With concerns of internet privacy growing tremendously over the last few years the usage of covert channels of digital communication is on the rise. Embedding hidden data into various other forms of data is by no means a new technology. People have been embedding hidden files into images, music files, and even TCP/IP packets for several years. Through the use of various steganography applications this process is becoming easier and easier for even those who are not technically savvy. One of the most common ways of embedding data covertly is to use what is called the least significant bit (LSB) methodology of injecting data into an image. How Bits Form Images
In order to understand how LSB technology works you must first understand exactly how data bits are used to represent a visual image. As most people know, an image is made up of pixels. Each pixel within an image is assigned a binary value that represents a color; black, white, or any of the 16.7 million possible colors. These binary values that determine a pixels color can be made up of anywhere from 8 to 24 bits depending on the depth of the color. The 16.7 million possible colors refer to the number of colors mathematically possible in a 24-bit image (8 bits by a power of 8 ). An 8-bit image only takes 256 of these 16.7 million colors. The number stored in each bit of an 8-bit image is actually a pointer to one of the colors in our 256-color palette. An 8-bit image tends to be smaller in size but carries less color detail than 24-bit images because of its restrictive color palettes. This is obvious in the math associated with having 8 bits of information that can all be a 1 or a 0. There are 256 different combinations of 1�s and 0�s in an 8-bit image, thus limiting the color palette of the image to 256 colors.
In 24-bit images, unlike 8-bit images, there are actually three sets of 8 bits that define the color for each pixel. Each of the primary colors (red, blue, and green) has 8 bits to itself. If we count all 24 bits, we realize 16.7 million different combinations of 1�s and 0�s are available to define a color. Thus, each pixel can represent one of over 16.7 million different colors. The 24-bit images are called true color for just this reason as they are capable of representing every actual red, green, and blue color value available. How LSB Works Least Significant Bit modification works by running software that is capable of determining what specific bits can be altered within a pixel without causing a visible difference. LSB modification takes the 1�s and 0�s from the payload file and inserts those into each pixel, starting at the bit least likely to make a noticeable change to the color of the pixel. Since a 1 or a 0 already exists in that spot, there is only ever a 50% chance that the bit will need to be changed. 
Typically a steganography application will start at the least significant bits in each pixel and then move down the line toward the more significant bits as a larger amount of data is inserted into the carrier file. However, the more significant bits will make greater changes in color for the pixel when modified which can sometimes be picked up by the naked eye. LSB Modification Using S-Tools There are several freeware applications available for employing LSB modification in images. One of these tools is the Steganography Tools or S-Tools package. This program is free and can be found in multiple locations with a simple Google search. S-Tools has the capability to insert data into both GIF and BMP files. In order to insert data into a carrier file you will need three things: - The S-Tools application
- A carrier image file
- A secret file to be inserted into the carrier file
To insert data into the carrier file complete the following steps: - Open the S-Tools program
- Click and drag your carrier file into S-Tools
- Click and drag your secret onto the image as it resides in S-Tools
- A window will pop up that gives you the option of encrypting the data inserted into the carrier files via various popular encryption algorithms. Select one of these algorithms along with a passphrase and select �OK�
- The next window will present several other options that are beyond the scope of this article. If you wish to learn more about this you can view the S-Tools help file. For now, we will simply click �OK�
- S-Tools will then encrypt and insert your hidden data into the carrier file and bring it up on screen. You can then right-click the image, select �Save As�, and then save the image to a location of your choice.
To pull hidden data from a carrier file: - Open the S-Tools program
- Click and drag your carrier file into S-Tools
- Right click the image and select �Decrypt�
- Select the appropriate encryption algorithm and type the correct passphrase and click �OK�
- S-Tools will then pull that data from the carrier file and open the a window displaying the extracted file. Right-click the filename and select �Save as� in order to select a location to save the newly uncovered file.
Conclusion It is very easy to see how least significant bit modification can provide a perfect means of covert communication. This along with the various other forms of steganography can prove to be very effective in hiding sensitive data. One of the other very effective methods of hiding data involves fragmenting data directly into TCP packet headers. Look for an article on this in due time. Also be sure to look for my follow-up to this article regarding how to detect hidden steganography in image files. |