00:00:00.000-->00:00:05.250 >>Hey guys, welcome to the talk. A Picture is Worth a Thousand Words, Literally. Deep neural 00:00:05.250-->00:00:10.250 networks for social stego. Do a quick intro for both of us first. Uh, I think we, we have 00:00:13.167-->00:00:16.500 you know kind of our thug and our skill sets that complement each other nicely for this kind 00:00:16.500-->00:00:22.458 of talk. Um, I'm a Data Scientist at ZeroFOX so I work in social media security. Um I 00:00:22.458-->00:00:26.958 did my PHD before this, I studied biological neural networks that were a lot more 00:00:26.958-->00:00:31.042 detailed than the kind of things that I'll talk about today. But more and more I've been looking 00:00:31.042-->00:00:36.625 into how to, how to study big data, social media data specifically. Uh in terms of 00:00:36.625-->00:00:41.625 these type of networks. And here's Mike. >>Thanks Phil. Uh so my name is Mike Raggo. Um 00:00:44.042-->00:00:49.375 been doing a lot of research in steganography for many, many years. Um, another gentleman 00:00:49.375-->00:00:54.458 that's here today, uh who I presented with at Sky Talks and later at the Wall of Sheep, Chet 00:00:54.458-->00:01:00.542 Hosmer and I, uh authored a book called, Data Hiding, a few years ago. Where it explored a lot of 00:01:00.542-->00:01:05.250 uh new and we tried to make it very groundbreaking methods, rather than yet another stego 00:01:05.250-->00:01:10.833 book. Uh and this is kind of a spin off of that. Which we'll tie in and uh super honored to 00:01:10.833-->00:01:16.458 be back. Um I last spoke here at Def Con 12, so I'm kind of a, maybe a grey beard old school. 00:01:16.458-->00:01:21.458 And uh at that time, um I had spoked on stego and authored a tool actually in VB uh called 00:01:24.708-->00:01:29.250 StegSpy. Um and I'll get into that a little bit more detail kind of bridging that to what 00:01:29.250-->00:01:34.250 we'll be discussing in more detail today. When we took a look at the theme for Dec Con 25 00:01:37.167-->00:01:43.083 this year, um Phil and I had already been kind of brainstorming this topic and 00:01:43.083-->00:01:48.417 when we saw the theme, unintended uses of technology, we're like, well this brainstorm 00:01:48.417-->00:01:53.083 some of this research we had already spawned and started would fit in perfectly with the 00:01:53.083-->00:01:58.083 conference. So in terms of leveraging that expertise myself more on the, on the stego side, 00:02:01.458-->00:02:07.333 uh and Phil of course, more on the uh the ML side. Uh we kind of put our 2 heads together and 00:02:07.333-->00:02:12.042 said I think we can create a really cool presentation, some really cool research and and 00:02:12.042-->00:02:18.250 ultimately a really cool tool as well. Um I'm sure the majority of you are familiar with 2600 00:02:18.250-->00:02:24.000 magazine, The Hacker Quarterly. Um I know I've been collecting the magazine since at least 97 00:02:24.000-->00:02:30.583 and it even predates that. And um in looking at that, if you've ever looked at some of the 00:02:30.583-->00:02:36.083 covers of these magazines uh and you put them in different types of light you'll actually find 00:02:36.083-->00:02:40.375 hidden messages on the front pages of these magazines. So, if you've got an archive of some of 00:02:40.375-->00:02:44.458 these old things and you're hanging out one night having a few beers it act- it's actually 00:02:44.458-->00:02:47.875 kind of cool to kind of break them out and see what kind of messages you can find amongst 00:02:47.875-->00:02:52.875 them. So our agenda is we're gonna kind of go through the evoluti- uh evolution of 00:02:55.375-->00:03:02.083 steganography and uh kind of bring you up to speed um and, and, and also really more kind 00:03:02.083-->00:03:07.083 of focus on everything that kind of led up to our idea around um, using uh social media uh for 00:03:09.333-->00:03:14.750 covert communications. And some of the ideas and cool research that others have done that kind 00:03:14.750-->00:03:20.542 of inspired our research. Furthermore we'll then kind of get into uh DIY or do it 00:03:20.542-->00:03:26.042 yourself type of social stego. I'll walk you through a lot of the testing. Um that we went 00:03:26.042-->00:03:32.333 through to kind of vet out the various methods we could use for hiding data across social. Um 00:03:32.333-->00:03:37.250 across images and now across audio and video. Um and the different types of insertion 00:03:37.250-->00:03:42.708 techniques that we employed. Um and then Phil will take over, we'll, he'll get into uh deep 00:03:42.708-->00:03:48.292 neural networks for social stego, um red and blue teaming approaches and then we'll 00:03:48.292-->00:03:53.292 collaborate on the wrap up and kind of uh real world use cases of this. So one of the things I 00:03:58.542-->00:04:03.958 always refer to especially when I present at forensics conferences is kind of um just 00:04:03.958-->00:04:09.958 kind of taking a step back in what is covert communication. And if you refer back to uh the 00:04:09.958-->00:04:15.583 US Department of Defense, uh Orange Book back from 85, they describe it as any communication 00:04:15.583-->00:04:20.583 channel that can be exploited by a process to transfer information in a manner that 00:04:20.583-->00:04:27.417 violates the system's security policy. They take a step back and you look at steganography or 00:04:27.417-->00:04:33.333 covered rioting, secret communications, things like that. Before we really go into 00:04:33.333-->00:04:39.375 the internet era you had um, uh the Code Breakers book that came out. Um by David Conn, anybody 00:04:39.375-->00:04:44.250 here ever read Code Breakers? Really really good book, came out in the late 60's and then a 00:04:44.250-->00:04:49.625 second edition in the 70's. fantastic book, takes you through the history of different 00:04:49.625-->00:04:55.042 types of covert communications, dating back to ancient times in the Egyptians, in the Romans 00:04:55.042-->00:05:00.042 and, and uh the Chinese. Um fantastic book and from that you can get a lot of ideas um, more 00:05:03.417-->00:05:08.583 from a digital standpoint about the various ways in which you can communicate covertly. I know 00:05:08.583-->00:05:13.667 I refer back to the book daily and keep it right on my desk all the time. Really inspires me to 00:05:13.667-->00:05:17.958 go back and say let me step away from the digital side of this. What were the methods they were 00:05:17.958-->00:05:22.958 using way back when? It we take a look at the internet era and the evolution timeline, Neal 00:05:27.542-->00:05:34.292 Provos and many others around the 90's and into the early 2000's were analyzing and there 00:05:34.292-->00:05:40.625 were lots of apps, um that were coming out um, for various operating systems to allow you 00:05:40.625-->00:05:46.708 to perform different types of stenographic techniques. These employed a lot of methods 00:05:46.708-->00:05:52.500 primarily focused on hiding in images. Whether they be JPEGS, GIFs, uh and other types of 00:05:52.500-->00:05:58.000 formats. And you can additionally employ uh, crypto to not only hide the message 00:05:58.000-->00:06:03.417 within an image using a variety of techniques we'll talk about next but further more encrypt 00:06:03.417-->00:06:08.792 it, cypher it, um even disperse it across the image. But people have certainly expanded upon 00:06:08.792-->00:06:12.375 that since then there is plethora of different ways you can do this that we'll cover 00:06:12.375-->00:06:17.375 next. As things progressed people started to kind of take a look at the mobile aspect to 00:06:19.458-->00:06:24.417 this. And they're more than a thousand movie apps that will allow you to uh leverage 00:06:24.417-->00:06:29.958 stenographic techniques to hide message, to hide a picture within a picture, to hide 00:06:29.958-->00:06:36.667 content in audio, in video as well. And furthermore Chet Hosmer and myself presenter here 00:06:36.667-->00:06:42.208 the last few years at both Sky Talks and uh the Wall of Sheep covering different techniques 00:06:42.208-->00:06:48.292 for uh hiding within different types of video formats and then uh later on today also 00:06:48.292-->00:06:55.250 presenting on covert TCP, covert UDP, and covert WIFI. And so there's a lot of different ways 00:06:55.250-->00:06:59.833 in which you can leverage stenographic techniques for hiding information. But this is 00:06:59.833-->00:07:04.833 kind of what led up to what we're going to cover today in terms of social. So just kind of 00:07:06.917-->00:07:12.292 revisiting some of the ones that were very inspiring to us. Uh, one particular app called 00:07:12.292-->00:07:18.250 OpenPuff kind of expands on what we described already in that, hey I can have an image in which 00:07:18.250-->00:07:23.667 I can hide content. Maybe I mess around with the metadata, maybe I append it to the file, maybe I 00:07:23.667-->00:07:29.917 use an LSB technique, DCT technique, or other techniques for that matter. OpenPuff 00:07:29.917-->00:07:35.000 basically said I'm gonna use multiple images and I'm gonna hide my content across multiple 00:07:35.000-->00:07:41.250 images. And then I'm gonna throw off the forensic investigator by creating decoy files as well. So 00:07:41.250-->00:07:46.083 if you had all of the images and you were the investigator trying to piece meal back together, 00:07:46.083-->00:07:50.708 that original message you would be throw off by some of the pictures actually having decoy 00:07:50.708-->00:07:54.875 data making it extremely difficult to not only identify that they're hidden content 00:07:54.875-->00:07:59.417 there but actually putting it all back together. Or performing stego analysis to reveal the 00:07:59.417-->00:08:04.417 original hidden content. We also saw uh, a few years back where Operation Shady Rat and the 00:08:06.667-->00:08:11.875 research surrounding that was released, right? And one of the ways uh they did that was it was 00:08:11.875-->00:08:18.208 very much weaponized by uh an actual call back to a wordpress site, other sites for that 00:08:18.208-->00:08:23.083 matter would get updated instructions hidden within an image that it would parse, 00:08:23.083-->00:08:27.667 extract and update the command and control information. Additionally, there was some 00:08:27.667-->00:08:33.042 great research done at Sands, around expanding upon alternate data streams within the Windows 00:08:33.042-->00:08:39.167 NT operating system such that you could do or perform stealth alternate data streams. This 00:08:39.167-->00:08:45.083 thereby uh some of those things that are built into the uh uh NT operating system like LPT and 00:08:45.083-->00:08:49.958 other things can actually also be exploited uh leveraging alternate data streams but in a 00:08:49.958-->00:08:56.042 much more stealthy manner. Verging that to today ya know, lot's of different types of 00:08:56.042-->00:09:01.958 protocol exploits for this, uh as well as I did some research around a smartwatch. Hiding data 00:09:01.958-->00:09:07.708 within that, presented that at Def Con demo labs. And then further more within MP3s which 00:09:07.708-->00:09:11.625 we'll come back to at the very end of the presentation about where we're going with further 00:09:11.625-->00:09:16.625 research. So breaking steganography out into these different categories many of 00:09:19.375-->00:09:25.750 which we explored for the reteach. Linguistic stego basically modifying the text and 00:09:25.750-->00:09:30.708 either adding additional words, additional text, misspelled words and other type of 00:09:30.708-->00:09:36.375 linguistic approaches can allow you to s- hide information in a very simple way and we've seen 00:09:36.375-->00:09:42.750 this employed on Twitter and other um, uh types of social media. Uh as well as Pinterest 00:09:42.750-->00:09:48.792 to allow you to go ahead and post uh something to one of these uh social media uh 00:09:48.792-->00:09:53.125 networks and while although it looks like a bunch of words done, really don't make a whole 00:09:53.125-->00:09:59.417 lot of sense to us the intended recipient, the bot or something else is extracting the pieces of 00:09:59.417-->00:10:03.625 those that they're most interested in. From an image standpoint lot of different 00:10:03.625-->00:10:10.583 methods, you can employ. Uh in terms of JPEGs for example, you have EXIF or even JFIF whereby 00:10:10.583-->00:10:15.750 there is metadata at the beginning of the actual JPG file. Some of that may actually 00:10:15.750-->00:10:20.750 be leverages when you take a picture on your smartphone, you post that to social unless they 00:10:20.750-->00:10:24.875 remove that metadata, ya know they have, there could be your location information, there 00:10:24.875-->00:10:29.917 could be uh overriding of other information such as what phone it was taken from, the time and 00:10:29.917-->00:10:34.042 data and a variety of other information. But that same metadata or those metadata 00:10:34.042-->00:10:40.000 fields can be used for hiding data. Additionally, there are other techniques in which you 00:10:40.000-->00:10:46.500 can append beyond the end of file marker. Or uh using a least significant bit technique or 00:10:46.500-->00:10:50.417 frequency as well. And we'll talk in more about that in detail and how we'll use that 00:10:50.417-->00:10:56.333 technique within social media. Additionally, done lots of research both across audio and 00:10:56.333-->00:11:02.333 video. Remember with an uh an MP3 for example that typically there's a copy of the album 00:11:02.333-->00:11:09.208 cover embedded or JPEG embedded within that MP3. If I can hide stuff in an image why can't I 00:11:09.208-->00:11:14.208 hide it within the JPEG that comprises the album cover that's embedded within the MP3 itself? 00:11:16.542-->00:11:22.750 And then for those who author a lot of these stego programs may additionally uh, uh employ 00:11:22.750-->00:11:27.917 different types of uh cypher techniques, uh Vision Air for those, those of you who know was 00:11:27.917-->00:11:34.458 used at, at uh CISCO for a long time. Uh XOR and many other types of uh crypto. Alright so 00:11:34.458-->00:11:39.458 what do we do with our actual research? Obviously when you look at uh social media and 00:11:43.042-->00:11:48.458 social networks there are a variety of uh images that you can target and that's exactly 00:11:48.458-->00:11:53.875 what we did in our testing. In that we said, ya we'll take an ethical approach here but to 00:11:53.875-->00:11:58.875 what extent can I hide information in a profile image, in a background image, in 00:11:58.875-->00:12:03.958 addition to images that I may actually post or an album, book or collection I may actually 00:12:03.958-->00:12:08.958 create. Additionally, can I do that over DM? Or can I actually have a link that points to 00:12:11.250-->00:12:15.792 another site where that image with the hidden content resides that's actually rendered and 00:12:15.792-->00:12:20.792 presented within the actual social network on that particular post or that page? 00:12:23.583-->00:12:30.167 It's important to consider when you're analyzing and looking to leverage uh, these image formats 00:12:30.167-->00:12:36.083 as a carrier to determine to what extent can I hide data? And what are the different 00:12:36.083-->00:12:41.083 compression methods that they employ? If you look at JPEG, PNG, TIF, GIF and BMP files most 00:12:44.583-->00:12:49.708 of these are lossless but they do have some lossy capacities. One might argue for example 00:12:49.708-->00:12:55.458 while although GIF and, and some of what was originally patented was a lossless technique it does 00:12:55.458-->00:13:01.917 use compression and in other formats of GIF you may lose data as it's compressed. Bottom line 00:13:01.917-->00:13:06.208 a lot of these image formats leverage a compression and a lot of that had to do with the early 00:13:06.208-->00:13:11.042 days of the web so you can post it and that file simply wouldn't be quite as big when you visit 00:13:11.042-->00:13:17.417 the page over a modem connection it would render much quicker for you. But what exists today is a 00:13:17.417-->00:13:22.792 lot of information about those compression techniques that can either be targeted as well as 00:13:22.792-->00:13:27.250 information about how they're formatted in terms of the metadata the file markers and a 00:13:27.250-->00:13:32.250 lot of other characteristics. So in terms of a research then we said, hey, yo, of all of these 00:13:36.500-->00:13:41.417 which ones can we actually model out in our testing and test for each social network and all the 00:13:41.417-->00:13:47.375 different variables that we previously outlined? With Least Significant Bit for example. W- 00:13:47.375-->00:13:52.625 basically uh, allows you the ability to go and modify the least significant bit from a 00:13:52.625-->00:13:58.917 zero to a 1 or a 1 to a zero but only modifying the least significant bit across the file 00:13:58.917-->00:14:04.750 or dispersed or even at specific file markers repetitively throughout the file. Such that 00:14:04.750-->00:14:09.958 the recipient who may use the same program or technique to reveal it extracts all those 00:14:09.958-->00:14:15.667 least significant bits to put them back together to either reveal the original ASKI coder 00:14:15.667-->00:14:21.917 or reassemble an image or something else that was hidden within that image. Other 00:14:21.917-->00:14:28.750 techniques that we employed, a lot of times when the social networks render a JPEG file um 00:14:28.750-->00:14:35.125 they're looking for the end of file marker which in a JPEG is FFD9. What we found in a lot of 00:14:35.125-->00:14:40.083 instances was we could do something as simple as just appending content after the end 00:14:40.083-->00:14:45.042 of file marker which for some of these net- social networks was actually it completely ignored. 00:14:45.042-->00:14:49.542 And what is rendered is just what you see up to the end of file marker. Just either 00:14:49.542-->00:14:54.042 ignoring or throwing away the extra content. But we found out that the survivability was 100 00:14:54.042-->00:14:58.792 percent because when we downloaded it after uploading it, it would survive. And that 00:14:58.792-->00:15:03.458 kind of leads to my last point which was 1 of the other techniques we kind of employed 00:15:03.458-->00:15:08.458 with this that I personally had never done before is well let's upload it, let's see to what 00:15:08.458-->00:15:14.667 extent they jam it, they recompress it, they strip the metadata and take that post 00:15:14.667-->00:15:20.958 download file and now actually hide content in that and post it back. Does the social network uh 00:15:20.958-->00:15:25.792 look at it as now, hey that's a file I've already touched, it's in my format I'm gonna ignore 00:15:25.792-->00:15:30.792 what's in there now or do they recompress it? So that's also part of the testing. So just a 00:15:33.125-->00:15:38.417 very high level testing workflow. We used a lot of these different types of hiding 00:15:38.417-->00:15:43.417 techniques within an image, uploaded it to a variety of social networks, then downloaded 00:15:45.417-->00:15:49.375 it and tried to understand the difference with the characteristics and what kind of 00:15:49.375-->00:15:54.375 content would or would not survive. So this spreadsheet is kind of a breakdown of the 00:15:57.667-->00:16:02.667 results of the initial testing. As you see here whether it's interest, uh Slack, uh and 00:16:05.250-->00:16:10.458 others ya know we went through a process of hey, let's try the profile file, uh, uh photo. 00:16:10.458-->00:16:15.458 Let's post an image as part of a post. Um let's try the background image. Um does the 00:16:18.042-->00:16:22.958 picture residing in an album, a collection or a book have any impact one way or another on 00:16:22.958-->00:16:29.917 this. And then that round trip of, hey, ya know I uploaded the file with the hidden content, it 00:16:29.917-->00:16:35.250 went ahead and recompressed it and removed the meta- meta data thus destroying what we had 00:16:35.250-->00:16:41.792 hidden or essentially jamming it. But if I, I then download it, modify it and repost it, did 00:16:41.792-->00:16:46.792 it actually survive? So, with Pinterest for example, and Slack we were able to post images and 00:16:48.875-->00:16:53.917 hide content in a number of different ways that included insertion techniques. Uh whether 00:16:53.917-->00:17:00.500 it be prepend, append, or within a portion of the file that may be ignored. Uh modifying the 00:17:00.500-->00:17:05.708 metadata and also using Least Significant Bit to hide content. So anywhere y- obviously, you 00:17:05.708-->00:17:10.208 see here a yes, that's highlighted in green is where we had a success rate in terms of 00:17:10.208-->00:17:15.000 these methods. Uploading it to the social network and then simulating a recipient, going 00:17:15.000-->00:17:20.250 out there, treating it like a dead drop and downloading it. What's interesting about this is 00:17:20.250-->00:17:24.917 we're using 1 of the most, ya know open forums for sharing information from everybody to 00:17:24.917-->00:17:31.333 see. But yet taking equal and opposite approach of actually uh secretly hiding data right in 00:17:31.333-->00:17:38.042 plain site that nobody really sees by actually observing it. Lastly amongst all of that we 00:17:38.042-->00:17:43.917 started exploring MP3s and I'll come back to that later with Tumblr and how we actually were 00:17:43.917-->00:17:47.625 successful in hiding content there. Because that's sort of the next stepping stone with our 00:17:47.625-->00:17:52.625 research. So this point I'll turn it over to Phil. [applause] >>Cool, thanks Mike. So to, to 00:17:58.167-->00:18:03.250 build off that, um we have a lot of research now and we have a lot of results about how we can 00:18:03.250-->00:18:09.042 go up and s- and post images and download them and see what type of effects are being rendered by 00:18:09.042-->00:18:14.667 the different social networks uh in this round trip. Um so we want to build off of that and 00:18:14.667-->00:18:20.833 for, for the instances in which the social networks are doing some kind of compression or some 00:18:20.833-->00:18:26.917 other type of uh backend uh re-rendering of the image we want to find out a way how to 00:18:26.917-->00:18:33.417 uh, retain the ability to implant stego, upload the image, download it and have that 00:18:33.417-->00:18:40.208 message survive. Um, so deep learning. I'll, I'll talk about that in a minute. To zoom out a 00:18:40.208-->00:18:45.167 little bit first. Why social networks are such nice conduits for steganography. We all 00:18:45.167-->00:18:50.250 notice, um they're massive. There is so much content that is being poured across social 00:18:50.250-->00:18:56.000 networks on a, on a second by second basis um it's incredible, right? The scale is out of 00:18:56.000-->00:19:00.750 control. It's 4, almost 5 billion pieces of Facebook content shared per day, 100's of 00:19:00.750-->00:19:05.958 hours of YouTube shared per minute. 500 million tweets per day, about that, etcetera. So 00:19:05.958-->00:19:10.667 the idea here is that there's so much bi content being poured across it should be fairly 00:19:10.667-->00:19:16.875 trivial or fairly anecdotally simple to, to hide some piece of data in that huge stream of data 00:19:16.875-->00:19:22.500 being poured across. And uh even though it's public have someone, a recipient of that message be 00:19:22.500-->00:19:27.667 able to take that data from the sender, decode it and understand it while everyone else doesn't 00:19:27.667-->00:19:32.083 understand it, right? So that they have like a special key or certain way of uh de um 00:19:32.083-->00:19:37.292 decrypting that message. On top of that social networks themselves are evolving. So 00:19:37.292-->00:19:42.708 initially when it was Facebook and Twitter and the initial like My Space a lot of the way that 00:19:42.708-->00:19:47.958 we as humans communicated with each other was through text. You know. Um, it was very simple, 00:19:47.958-->00:19:53.500 140 characters. Uh we got the message across, text messages more and more now um and the 00:19:53.500-->00:19:56.792 older social networks are catching onto this but the way that we communicate with each 00:19:56.792-->00:20:01.125 other is mostly through images. And there is a lot of reasons for this um and there is a lot 00:20:01.125-->00:20:05.917 more engagement that gets um created as a result of this. But networks like Instagram, 00:20:05.917-->00:20:11.542 Snapchat, Pinterest, Tumblr, these type of networks where the primaril- the primary avenue of 00:20:11.542-->00:20:16.750 communication is over an image, whether it be a meme um or a, or a photo that I, that I take on 00:20:16.750-->00:20:21.083 stage and send out to my social network. Um we're living more in the moment and we want to share 00:20:21.083-->00:20:26.708 that instantly to other people. Um, so in addition to the fact that they're heavily trafficked 00:20:26.708-->00:20:31.333 and they have this public nature, um social networks provide convenient APIs for, for 00:20:31.333-->00:20:35.875 sharing content uh for developers and the apps that they build. And so it's fairly 00:20:35.875-->00:20:41.250 trivial for me if I have an account to design uh or to build some code that makes it so that 00:20:41.250-->00:20:46.458 I can automatically upload an image to social network and then in, in uh in turn download that. 00:20:46.458-->00:20:50.167 Um if you're worried about attribution, fake account creation is pretty trivial on 00:20:50.167-->00:20:54.000 all the social networks. Anyone can go up and assume some identity. Um, when you're 00:20:54.000-->00:20:57.917 worried about steganography and the more malicious kind of steganography which I'll get 00:20:57.917-->00:21:03.667 into in a little bit. Um if you're, if you're a, an IT guy in a company, from a network 00:21:03.667-->00:21:09.167 perspective or from, from a, from a, um forensics perspective social networks look completely 00:21:09.167-->00:21:14.208 benign. Interacting through a social network doesn't raise any red flags. Um it's expected 00:21:14.208-->00:21:18.625 almost, people post on social media at work all the time. Um in addition to these kind of 00:21:18.625-->00:21:22.417 characteristics you have a lot of examples of these things happening in the wild. And I'll 00:21:22.417-->00:21:27.625 go over that now. Um I put it up now and to kind of black hat versus white hat. And the most 00:21:27.625-->00:21:32.750 prominent example of this black hat example was HAMMERTOSS. And of course uh this was discovered 00:21:32.750-->00:21:37.750 by FireEye a few years ago. Um, and this was allegedly the Russian APT 29 group that um, 00:21:40.500-->00:21:45.500 that once the malware was installed locally on machines it would go up and look for um 00:21:45.500-->00:21:49.583 different social network users on Twitter and if the user would exist it would look for a 00:21:49.583-->00:21:55.167 hashtag and a URL that is associated with the last post they made and if that existed um 00:21:55.167-->00:22:00.458 at the URL there would be a link to, typically a Github page which contains an image and 00:22:00.458-->00:22:04.500 within that image with steganography BCF, all these, all these layers of obfuscation 00:22:04.500-->00:22:09.167 here that have been implanted by the attacker just to retain command control and to, to 00:22:09.167-->00:22:14.167 communicate with the infected machines. We have other examples of this, not just on Twitter. 00:22:14.167-->00:22:19.667 More recently you had uh, the allegedly again. the group Turla doing this with Britney Spears' 00:22:19.667-->00:22:24.333 Instagram comments. Um so they're getting pretty creative in the way that they uh maintain 00:22:24.333-->00:22:28.000 their command and control infrastructures. And so on the other side of the page here you 00:22:28.000-->00:22:32.500 have more white hat research and this, so, so, some pretty smart people last year at ENDGAME 00:22:32.500-->00:22:37.917 presented a way to um, deliver powershell code through Instagram images using discrete 00:22:37.917-->00:22:43.583 cosine transform uh, steganography and a- again this was away f- to maintain a 00:22:43.583-->00:22:47.958 command and control infrastructure and to um, to keep contact with the malicious 00:22:47.958-->00:22:53.458 computers or the infected computers or um, workstations. So, in addition to that you have 00:22:53.458-->00:22:57.875 uh, pretty cool tool I'd like to point you guys to called Secretbook by Owen 00:22:57.875-->00:23:03.000 Campbell-Moore. This was a Chrome extension that made it super easy for you to go up and 00:23:03.000-->00:23:08.000 put a little message into a Facebook post or a Facebook image and upload it or um upload 00:23:08.000-->00:23:12.042 it to the network and then download it and encrypt it and be able to recover that message 00:23:12.042-->00:23:16.792 on the other side. So the way that he did this and the way that the, the folks who did the 00:23:16.792-->00:23:22.500 Instagram research both did this um was that they were able to look at the quantization tables 00:23:22.500-->00:23:27.750 that were being used by both Instagram and Facebook and uh, and basically reverse engineer 00:23:27.750-->00:23:32.625 those things and once they knew or once they had the knowledge of what, what the, the 00:23:32.625-->00:23:37.458 quantization table or basically what, what the JPEG algorithm is doing behind the scenes they 00:23:37.458-->00:23:41.458 were able to predictably and reliability transfer data through the social networks 00:23:41.458-->00:23:46.500 despite the fact that they tend to declobber or, um or really um compress the, the crap out of 00:23:46.500-->00:23:51.500 the images. Um, and there is other heuristic discrete cosine transform schemes that exist. Um 00:23:53.583-->00:23:59.042 another reason why social networks are, are kind of nice conduits for social stego uh is 00:23:59.042-->00:24:03.458 that um, from, from like a machine learning perspective it's really easy to go up and 00:24:03.458-->00:24:09.875 get data. Um, as a, as a data scientist you need access to data and label data and so, it, 00:24:09.875-->00:24:14.458 it's very easy uh because social media provides permissive APIs I can take a bunch of images, um 00:24:14.458-->00:24:16.458 on my local machine and either upload them to an album in bulk and then download them or I can 00:24:16.458-->00:24:18.667 do it the hard way uh whereby I can just take a 4 loop on my local machine and add some time 00:24:18.667-->00:24:23.667 jitter to it so maybe to, to avoid some detection if it's very regular that I'm uploading 00:24:30.167-->00:24:35.167 images it might be very unpredictable and, and they might take notice. And so uh I 00:24:40.292-->00:24:45.417 can go up and I can piece by piece post each of these images to social network and then just 00:24:45.417-->00:24:50.417 download them at a click of a button uh from a Facebook album. Or not just necessarily Facebook 00:24:50.417-->00:24:55.292 but any other kind of social network. Um so to get back to this workflow that Mike 00:24:55.292-->00:25:00.792 introduced, uh we have a pre-uploaded social network image, um our server image that 00:25:00.792-->00:25:06.125 we want to upload to social media and then next we want to download it and the message that 00:25:06.125-->00:25:10.375 we stored before we uploaded we w- we want to be able to recover it. And so some of the social 00:25:10.375-->00:25:15.375 networks that Mike identified before, for example Pinterest and Google plus and Slack and 00:25:15.375-->00:25:19.125 Flickr, they don't do anything to the image when you, when you upload them to them to the 00:25:19.125-->00:25:24.292 social network. So, so there's no reason why you can't just do LSV out of the box or append it 00:25:24.292-->00:25:29.792 to the end of the file or change the metadata. Um they're not doing much so this for me is not 00:25:29.792-->00:25:35.875 interesting, um I care more about the fact that um different social networks um like, like 00:25:35.875-->00:25:41.167 Instagram and Facebook and Tumblr uh are compressing the image. So I wanna isolate these 00:25:41.167-->00:25:46.542 and I wanna be able to say um despite the, these alterations that are being made I wanna be 00:25:46.542-->00:25:51.458 able to still pass a message on, on the pre-upload side and recover that message after it's 00:25:51.458-->00:25:56.667 downloaded. That's kind of the challenge that I, that I posed for us. Um, and so why is this 00:25:56.667-->00:26:01.083 such a challenge? It's because you have different j- uh jamming techniques that are being 00:26:01.083-->00:26:07.083 employed by the social networks, um, when content is uploaded to the backend of their servers. Um 00:26:07.083-->00:26:11.333 and so they do this for a few different reasons the most obvious reason is that when they 00:26:11.333-->00:26:16.042 wanna serve up content to the users um they want to make it so that their users have a seamless 00:26:16.042-->00:26:22.333 UI or a seamless user experience should I say. Um they wanna be able to serve up images as you 00:26:22.333-->00:26:27.292 scroll through a timeline or as you scroll through albums. You wanna be able to uninterruptedly 00:26:27.292-->00:26:31.917 look at these images and render them on the fly. And um, because this is a very expensive 00:26:31.917-->00:26:36.625 operation typically on your mobile device uh they tend to compress it so they make it, 00:26:36.625-->00:26:40.792 they make the image smaller and when it's smaller it's able to be fed quicker and more easily 00:26:40.792-->00:26:45.417 and more conveniently. And it's not just compression there's a lot of different other uh types 00:26:45.417-->00:26:49.292 of techniques that are, that are used like lowpass filtering. Mike said stripping the 00:26:49.292-->00:26:54.500 metadata. Um they could even convert the file type so if you upload a PNG the social networks 00:26:54.500-->00:26:59.583 might convert it to a JPEG. Um, and there's other type of image alterations you can do like 00:26:59.583-->00:27:03.500 alpha compositing that might be, uh might be done. But there's anyway, here's a slew of 00:27:03.500-->00:27:07.542 different operations that are done by these social networks and I wanna say and I wanna kind 00:27:07.542-->00:27:12.250 of prove that despite these things we can still uh create a message that survives the uh, 00:27:12.250-->00:27:18.000 the transit through the social network. So this is a pretty fundamental um figure that I'll 00:27:18.000-->00:27:24.500 talk about for a few minutes. Um, when you, when you take a an image uh and you implant it with 00:27:24.500-->00:27:29.167 some stego and you or, or some hidden message, whatever it may be and you upload it to social 00:27:29.167-->00:27:33.083 network and then you download it. You have 2 images. You have your pre-uploaded image and you 00:27:33.083-->00:27:37.958 have your downloaded image. Um so what we did is we looked for a bunch of different images like 00:27:37.958-->00:27:42.917 this. Uh what was actually happening to the, to the individual pixel of these images 00:27:42.917-->00:27:48.042 as they transited through the social networks. As, as you can see this is a pre-posted pixel 00:27:48.042-->00:27:54.208 difference histogram. And what it means is that if I compare pixel to pixel the pre-uploaded 00:27:54.208-->00:28:00.833 and downloaded image um what is the difference in our GP value that I'm seeing from pre to, 00:28:00.833-->00:28:06.625 from pre to post during the transit? And the peak here for, for both Tumblr, Facebook and 00:28:06.625-->00:28:11.208 Twitter and the other networks that we saw when we compressed these things is centered at zero 00:28:11.208-->00:28:15.167 and when it's centered at zero that means that the majority of the pixels aren't changing. 00:28:15.167-->00:28:19.375 Alright so, so this is good news. Uh that means even though there's compression and other 00:28:19.375-->00:28:25.125 types of abrasions happening uh we might be able to somehow predict which of these pixels 00:28:25.125-->00:28:30.542 aren't changing in advance. But this is a really hard task because I can do it for a single 00:28:30.542-->00:28:36.875 image and I can do it for a few images but I wanna be able to know before I do the stego which 00:28:36.875-->00:28:43.583 image locations, which pixels are most um, are most embeddable are least likely to be changed 00:28:43.583-->00:28:47.500 by the social network transit and the compression and other stuff that they, that they do 00:28:47.500-->00:28:53.167 upon the image, right? So basically from a machine learning perspective uh we take 00:28:53.167-->00:29:00.125 a bunch of data and we take a bunch of images and we label it in a bin- binary fashion um all 00:29:00.125-->00:29:06.375 the pixels in the image which are least l- least likely to change so they have zero 00:29:06.375-->00:29:11.167 difference between the pre, pre-uploaded and post downloaded images. We label those pixels 00:29:11.167-->00:29:15.208 with a 1. Those are prime locations. Prime carrier locations for us that we wanna 00:29:15.208-->00:29:20.417 target with our message that we wanna embed in the image. All the other ones where you have 00:29:20.417-->00:29:24.958 some slight pixel differences happening between pre-upload and download uh we don't care about 00:29:24.958-->00:29:28.583 them. We want to toss those away. If we try to change some bit and store some message in 00:29:28.583-->00:29:33.583 those pixels it's going to be changed, alright. Uh, so you can do this and you can scale this 00:29:35.667-->00:29:41.667 up. So for example there's a lot of image libraries um, and we as a company should note that. And 00:29:41.667-->00:29:45.833 some of our own images and selected a bunch of samples because the algorithms that I'll 00:29:45.833-->00:29:51.750 talk about in a little bit um rely on a lot of data to be able to learn which locations with or 00:29:51.750-->00:29:57.792 which pixels within the image are most likely to survive um survive transit. Uh and we can 00:29:57.792-->00:30:01.833 automate the uploads and the downloads using the API functions. And so in the end you 00:30:01.833-->00:30:07.333 have let's say we start with 50-->000 um images. You have 50-->000 pre-uploaded and you have 00:30:07.333-->00:30:12.958 50-->000 post downloaded. And you can go and you can create labels like I said before and you can 00:30:12.958-->00:30:18.208 do the diff and you can create the labels so you have basically binary masks for each image. 00:30:18.208-->00:30:24.625 Alright. And so then the question is, great you have these labels, you have the for a 00:30:24.625-->00:30:30.958 bunch of different variable images, which locations were uh, are most likely to survive uh 00:30:30.958-->00:30:37.000 social network transit. Um now how can we go about predicting that for yet unseen images? Um 00:30:37.000-->00:30:43.000 and so to do that we want to use a neural network. Um but classic neural networks like this uh 00:30:43.000-->00:30:48.958 simple 1 layer hidden, with 1 layer single hidden layer types they don't scale well to images. 00:30:48.958-->00:30:52.583 Um when you have so many dimensions with the width of the image and the height of the 00:30:52.583-->00:30:57.042 image and you have the 3 RGB channels, what you end up getting is an unimaginable 00:30:57.042-->00:31:03.167 number of weights that would take way too long to compute. Um and so starting in the 2010's or 00:31:03.167-->00:31:06.583 even a little bit before that there was a class of algorithms that came out called 00:31:06.583-->00:31:11.583 Convolutional Neural Networks. And um, and these types of networks allow us to encode the 00:31:11.583-->00:31:16.583 properties of these images into the network itself, into the network architecture itself. So 00:31:16.583-->00:31:21.083 instead of dealing with hidden layers that are single dimensional we're now dealing 00:31:21.083-->00:31:26.125 with um, with multi-dimensional hidden layers. And you're basically kind of like the human 00:31:26.125-->00:31:29.625 visual field is doing, I won't dwell on this too much because it's, it's probably outside the 00:31:29.625-->00:31:34.917 scope of the talk but kind of like the human visual field is um, uh the visual system is 00:31:34.917-->00:31:39.917 doing, um it's taking convolutions or filters over each layer and it's in each 00:31:42.042-->00:31:47.000 layer it's responding selectively to activations in the previous layer. And so this 00:31:47.000-->00:31:51.958 has been proven to be um, really effective comp- for different computer vision tasks like 00:31:51.958-->00:31:57.000 object classification and facial recognition. Uh a lot of the big uh companies are using this now 00:31:57.000-->00:32:02.250 at scale and they sale this as products to you. Um but like I said before we wanna pose this 00:32:02.250-->00:32:08.958 as a binary classification task for each individual pixel. Given an unseen image I want to 00:32:08.958-->00:32:14.958 predict for each pixel which or ask the question for each pixel, is this pixel likely to change 00:32:14.958-->00:32:20.042 when I, when I upload it to the social network and download it. Or um is it likely to be one of 00:32:20.042-->00:32:24.542 the pixels that are gonna, are gonna change um and therefor I should kind of toss that away 00:32:24.542-->00:32:30.167 and not store a message there? And so this task is akin to image segmentation. I'll go into 00:32:30.167-->00:32:33.667 this, into more detail on the next slide. But you want to create a binary mask for each 00:32:33.667-->00:32:40.250 image so you basically want to select the pixels that are, that are most likely to, to keep your 00:32:40.250-->00:32:45.208 message intact and deselect the ones that are least likely to. Um and these, there's, these' a 00:32:45.208-->00:32:49.917 lot of reason why you would do this. You can imagine the path that the image takes. As it gets 00:32:49.917-->00:32:55.708 compressed the social network has a function that's being uh imposed upon the uh upon the 00:32:55.708-->00:32:59.792 image. And feed forward networks have very nice properties so that you can approximate these 00:32:59.792-->00:33:06.583 types of functions. Um so we set up uh, we set up a model uh and the model is built on uh built 00:33:06.583-->00:33:12.167 using python, um terrace using a tensor flow backend. Um if anyone has more details about 00:33:12.167-->00:33:16.542 the, more is, more interested about technical details come find me after. Uh but we used a 00:33:16.542-->00:33:21.542 GPU uh and we used a, a neural network with 23 layers fed through um, through ReLUs use 00:33:23.792-->00:33:28.792 that was kind of contracting and expanding. And it looked like these type of networks. So um if 00:33:28.792-->00:33:35.208 you can imagine finding pixels that are least likely to, to be changed as you upload an image 00:33:35.208-->00:33:42.208 to social network it's akin to uh identifying pixels and images, um let's say for objects 00:33:42.208-->00:33:48.167 right. So on the left hand side this is an image taken from Deep Mask, um and the idea here is 00:33:48.167-->00:33:53.500 that you want to do object recognition so you want to selectively choose pixels that 00:33:53.500-->00:33:57.917 are most likely to contain objects. On the right hand side, this is a pi- this is a picture 00:33:57.917-->00:34:02.583 from u-net and the idea here is, is that you have more of a biological use case where you 00:34:02.583-->00:34:07.083 have cells where you might be interested in like analyzing ultra sound or, or doing some 00:34:07.083-->00:34:12.042 kind of cancer screening or cancer detection. More and more of these tests are being um, are 00:34:12.042-->00:34:16.083 being accomplished by neural networks and more automated techniques. And less so by 00:34:16.083-->00:34:22.625 surgeons or, or doctors. Uh so the idea here is that you have specific cells that you want to 00:34:22.625-->00:34:26.875 isolate from the 4 uh you want to isolate the foreground from the background of this image And 00:34:26.875-->00:34:31.875 the same thing can be done or the same idea can be applied to um identifying pixels that are 00:34:34.500-->00:34:39.292 least likely to be clobbered or least likely to be altered during social network transit. 00:34:39.292-->00:34:43.708 Although it's not as pretty, you know you're not identifying objects anymore on the right 00:34:43.708-->00:34:48.125 hand said you see the base image and then on the, on the bottom you see the pixels that are most 00:34:48.125-->00:34:54.583 likely to, to be able to contain or be able to survive um social network transit. So these are 00:34:54.583-->00:35:00.417 the ones we want to select for um, for embedding our hidden message in. Um but it, it works 00:35:00.417-->00:35:04.875 to some extent right? So we're able to predict using a bunch of different image uh which pixel 00:35:04.875-->00:35:10.958 locations for an unseen image can survive the, the throughput. Um and so we have several 00:35:10.958-->00:35:17.458 different caveats to this. Um first we, we impose constraints upon the neural network. So that 00:35:17.458-->00:35:23.833 instead of uh being able to willy nilly e- embed a ton of different data uh we actually 00:35:23.833-->00:35:29.125 want to make sure that the difference between the pre and the post uploaded image um 00:35:29.125-->00:35:33.000 doesn't look completely different. Otherwise if we go too far in that direction you 00:35:33.000-->00:35:37.792 get in the, in the zone of watermarking where people are trying to put too much data in 00:35:37.792-->00:35:41.458 the image to make sure that it survives compression. We don't want to do that we wanna make it 00:35:41.458-->00:35:45.917 for a human still imperceptible. You don't want the human to notice that the message is 00:35:45.917-->00:35:51.292 stored inside there. Um, uh and so this affects the capacity to some extent. Uh but there's 00:35:51.292-->00:35:55.542 anyway there's different constraints that you can encode on these algorithms to make sure 00:35:55.542-->00:35:59.958 that um that they don't, that they don't show up for uh, for a human. You can do different 00:35:59.958-->00:36:06.625 things like MSSI uh uh MS SSIM or use peak signal-to-noise to impose that constraint. Uh and 00:36:06.625-->00:36:11.583 then the results we were looking at, and I, I've yet to quantify this but uh the, the learnt 00:36:11.583-->00:36:17.625 pixel locations that are most likely to, to survive social network transit with a message, 00:36:17.625-->00:36:22.792 um correspond to regions of im- of the image that are that tend to be more complex and busier 00:36:22.792-->00:36:27.208 and that's because of the constraint we imposed upon it. Um, that we wanna minimize the 00:36:27.208-->00:36:32.417 visual difference between pre and post image. And so what's the novelty here, um you know 00:36:32.417-->00:36:38.208 with, with spatial steganography traditionally and sp- by spatial I mean that you're actually 00:36:38.208-->00:36:43.958 flipping bits or you're doing LSB or, or even 2 um the 2 less bits or whatever you want to do. 00:36:43.958-->00:36:45.958 Uh typically uh this, this technique tends to have more storage capacity and so you can, 00:36:45.958-->00:36:47.958 you can imbed uh larger payloads within your image. Um compared to frequency based stego which 00:36:47.958-->00:36:49.958 is where you're encoding the message inside the discrete cosine transform coefficients. 00:36:49.958-->00:36:54.958 However typically it's been thought of as being compression or um any kind of alteration, 00:36:58.458-->00:37:03.458 intolerant. And so here we're trying to show that's not necessarily the case, alight. 00:37:10.208-->00:37:14.750 And so, previous ad hoc approaches were, were based on, okay I have a bunch of different 00:37:14.750-->00:37:20.292 um, images and I've, I've a network here and I wanna just try and see what happens and, 00:37:20.292-->00:37:26.042 and uh and present the result of, of what's actually going on, what can I actually do. Um here 00:37:26.042-->00:37:30.417 we wanna actually create a feedback loop and use the data on the other side and let it 00:37:30.417-->00:37:35.875 inform future data and make future predictions for us. And in principle although uh the 00:37:35.875-->00:37:40.208 results I'm showing you here today are, are being used on Tumblr uh this should generalize 00:37:40.208-->00:37:46.208 across social networks that, that use compression. Um, and so the nice thing here is that uh 00:37:46.208-->00:37:50.083 you don't necessarily need to know the implementat- implementation details of what's 00:37:50.083-->00:37:54.917 going, going on behind the scenes. Uh you don't need to necessarily know in advance that 00:37:54.917-->00:37:59.750 the social networks imposing this specific type of compression um, or with this 00:37:59.750-->00:38:03.750 certain specific range. Uh you can just kind of let the data and let the machine learning 00:38:03.750-->00:38:08.750 algorithm do that work for you. Uh, uh and then just to kind of um, to kind of contextualize 00:38:12.750-->00:38:19.625 this. I got up on stage last year and, and gave this slide and the idea here is that um a 00:38:19.625-->00:38:26.125 lot of, a lot of past thinking in, in uh information security based on machine learning but 00:38:26.125-->00:38:31.125 applied to defense so whether it be um network intrusion detection or spam filtering or 00:38:33.500-->00:38:39.250 um antivirus prediction, um people tend to associate machine learning with being able to 00:38:39.250-->00:38:44.000 detect this stuff in the back as you're doing. Um but last year I was up on stage with my 00:38:44.000-->00:38:49.000 colleague John Seymour and we talked about a way to generate text and generate messages on 00:38:49.000-->00:38:55.333 Twitter that people were much more likely to click on. Um, uh and so the idea here was that 00:38:55.333-->00:39:00.583 you could use uh a neural network and train based on people's preferences and their 00:39:00.583-->00:39:05.250 likes and interests based on their Twitter timelines and actually deliver them a payload 00:39:05.250-->00:39:10.292 and deliver them uh a message that looks a lot like what uh is something that they might be 00:39:10.292-->00:39:15.125 interested in clicking on. Again, uh and so the idea here is that you can kind of mix the 00:39:15.125-->00:39:20.792 effectiveness and the high accuracy. Um but the get away from the high manual labor 00:39:20.792-->00:39:26.500 associated with spear fishing. Um and still um, and scale it up to the level you would see with 00:39:26.500-->00:39:32.917 fishing. And so kind of the, the overarching theme here is that um red team or offensive 00:39:32.917-->00:39:37.958 techniques and machine learning is rising. Um there's a growing number of examples in literature 00:39:37.958-->00:39:42.917 um both the stuff we works on last year and this year when it came to steganography and 00:39:42.917-->00:39:46.792 micro-targeted social engineering on Twitter but also when it comes to password 00:39:46.792-->00:39:53.125 cracking, captcha subversion. Um Hyrum Anderson gave a talk recently about antivirus evasion 00:39:53.125-->00:39:58.250 and so th- these type of things are being uh employed more and more and um, in, in fact it's 00:39:58.250-->00:40:02.208 easier that defensive machine learning. You don't need to necessarily go out and get a lot 00:40:02.208-->00:40:07.208 of labeled samples to be able to do this effectively. Here I was able to automate the, the labels 00:40:07.208-->00:40:11.750 I got just based on differences between pre and post uploaded images. The work we did last 00:40:11.750-->00:40:17.583 year with micro targeted social engineering. We use um, we didn't even need labels, um it 00:40:17.583-->00:40:22.958 was unsupervised in nature. So, we'd let the network spit out a tweet that looked like exactly 00:40:22.958-->00:40:28.542 s- what someone might post previously, right. On top of that, um the success matters 00:40:28.542-->00:40:33.750 less um for the red team ya know. If I go out a 100 times and I succeed once, that's 00:40:33.750-->00:40:39.083 great. For the blue team it's the exact inverse, right? And so, there's like of like a, a 00:40:39.083-->00:40:42.833 slew of these different characteristics that are conspiring to make attacks 00:40:42.833-->00:40:47.375 easier and make machine learning a, a viable way to do this. On top of that the retreating 00:40:47.375-->00:40:54.375 barriers to entry. Um, but I don't wanna worry people here. I think red team machine learning 00:40:54.375-->00:40:57.583 and offensive machine learning is a positive development for the community. It's going to 00:40:57.583-->00:41:01.875 start keeping us honest. If you apply statistics and make the attach more statistical in 00:41:01.875-->00:41:06.417 nature, it's going to make your defenses more robust and fortify them in the long run. And uh, 00:41:06.417-->00:41:12.750 and I think people like Elon Musk who, who tend to be more fear mongering about AI, um you 00:41:12.750-->00:41:17.000 know they, they might have other ulterior motives to do that but I think i- in the long run for, 00:41:17.000-->00:41:20.500 for security this is going to be really a really nice development. Uh it's only going 00:41:20.500-->00:41:24.292 to improve security and the faster this is realized the better we'll all be. >>Yeah, so 00:41:24.292-->00:41:29.292 ya know from a forensic standpoint and trying to perform steganalysis right is, is quite 00:41:34.750-->00:41:39.750 difficult. And so this sort of um simulated offensive approach to testing out all the different 00:41:42.417-->00:41:47.875 characteristics in ways in which you could potentially hide data and all the different methods 00:41:47.875-->00:41:54.833 that we've outlined so far from an ML perspective that is, does that allow you to get ahead of 00:41:54.833-->00:41:59.583 uh the people that may be actually looking to maliciously exploit that? Right? And from 00:41:59.583-->00:42:04.750 that learn other ways say which you can further jam or prevent those techniques. I think that's 00:42:04.750-->00:42:10.375 ya know some of the things to consider here. Um, in looking at the general use cases and we're 00:42:10.375-->00:42:15.750 almost out of time here, ya know coming back to some of the actual use cases from a data 00:42:15.750-->00:42:21.083 exfiltration standpoint if somebody is communicating covertly, posting these, ya know 00:42:21.083-->00:42:25.000 they, they look very benign right when people are posting images to social and although it 00:42:25.000-->00:42:29.667 may be a medical environment a government environment or something else for that matter, 00:42:29.667-->00:42:34.375 when people post that you may be observing that on the network. You may be observing what they 00:42:34.375-->00:42:39.917 posted. It may look very, very benign but as we've demonstrated these techniques definitely 00:42:39.917-->00:42:45.958 circumvent, a majority of your IDSs, malware protection systems and, and other types of security 00:42:45.958-->00:42:52.042 products. And so, it remains a big threat and a big risk. Furthermore, it makes a perfect 00:42:52.042-->00:42:56.833 dead drop, right? Hiding in plain sight. Whether you played Zelda on Nintendo and try to 00:42:56.833-->00:43:02.125 find that brick where that ya know item was hidden behind, to a digital ya know, applied 00:43:02.125-->00:43:08.167 perspective of that. This provides a great mechanism for performing that. Furthermore, 00:43:08.167-->00:43:12.417 it's been demonstrated in the wild and there are real use cases like HAMMERTOSS and others 00:43:12.417-->00:43:18.125 in which the CNC was weaponized. Um and then uh one other thing I'll mention in terms of 00:43:18.125-->00:43:23.583 privacy, ya know when we post those images to what extent is that data stripped away? Uh and 00:43:23.583-->00:43:28.958 conversely how can that be further used to communicate covertly? >>Cool, yea and, and 00:43:28.958-->00:43:33.542 you can also think about this in terms of the, ya know bypassing the censorship type of situation 00:43:33.542-->00:43:37.250 more and more, ya know governments of the world and a lot of western governments too 00:43:37.250-->00:43:42.500 are uh, are imposing restrictions of what can and cannot be posted on social. And 00:43:42.500-->00:43:47.750 so, this was one of the ideas that was um, that was emphasized in the, in the Chrome uh tool 00:43:47.750-->00:43:53.417 talk. The, the one by Owen Campbell-Moore is that, these type of uh hidden messages allow 00:43:53.417-->00:43:57.792 you to still retain the ability to, to bypass these online sensors and still get your 00:43:57.792-->00:44:01.917 message across to the people that you want to reach. Uh and then lastly kind of the one of 00:44:01.917-->00:44:05.792 the purposes we wanted to emphasize here is that uh we which want to raise social media 00:44:05.792-->00:44:10.625 security awareness in general. Um a lot of people may not even be aware of the fact that when 00:44:10.625-->00:44:14.583 you upload an image from your phone or from your camera the metadata or other identifying 00:44:14.583-->00:44:18.917 characteristics might be still there. And this might be a really nice way or a really easy 00:44:18.917-->00:44:23.083 way for government to co- uh government to track you and track your location and other 00:44:23.083-->00:44:27.458 type of metadata that's surrounding um that's surrounded the images that you're posting. 00:44:29.542-->00:44:34.542 >>So just to wrap up then. Uh we've started to spread into uh video and audio. So um, one 00:44:37.042-->00:44:41.417 example is some of the uh sites will allow you to upload audio but it will get converted from 00:44:41.417-->00:44:48.167 an MP3 to an MP4 but in others you can upload an MP3 and within that a lot of MP3s have that 00:44:48.167-->00:44:54.333 field for a JPEG so could you hide information within the JPEG within the MP3, upload that to 00:44:54.333-->00:45:00.042 social nad would it survive. In our test cases so far, yes it has. So you could certainly 00:45:00.042-->00:45:05.042 leverage that from an audio and even a, a video standpoint too with MP4s. >>Eh, and really 00:45:07.542-->00:45:13.250 quickly in terms of mitigations, you know, we're not, we're not presenting in, in defeatable or 00:45:13.250-->00:45:19.417 un, un unrefutable uh technique here. There's um, there's things that can be done. You can, you 00:45:19.417-->00:45:23.750 can in- you can imagine more sophisticated and dynamic jamming techniques. So, switch 00:45:23.750-->00:45:27.792 over the quantization tables more often and more frequently and there are different ways to 00:45:27.792-->00:45:33.417 detect steganography as well that are well vetted out in the literature. Um and so, ya know 00:45:33.417-->00:45:37.167 that's it. Here's some summary points and we're going to be around for questions after this 00:45:37.167-->00:45:40.708 if anyone is interested in talking about it. Uh I'm going to release some code in the next 00:45:40.708-->00:45:44.417 few weeks that will allow you to play with steganography on different social networks and 00:45:44.417-->00:45:50.000 automated through your um, um through, through your user. Um, and if anyone else, this is, 00:45:50.000-->00:45:54.083 this is in a lot of ways this is a work in progress so if anyone is interested in these types of 00:45:54.083-->00:45:59.417 techniques and this approach um just let me know and I would love to continue and collaborate 00:45:59.417-->00:46:04.417 on these ideas later. Thanks. [applause] >>Great thanks everyone. [applause]