IEEE Spectrum November, 2013 - 43

Four ways to smuggle
messages through
Internet servIces
By wojcIech mazurczyk, krzysztoF szczypIorskI & józeF luBacz

heir neighbors thought they were just ordinary
U.S. residents, but secretly they were spies, sent by Russia's
Foreign Intelligence Service to gather information on U.S.
policies and programs. For years they thwarted detection, partly by hiding secret correspondence in seemingly innocent pictures posted on public websites. They
encoded and decoded the dispatches using custommade software. ¶ But the scheme wasn't as covert as the spies had assumed.
Eventually, investigators from the U.S. Department of Justice tracked down the
altered images, which helped build a case against the Russians. In June 2010,
federal agents arrested 10 of them, who admitted to being secret agents a few
weeks later. ¶ The act of concealing data in plain sight is known as steganography.
Since antiquity, clandestine couriers have used hundreds of steganographic techniques, including invisible ink, shrunken text, and strategically placed tattoos. Picture steganography-one of the Russian spies' primary tactics-dates back to about
the early 1990s. That they used such an old-school strategy is odd, particularly
because doctored images can be detected and used as evidence. ¶ A more modern approach, known as network steganography, leaves almost no trail [see "Vice
Over IP," IEEE Spectrum, February 2010]. Rather than embed confidential information in data files, such as JPEGs or MP3s, network steganography programs
hide communication in otherwise innocuous Internet traffic. And because these
programs use short-lived delivery channels-a Voice over Internet Protocol (VoIP)
connection, for example-the hidden exchanges are much harder to detect. ¶
Network security experts have invented all of the dozens of publicly documented network steganography techniques. But this doesn't mean that criminals,
hackers, and spies-as well as persecuted citizens wanting to evade government
censorship or journalists wanting to conceal sources-aren't using these or similar tactics. They probably are, but nobody has tools that are effective enough
to detect these techniques. In fact, had the Russian spies used newer steganography methods, they might not have been exposed so handily. ¶ As members of
the Network Security Group at Warsaw University of Technology, in Poland, we
study new ways to disguise data in order to help security experts design better
detection software for those cases when steganography is used for nefarious purposes. As communication technologies evolve, we and other steganographers
must develop ever more advanced steganography techniques. ¶ About a decade
ago, state-of-the-art programs primarily manipulated the Internet Protocol. Today, however, the most sophisticated methods target specific Internet services,
such as search tools, social networks, and file-transfer systems. To illustrate the
range of possibilities, we present four steganographic techniques we've recently
developed, each of which exploits a common use of the Internet.

IllustratIons By carl De torres

SPectrUm.ieee.OrG

NOrth americaN

NOV 2013

http://SPectrUm.ieee.OrG

Table of Contents for the Digital Edition of IEEE Spectrum November, 2013