An Enhanced Steganographic Method An Enhanced Steganographic Method for Data Hiding in for Data Hiding in

Microsoft Word Documents Microsoft Word Documents by a by a

Change Tracking TechniqueChange Tracking Technique

Dan DeBlasio and Brad MundtDan DeBlasio and Brad MundtUniversity of Central FloridaUniversity of Central Florida

deblasio@cs.ucf.edu, bmundt@pegasus.cc.ucf.edu deblasio@cs.ucf.edu, bmundt@pegasus.cc.ucf.edu

SteganographySteganography

What is Steg?What is Steg?

The word steganography is of Greek origin The word steganography is of Greek origin and means "covered, or hidden writing". and means "covered, or hidden writing".

Modern implementation is embedding secret Modern implementation is embedding secret information into something innocentinformation into something innocent

Pictures, audio, videoPictures, audio, video

Picture StegPicture Steg

By removing all but the last 2 bits of each color component, an almost completely black image results. Making the resulting image 85 times brighter results in the image to the right.

Image extracted from tree image.

Image of a tree.

Our selectionOur selection

A New Steganographic Method for Data Hiding in Microsoft Word Documents by a Change Tracking Technique by Tsung-Yuan Liu and Wen-Hsiang Tsai

A new steg method to hide information via MS Word A new steg method to hide information via MS Word change trackingchange tracking

Collaborative document with correctionsCollaborative document with corrections

Deleted words are struck through and new words are Deleted words are struck through and new words are underlinedunderlined

OverviewOverview

Transform a regular document to one with Transform a regular document to one with misspellings or mistakesmisspellings or mistakes

Make changes, allow word to track them.Make changes, allow word to track them.

Using a Huffman tree on the original words in Using a Huffman tree on the original words in the file, create a binary string of the embedded the file, create a binary string of the embedded messagemessage

Decode the binary string to get the secret Decode the binary string to get the secret messagemessage

The quick brown fox jumped over the lazy dog.

Original sentenceOriginal sentence

The quick borwn fox jumped oevr the lazy dag.

Sentences with MisspellingsSentences with Misspellings

The quick borwnbrown fox jumped oevrover the lazy dagdog.

Sentence with changes trackedSentence with changes tracked

Huffman TreeHuffman Tree

Created from the frequency of misspellings

WordWord HuffmanHuffman

tehteh 1111

qwikqwik 101101

borwnborwn 1001010010

brounbroun 00110011

jumppedjumpped 000010000010

oevroevr 00011100001110

orverorver 100010100010

dagdag 0101

The quick borwnbrown fox jumped oevrover the lazy dagdog.

How to DecodeHow to Decode

WordWord HuffmanHuffman

tehteh 1111

qwikqwik 101101

borwnborwn 1001010010

brounbroun 00110011

jumppedjumpped 000010000010

oevroevr 00011100001110

orverorver 100010100010

dagdag 0101

1001000 0111001

0x72 0x105

Hi

Our implementationOur implementation

Recreated the method from scratchRecreated the method from scratch

Made improvementsMade improvements

Modular code for easy improvementsModular code for easy improvements

Encryption, simple XOR pad with key in the Encryption, simple XOR pad with key in the author fieldauthor field

Example next,Example next,then a live demothen a live demo

A Word documentA Word documentBefore steg encodingBefore steg encoding

Encoding in ProgressEncoding in Progress

Encoding CompleteEncoding Complete

The Word documentThe Word documentAfter steg encodingAfter steg encoding

Decoding in ProgressDecoding in Progress

Decoding completeDecoding complete

Live DemoLive Demo

Statistical ResultsStatistical Results

Changes Bits b/change Words % changed

Sent. Changes/Sent

Document 1 40.4 93.8 2.321 475 8.5% 29 1.393

Document 2 43.2 99.8 2.310 551 7.8% 31 1.394

Document 3 65.6 129.6 1.976 641 10.2% 51 1.286

Document 4 124.4 224.8 1.968 1268 9.8% 89 1.398

Document 5 37.6 78 2.074 481 7.8% 27 1.392

ImprovementsImprovements

Due to the code being modular, improvements Due to the code being modular, improvements will be easywill be easy

More advanced or alternate encryption algorithmsMore advanced or alternate encryption algorithms

Implement a Markov model instead of a Huffman tree Implement a Markov model instead of a Huffman tree for statistical attacksfor statistical attacks

Use synonyms instead of misspellings or a Use synonyms instead of misspellings or a combination of bothcombination of both

That’s all for now folks!That’s all for now folks!