Steganalysis - Disappearing Cryptography - page 333

the most significant frequency while ignoring softer versions of sim-
ilar frequencies.

17.5 Structural Attacks

In many cases, steganographic algorithms leave behind a character-
istic structure to the data. This is often as distinctive as a person's
handwriting or an artist's brushstroke. If you know what to look for,
you can often spot the effects of some algorithms very quickly.
Many of the basic steganographic solutions that hide information
in the least significant bits of images are hampered by the data for-
mats used to represent images. Hiding information in the least sig-
nificant bit is easy when each pixel is represented by 24 bits, with 8
bits allocated for the amount of red, green and blue. Scanners and
cameras often leave enough randomness in the three least signifi-
cant bits assigned to each pixel to make it feasible to store the data.
Unfortunately, most images don't allocate 24 bits for each image.
File formats like the GIF or PNG allocate 8 bits or fewer by building
a palette of selected colors. An bit palette means 2 i possible col-

ors. These can significantly reduce the size of the images, especially
when they're combined with run-length encoding to compress long
stretches of identical pixels.
In some cases, the structure used by the software hiding the data
is different from the standard. Many GIF files are written with entries
for 256 colors, even if only a small number are needed. The software
SysCop only writes out the colors in the image. The extra efficiency
may shrink the file, but it can distinguish the output.
There are glitches and minor incompatibilities in many of the
current packages. Version 4.1 of Hide and Seek, for instance, requires
all images to be 320

i

200
pixel images. None of these limitations are difficult to fix, but they
show how dangerous quick and dirty steganography software can be.
[JJ98a]
Hiding information in the compressed GIF or PNG format by
tweaking the least significant bit can fail dramatically because the
palette entries are often not close enough to each other. Entry
01001001 may be a deep blue while entry 01001000 may be a hot
pink. Twiddling the last bit will distort the image.
Many of the steganographic schemes in Chapter 9 try to avoid this
problem by constructing a special palette. This process can leave a
damning mark.
A good technique is to choose a smaller palette and then add
duplicate colors that can be used to hide information. S-Tools,

× 480 arrays of pixels. StegoDos uses 320 ×