IJCCCE Vol.13, No.1, 2013 _____________________________________________________________________________________ A New Approach for Hiding Data within Executable Computer Program Files Using an Improvement Cover Region Dr. AbeerTariq1 EkhlasFalih1 Eman Shaker1 1Computer Science Department, University of Technology, Baghdad email: [email protected] [email protected] [email protected] Received: 27/1/2013 Accepted: 22/7/2013 Abstract – The process of hiding is considered to be one of the important security branches which are used to ensure the safe transfer of vital data and its protection against theft or editing. Recently, the need for developed hiding methods have greatly increased as the programming technologies that are capable of detecting hidden data, which are hidden using conventional methods, have undergone a great leap in progress. This paper aims to introduce a novel method of hiding a text inside an executable (.exe) file. This is considered one of the recent, more developed types. The suggested system has been tested on two types of executable files. The first type was written using (C++.exe) whereas the second was written using (VB.exe). The text was hidden using the suggest method (Cover Region and Parity bits) through which the executable file will be segmented into (regions) afterwards, each group of values will be tested alongside the value of the secret message that needs to be hidden. The suggested approach was applied on several texts and the result was that hiding via the executable files of the (VB) types is faster and it occupies less size than the (C++) type.. Keywords –C++ execution file,VB execution file and Cover Region and Parity Bits. 55 IJCCCE Vol.13, No.1, 2013 A New Approach for Hiding Data within Executable Computer Program Files Using an Dr. Abeer Tariq et. al. Improvement Cover Region 1. Introduction as well as internal programmer notes Internet communication has become and identifiers, redundant sections of an integral part of the infrastructure of code and infuriatingly in some senses today’s world. The information coding "bloat." All of this adds up to communicated comes in numerous forms large and essentially random file sizes and is used in many applications. In a for exe files. As such, it might be large number of these applications, it is possible to embed and hide large desired that the communication be done in amounts of data in encoded form in secret. Such secret communication ranges an exe file without disrupting the from the obvious cases of bank transfers, file's ability to be executed, or run, as corporate communications, and credit card a program but crucially without purchases, on down to a large percentage anyone discovering that the exe file of everyday email. With email, many has a dual function [3]. people wrongly assume that their communication is safe because it is just a 2. Theoretical Background small piece of an enormous amount of data being sent worldwide. After all, the Steganography can be split into two Internet is not a secure medium, and there types: Fragile and Robust. The following are programs “out there” which just sit section describes the definition of these and watch messages go by for interesting two different types of steganography. information [1]. 1. Steganography and encryption are 2.1 Pure steganography: -A both used to ensure data steganographic system which does not confidentiality. The main difference require prior exchange of some secret between them is that with encryption information (like a stego key) is pure anybody can see that both parties are steganography. The embedding process communicating in secret. can be described as a mapping Steganography hides the existence of E: CxMS a secret message and in the best case whereC is the set of possible covers and nobody can see that both parties are M is the set of possible messages. communicating in secret. This makes steganography suitable for some The extracting process consist of a tasks, such as copyright marking, for mapping which encryption isn't. Adding D: SM encrypted copyright information to a file could be easy to remove but extracting the secret message out of a embedding it within the contents of cover . the file itself can prevent it from 2.2 Secret key steganography: -In secret being easily identified and removed key steganography, the sender chooses [2]. cover C and embeds the secret message 2. There is one group of files that vary into C using secret key K. If the key in the enormously in size and are usually embedding process is known to the rather difficult to examine in detail receiver, he can reverse the process and because they are comprised of extract the secret message. The mapping compiled computer codes which are of the process if K is the set of secret executable, or exe, files. These files keys. tend to contain lots of what might be described as "junk data" of their own Ek: C×M×KS 56 IJCCCE Vol.13, No.1, 2013 A New Approach for Hiding Data within Executable Computer Program Files Using an Improvement Cover Dr. Abeer Tariq et. al. Region And 28 = 256 colors and in a 24-bit bitmap, 24 Dk: S×KM there can be 2 = 16777216 colors. with the property that Information can be hidden in many Dk(Ek(c,m,k),k)=m for all mM,cC different ways in images. Straight and kK is called a secret key message insertion can be done, which will steganography system simply encode every bit of information in 2.3 Public key steganography:- the image. More complex encoding can be Public key steganography system done to embed the message only in noisy require the use of two keys, one is areas of the image that will attract less private and the other one is attention. The message may also be public.The public key is stored in scattered randomly throughout the cover a public database whereas the image [4]. public key is used in the embedding process. The private key is used to reconstruct the 3.2 Hiding in Audio secret message [4]. General principles of data hiding technology, as well as terminology adopted at the First International Workshop on Information Hiding, Cambridge, U.K. are illustrated in Figure 3. Media Used for Hiding (3.1). There are different media for hiding data:- A data message is hidden within a 3.1 Data hiding in images cover signal (object) in the block called In a computer, images are represented embeddor using a stego key, which is a as arrays of values. These values represent secret set of parameters of a known hiding the i3.ntensities of the three colors R(ed) algorithm. The output of the embedded is G(reen) and B(lue), where a value for called stego signal (object). After each of the three colors describes a pixel. transmission, recording, and other signal processing which may contaminate and Through varying the intensity of the bend the stego signal, the embedded RGB values, a finite set of colors message is retrieved using the appropriate spanning the full visible spectrum can be stego key in the block called extractor [5]. created. In an 8-bit gif image, there can be Figure (1) Block diagram of data hiding and retrieval. 57 IJCCCE Vol.13, No.1, 2013 A New Approach for Hiding Data within Executable Computer Program Files Using an Dr. Abeer Tariq et. al. Improvement Cover Region 4. Basic Media (Cover) and A number of different cover objects Techniques Used In Proposal (signals) can be used to carry hidden messages. Data hiding in audio signals The execution file used as a cover, exploits the imperfection of the human and Cover Region and Parity Bits auditory system known as audio masking. technique used as technique in our In thepresence of a loud signal (masker), proposal: another weaker signal may be inaudible, depending on spectral and temporal 4.1 Executable File characteristics of both masked signal and An executable file is a file that is used masker [5].Masking models is extensively to perform various functions or operations studied for perceptual compression of on a computer. Unlike a data file, an audio signals. In the case of perceptual executable file cannot be read because it compression the quantization noise is has been compiled. On an IBM hidden below the masking threshold, compatible computer, common executable while in a data hiding application the files are .BAT, .COM, .EXE, and .BIN. embedded signal is hidden there. Data Depending on the operating system and its hiding in audio signals is especially setup, there can also be several other challenging, because the human auditory executable files [7]. system operates over a wide dynamic To execute a file in MS-DOS and range. The human auditory system numerous other command line operating perceives over a range of power greater systems, type the name of the executable than one billion to one and a range of file and press enter. For example, the file frequencies greater than one thousand to myfile.exe is executed by typing myfile at one. the prompt. Sensitivity to additive random noise Other command line operating is also acute. The perturbations in a sound systems such as Linux or Unix may file can be detected as low as one part in require the user to type a period and a ten million (80 dB below ambient forward slash in front of the file name, for level).However, there are some “holes” example, ./myfile would execute the available. While the human auditory executable file named myfile. system has a large dynamic range, it has a To execute a file in Microsoft fairly small differential range.