hidebehind 0.0.1

A steganography library

hidebehind

What is this?

It's a simple python library to embed data (files) into image/video/audio files.

Why?

It was written for educational purposes only. It may contain bugs, so use it at your own risk!

Installation

$ python3 -m pip install hidebehind
# Create an alias for it. Note, if you use zsh, change .bashrc to .zshrc 
$ cp ~/.bashrc ~/.bashrc.bak && echo "alias hide='python3 -m hidebehind'" >> ~/.bashrc && source ~/.bashrc 

Quick start examples

First, read Unix philosophy:

Write programs to handle text streams, because that is a universal interface.

Assume you have:

$ echo "Dream big and dare to fail" > secret1.txt
$ echo "Talk is cheap. Show me the code." > secret2.txt
$ wget https://github.com/multifrench/hidebehind/blob/main/img/Gauss.png

Then:

$ hide put -c Gauss.png < secret1.txt > embedded.png
$ hide get < embedded.png > s1-restored.txt
$ cat s1-restored.txt

Encryption

It's not safe to transmit unencrypted (sensitive) information over public connections.
In this example I'll use GnuPG, but you can use anything you want (i.e. VeraCrypt)

# Encrypt:
$ gpg -er <YouKeyID> -o - < secret2.txt | hide put -c Gauss.png > embedded.png
# Decrypt:
$ hide get < embedded.png | gpg -d > s2-restored.txt
$ cat s2-restored.txt

Multiple files & compression

In case you want to transmit more than one file at once, use tar.
It's also a good idea to compress our data. I'll use bzip2.

$ tar -c secret?.txt | bzip2 -9 | hide put -c Gauss.png > embedded.png
# And get our data back:
$ hide get < embedded.png | tar -xj
$ cat secret?.txt

Integrity

In addition, to be sure our files weren't corrupted, we will write down their hashes (sha256sum) into a separate file and use technique from the previous paragraph to save them.

$ sha256sum secret?.txt > .shasum
# Copy-paste the previous code block but add `.shasum` into the archive.
$ tar -c secret?.txt .shasum | bzip2 -9 | hide put -c Gauss.png > embedded.png
# Get our data back:
$ hide get < embedded.png | tar -xj
# Now, verify the data wasn't corrupted (or it was)
$ sha256sum -c .shasum

What else?

Write programs to handle text streams, because that is a universal interface.

Remember? I hope now you're (if you weren't) convinced it's very useful technique. You may, for example, want to embed encrypted and compressed secret and then check its integrity. It's up to you.

How does it work?

Do you see the difference?

Nor do I. But there is a secret embedded in it!

Stay hungry. Stay foolish

Basically, the idea behind it is that the human eye is very insensitive. It can't detect difference in less than 1%.
The program slightly changes the value of blue part (of an RGB pixel).

Implementation detail

Assume we want to hide a sequence of bytes S (that's our secret message; it's not necessarily a string of printable characters, i.e. a binary file) into an image I. For simplicity, we assume an image is an NxMx3 array, where I[i][j] is [red, green, blue]. We are only interested in 0 <= blue < 256 value. It's possible to represent it as a binary number. For example, 55 = 0b110111. If we clear last least significant bit, we get 0b110110 = 54. We changed the value of it only by less than 0.4%! Having done so, now we can store the payload there. Yes, a bit of the payload goes into one pixel. If we want to embed more, we modify two least significant bits. The maximum difference then will be 1.2%, but it's still OK.