofapplyingthistechniquetoa300x328pixelversionofthesame bitmapimagewesawearlier. Theimageintheleftisthe control image for this set of experiments,ithasnomodifications. Theimageintherightisthe result of replacing the least significantbitofeachbytewithdata.

Figures10,11ExperimentalresultsofapplyingtheLSBtechnique

Thenextimageistheresult of replacing the two least significant bits with two bits of data.Asyoucansee,thereislittle visibledifferencebetweenthesetwo modifiedimagesandthecontrol. The third image after the control has the three least significant bits of each byte replaced, the fourth four, the fifth five,thesixthsix,andtheseventh seven. We can see in the third imageafterthecontrolsomeslight distortion in the yellow portions. The fourth is beginning to clearly show difference from the control, noticeableinthegradientareas.The next image enhances these flaws, andbeginstoshowrandompatterns in the originally solid white background. The final image resembles themostsignificantbitplane,with randomnoisethroughout.

Figures12.13.14.15.16.17ExperimentalresultsofapplyingtheLSB techniqueofsteganography.EachsuccessiveimagehasanadditionalLSB planereplacedwithdata.Theprogressionclearlyrepresentstheamount ofmodificationversustheamountofdatahidden.

FollowingisthesamelogicalprogressionoftheLSBtechniquetotheearlierintroducednoisier image.

Figures18,19,20,21,22,23,24,25ExperimentalresultsofapplyingtheLSBtechniqueofsteganography. EachsuccessiveimagehasanadditionalLSBplanereplacedwithdata.Theprogressionclearlyrepresentsthe amountofmodificationversustheamountofdatahidden.

Thesearetheresultsofapplyingthesametechniquestoanoisierbitmapimage.Itisnotuntilthe fourthandfifthbitplanebeforewestarttoseenoticeablechangesfromthecontrol.Atthispoint,upto fivetimestheamountofdatapossiblebymodifyingsinglebitsiscapableofbeingembeddedinthe image.

Goingbacktotheconcernofselectivenoise,letuslookatwhathappenstotheleastsignificant bitswhenmodifyingimagesexpressingit.

Figures26,27,28Theseimagesshowtheleastsignificantbitplanesaftera)no modification,b)modificationofanamountlessthanthepossiblecarryingcapacity, c)paddingoftheimagewithrandomdatapastthesignificantdatabeinghid.

Figure26showstheleastsignificantbitplanefortheunmodifiedimage.Figure27showsthe leastsignificantbitplaneafterhidingaportionofdatawithintheimage.Thedatawascarefullyselected inthisexperimenttobelessthanthetotalamountpossible.Herewecanimmediatelyseethemodified bits.Thiscanbeextremelydangerousifnoticedbypersonsperformingsteganalysisonsuchanimage,as itclearlypresentsitself.Innoisyimagesitmightbebeneficialtoleavetheunmodifiedbitsastheyare, butinimagesexpressingselectivenoiseitmightbebeneficialtomodifyadditionalbitswithrandom data.Figure28showsthis. VIII.Implementation Implementingtheleastsignificantbittechniquecanbedoneeasilyusingbitwiseoperationson thebytes.Forexample,considerthefollowingbyte,representedinbinaryas01101100.Tokeepthisbyte thesame(inotherwords,modifythebytetohavea0astheleastsignificantbit),weanditwithitself 01101100&01101100=01101100.Tochangethebittoa1,anditwithitselfandadd1(01101100& 01101100)+1=01101101.Thesecondcasewouldbeabyteendingwitha101101101forexample.To keepthisbytethesame(inotherwords,modifythebytetohavea1astheleastsignificantbit),we andit withitself01101101&01101101=01101101.Tochangethebittoa0, and itwithitselfminus1 01101101&(01101011)=01101100. Anothersimpleimplementationwouldbeconvertingthebytetoaninteger,thensubtractingor adding1tothevalue.Incodeitmightlooklikethis:

def setZero byte if ((byte.to_i % 2) != 0) byte = (byte.to_i - 1).to_i end return byte.to_i end

Thebitwiseorintegermethodscouldbeextendedtodothemultiplebits,butasimplermethodis totreatthebytesasbinarystrings.Thisallowsustotakesubstringsfromeachbyte(thepixelandthe character)andconcatenatethemtogether.Incode,forreplacingthethreeleastsignificantbits,itmight looklikethis:

def hide byte, data byte = '%b' % byte while byte.length < 8 tmp = "0" + tmp end byte = byte[0..4] byte += data return byte.to_i(2) end out.push((('%d' % hide(bytes[i+j], mbytes[x].to_s + mbytes[x+1].to_s + mbytes[x+2].to_s)).to_i).chr)

IX.AlternateTechniques In effort to reduce the footprint created by changing bits, the following modification to the originaltechniqueisintroduced.Selectonlyonecolorplanetomodify.Thatis,modifyonlyeverythird byteoftheimage.Thishastwoeffects.First,itreducestheamountofchangedbitswhichhelpdeter methodsofsteganalysis.Second,andbecauseofthistheamountthatiscapableofbeinghidisreduced byonethird. Anotherextensiontothebasicleastsignificantbittechniqueistoapplytheconceptofrandom walks.Insteadofembeddingdatainasequentialorder,selectrandomlocationsthroughouttheimageto hidebits.This,however,requiressomesortofkeyfortherecipienttorecoverthedata.Thiswould typicallybestoredasasequentialstringeitheratthebeginningoftheBitmapDatablock,orwithin unusedheaderbits. Afinalideatoconsiderisrelativemodification.Thisideainvolvesmodifyingallthebyteswhich areidenticaltothebytecurrentlybeingedited.Thiseffectivelydeterscertainformsofsteganalysis,but presentsadditionalproblemsforembeddingandrecoveringthehiddenmessages. Some interesting and early research is currently being conducted in extending bitmap steganography (as well as other media types) to multiple files, which is referred to as distributed steganography.Thisaddsanadditionallayer(orseverallayers)ofdeceptionforcoverttraffic.Itwillbe

interestingtoseehowthisresearchprogressesinthenearfuture.[2] AnotherareaofearlyresearchisinvolvedwithafieldknownasPublicKeySteganography,which isatheoreticallyimpossibletechniquetheabilitytosecretlyexchangemessageswithpersonswhohave nevermet.[5,6] X.Conclusions Applyingthetechniqueofsteganographytodigitaltechnology,asdemonstratedinthisarticle, opensadoorfornewmethodsofinformationtransmissionoversharedchannels.Theabilitytouse existingfilestructurestoaccomplishthisisparticularlyhandy,andaswehaveseen,someexploit themselveswellforthis.Theuniquepropertiesofmediafiles,inthisarticlespecificallybitmapimages, makethemgoodcandidatestobemodifiedwithoutdetection. Steganographycanbeapowerfultechniqueforsecretivecommunicationifappliedeffectively.It offersadifferenttechniqueofsecurecommunicationthancryptography,namelysecrecycomparedto privacy.Ifcombined,eachofthesefieldscouldcomplementtheotherinwaystoimprovetheoverallgoal ofprotectingorconcealinginformationfromunintendedrecipients.

XI.References [1]PeterWayner,DissapearingCryptographyInformationHiding:Steganography&Watermarking SecondEdition.SanFransisco,California,U.S.A.:ElsevierScience,2002,ISBN1558607692. [2]BretDunbarADetailedLookatSteganographicTechniquesandtheirUseSansInfoSecReading Room,Jan2002. [3]MSDN:AboutBitmaps<http://msdn.microsoft.

com/library/default.asp?url=/library/en-us/gdi/bitmaps_99ir.asp?frame=tru>,2007,

MicrosoftCorporation.

[4]FabienA.P.Petitcolas,RossJ.AndersonandMarkusG.Kuhn,InformationHidingASurvey. ProceedingsoftheIEEE,vol.87,no.7,pp.10621078,July1999. [5]MichaelBackesandChristianCachin,PublicKeySteganographywithActiveAttacksIBM Research,ZurichResearchLaboratory,<www.zurich.ibm.com>, Feb2004. [6]LouisvonAhnandNicholasJ.Hopper,PublicKeySteganographyCarnegieMellonUniversity, ICALP,2005.