Investigating Steganography in Audio Stream for Network Forensic Investigations: Detection & Extraction Yao Lu a thesis submitted to the graduate faculty of design and creative technologies AUT University In partial fulfillment of the Requirements for the degree of Master of Forensic Information Technology School of Computer and Mathematical Sciences Auckland, New Zealand 2014 i Declaration I hereby declare that this submission is my own work and that, to the best of my knowledge and belief, it contains no material previously published or written by another person nor material which to a substantial extent has been accepted for the qualification of any other degree or diploma of a University or other institution of higher learning, except where due acknowledgement is made in the acknowledgements. ……………………………. Yao Lu ii Acknowledgements This thesis was completed at the Faculty of Design and Creative Technologies in the school of Computing and Mathematical Sciences at Auckland University of Technology, New Zealand. Support was received from many people through the 2 years of study. Firstly, I would like to thank my family; my mother Xiangyan Xiao and my father Jianhua Lu who provided financial support. Also special thanks to my fiancée Natalie Ai who took care of my daily life so that I can focus on the thesis research. I would also like to thank my thesis supervisor, Prof. Brian O. Cusack who has provided valuable support and inspiration in the thesis project. With his support the project progressed smoothly. There are many other staff members at AUT that deserve thanking for their support. Jung Son for setting up EnCase for the research and Alastair Nisbet for managing the laboratory environment for the research testing. Other classmates supported the research with their knowledge and encouragement. Ting and Wei Li were always providing ideas in regards to the research project. Last but not least, thanks to the members of various open source communities. Specifically, thanks to Backbone Security for providing free trial version of StegAlyzerAS and StegAlyzerSS. Thanks to Chad Davis from Backbone Security who has answered my queries regarding to technical issues and thanks to the proof reader. iii Abstract There are more than 200 steganography tools have been developed by software developers for use in digital media. Multimedia technologies are readily available in the steganography field. They have complex encoding algorithms and compression methods to hide information. Audio is a common multimedia format that is widely used in the Internet. The uploading, downloading and transmission of audio files through the Internet is done through many different audio streams. Audio steganography activities could happen in any of those audio streams. The possibility puts challenges to traditional digital forensic investigation. In order to investigate audio streaming steganography, several steganography detection tools and network stream capture tools need to be involved and evaluated. The current academic literature has little support in this topic area for forensic investigation knowledge. Therefore, the main focus of the research project is to investigate steganography in audio streams as a forensic investigation. The research asked the question; What are the procedures and challenges when conducting digital forensic investigations for audio steganography? Five testing phases were designed. In phase 1, three audio steganography tools and two steganography detection tools were tested in order to determine suitable tools for conducting case scenario testing. Openpuff and StegAlyzerAS were found to be the best audio steganography embedding tool and detection tool respectively. WireShark was tested to evaluate audio streaming capture capability as well as packets analysis capability. Phase two involved conducting the case scenario simulating a criminal activity using audio steganography in which Openpuff was used to create four audio steganography files containing evidence. Phase 3 and phase 4 then used combinations of digital forensic tools and steganalysis tools to detect and extract the secret contents from audio streams using standard forensic procedures. iv The research findings showed that Openpuff was better than Mp3Stegz and S-Tools both in audio steganography embedding processes and audio steganography extraction processes. StegAlyzerAS was capable of detecting audio steganography tools after scanning while StegAlyzerSS was incapable of detection audio steganography contents during scanning. Additionally, WireShark successfully captured audio streaming packets. The analysis on these captured packets indicated that WireShark would not identify any steganography activities but the analysis could show information such as the type of files in the packet. This information was then used to reduce the scope of the forensic investigation and to better target audio steganography on a suspect’s hard drive. After comparative analysis on original evidence and extracted evidence, the extraction rate of audio steganography achieved 75% in the case simulation. The research has provided knowledge on audio steganography investigation methods and indicates that current forensic tools could cause problems for investigation unless correctly applied. Current steganalysis tools are designed for looking at particular algorithms in steganography but there are other algorithms that are used in audio steganography. This is the challenge for forensic investigators. Therefore, a possible design of an audio steganography tool within a logical flow chart diagram was proposed for future research (see Figure 6.1). v Table of Contents Declaration ........................................................................................................ i Acknowledgements .......................................................................................... ii Abstract ........................................................................................................... iii List of Tables ................................................................................................. viii List of Figures .................................................................................................. x List of Abbreviations ...................................................................................... xii Chapter 1: INTRODUCTION 1.0 BACKGROUND ................................................................................... 1 1.1 MOTIVATION ....................................................................................... 3 1.2 STUCTURE OF THESIS ...................................................................... 5 Chapter 2: LITERATURE REVIEW 2.0 INTRODUCTION ................................................................................. 8 2.1 STEGANOGRAPHY DEFINITION ..................................................... 9 2.2 STEGANOGRAPHY THROUGHOUT HISTORY .............................. 9 2.3 STEGANOGRAPHY TECHNOLOGY .............................................. 11 2.3.1 Categories of Steganography ..................................................... 12 2.3.2 Types of Steganography ............................................................ 16 2.4 ISSUES IN STEGANOGRAPHY ....................................................... 18 2.5 STEGANOGRAPHY TOOLS ............................................................. 19 2.5.1 BackYard ................................................................................... 19 2.5.2 BMP Secrets .............................................................................. 20 2.5.3 Info Stego .................................................................................. 20 2.5.4 MP3Stego .................................................................................. 21 2.5.5 F5 ............................................................................................... 22 2.6 AUDIO STEGANOGRAPHY ............................................................ 23 2.6.1 Embedding Methods in Audio Steganography .......................... 23 vi 2.7 STEGANOGRAPHY DETECTION ................................................. 30 2.8 STEGANOGRAPHY AND NETWORK AUDIO STREAMING FORENSICS ................................................................................................. 33 2.9 SUMMARY ISSUES AND PROBLEMS ........................................... 34 2.10 CONCLUSION .................................................................................... 36 Chapter 3: RESEARCH METHODOLOGY 3.0 INTRODUCTION ............................................................................... 38 3.1 REVIEW OF SIMILAR STUDIES ..................................................... 38 3.1.1 Feature Matching to Identify Steganography Software ............ 39 3.1.2 Information Hiding within Network Audio Streams ................. 41 3.1.3 Audio Steganalysis using GA .................................................... 43 3.1.4 Forensic and Anti-Forensic of Steganography .......................... 45 3.1.5 Network Forensic on Encrypted Skype Traffics ....................... 47 3.2 RESEARCH DESIGN ......................................................................... 49 3.2.1 Summary of Similar Studies ...................................................... 50 3.2.2 Review of Problem Areas .......................................................... 51 3.2.3 The Research Question .............................................................. 53 3.2.4 Research Model ........................................................................