A MP3 Steganographic File System Approach
Posted in security, stega | by evilbitz |Inspired by Paranoia, a book by Joseph Finder, I decided to write this post. Paranoia really had influenced my thinking as I was reading about Adam Cassidy, a young man who was hired to do some dirty industrial espionage work for another firm. The tools that are needed for this kind of work are various, and I’m not going to discuss about these tools but rather about an imminent need for this kind of job, and that is: the place to collect your prize.
Well, you don’t have to be an industrial spy to see the advantages in a steganographic file system, even the most naive and simple PC user can find a Steganographic file system useful, as it can protect him from different kind of threats. Information Hiding can protect users against hacker attacks, and information theft in general, imagine that your password list or your bank account info is hidden in an encrypted way inside your mp3 files (this is what I’m going to talk about).
It looks naive and unsuspicious, who would imagine that your sensitive information is stored over some ordinary looking files. If we will go back to our industrial spy example – let’s say that he needs to get some documents from a competitive firm, first he will apply for a job there, then, after he is actually there and have access to these documents, he needs to steal them – his stolen documents are going to be stored inside some movies or other media files, it is innocent and even if he is getting caught somehow, he can just play the movies at his hard drive / removalble media device (usb key for example).
Design
Whem I’m looking for requirements for such a project, I try to see it as simple as I can. Implementing the file system over regular files let’s you be independent from technologies or operating systems, the stegnographic file system should be portable and easy to implement in any language / OS. The storing media is also taking into account when you can be using your local hard drive or your removable USB key, it let’s you be independant from low level issues. the most innocent looking files I can think of are music files like MP3s, and the media can be any MP3 Player / iPod.
The file system requirements are also not so wide. It should give you the ability to store various files, inside different directories, if it’s feasible. The operations that the file system supports are the follows:
- Expand: Looping through a list of mp3 files and preparing them for future data.
- Format: Deleting all files that are currently availble in the file system.
- Add: Copy a file to the file system or from the file system.
- Remove: Delete an existing file from the file system.
- Rename: Changing the name of an existing file.
- Extract: Copy a file from the file system to any other place.
Simple Implementation
Lets say, that on each MP3 file you have a different amount of free data to store, so the file system overall storing size is the sum of all free size of each and every MP3 file. Each MP3 file should be treated as a stream, that is, the free size will be filled with chunks of the original files that we are storing, each chunk will contain a simple header that describes the chunk. It can be something like the following struct:
typedef struct _ORIGFILE_CHUNK {
/* crc32 of the current chunk */
UINT32 chunk_crc32;
UINT32 origfile_crc32;
struct orig_filename {
UINT8 filename_size;
CHAR filename[];
};
struct orig_data {
/* the offset from the original file */
UINT32 offset;
UINT32 chunk_size;
BYTE chunk_data[];
};
} ORIGFILE_CHUNK, *PORIGFILE_CHUNK;
The original files will be stored in chunks, in any order, over as many files that are needed. The restoring process will be done as follows:
- Read all chunks into memory
- Validate integrity for all the loaded chunks
- Build a dictionary with the original filename as the key
- Build the original files from the chunks
When these steps are done, we should validate integrity for each file. We’ll do that using the origfile_crc32 field of each chunk and compare them to the calculated crc32 of the overall original file data of the corresponding chunk.
The underlying steganographic approach can be anything you can think of, a nice project that is looking quite good is mp3stego, and can be used to implement the steganographic part, The data is further protected with encryption.
Conclusion
Armed with our MP3 steganographic file system, our evil spy can go to work, insert his USB key and listen to his favourite music while stealing and collecting info from the firm.
Are you scared? 