Purpose: The goal of this lab is demonstrate one of the many ways that terrorists, hackers, or other criminals can covertly pass information within files on the Internet, Facebook, or other public forums. It is designed to raise awareness among network administrators and security officers so that they can acquire tools such as StegDetect or Camerashy that can look for hidden messages in images posted on corporate web servers.
Files needed: Quick Stego software by Quickcrypto.com and a very large bitmap file (.bmp).
Objective: Use steganography to effectively hide one file within another one such that the file system/operating system doesn't detect it.
1. Create a file on your desktop using Notepad that will be hidden in the image.
2. Identify a large image (.bmp file) that will be used as your "carrier" file to hide your other file in. If you don't have one, open up a .jpg file in Paint (Accessories) and save it as a bitmap file (.bmp).
4. Record the file size of both bitmap.bmp file and your text document that you will hide in your carrier file.
5. Install Quick Stego onto your PC, a free download is available from: https://quickcrypto.com/free-steganography-software.html
6. After installing, Run the program by clicking on the icon.
7. Click on Open Image and find your carrier file.
8. Click on Text File and Open Text - find the document your created and click on it. The text that you want to hide should be present in the right-hand window.
9. Click on the Hide Text button. You will see a message at the bottom of the window that says "The text message is now hidden in image".
10. Click on Save Image and name it hiddenfile.bmp.
11. Open up hiddenfile.bmp by double-clicking on it. Can you tell that you have this file hidden within the other one?
12. Compare the original with the stego copy Is there a discernible difference in resolution? Is there a difference in file size?
13. Now Run the Quick Stego program again and open up the hiddenfile.bmp. Do you see the text?
14. Perform an MD5 hash on the two files (your original .bmp file before you embedded the file and hiddenfile.bmp that you hid the document in) using the Advanced Checksum Verifier (avcsi.exe - from https://www.irnis.net/ - demo software ) or HashCalc from LavaSoft (freeware) - are the hashes different?
15. Download and use Camerashy to attempt to analyze hiddenfile.bmp. Was it successful?
Questions to answer:
1) What tools can you locate on the Internet that can help you detect files hidden in other files?
2) Why did, or didn't, the file size differ between the original file and the file with the document hidden inside?
3) Were you able to successfully identify the file hidden in hiddenfile.bmp with Camerashy or another tool?