A USA Today story claimed that al-Qaeda operatives were sending out encrypted messages by hiding them inside digital photographs [jpg files] on eBay. While the claim was never proved, it is very easy to hide [or embed] any other file[s] inside a JPEG image. You can place video clips, pdf, mp3, Office documents, zipped files, webpage or any other file format inside a JPEG image.
And when a suspecting user [read CIA, FBI] tries to open that jpeg file [with concealed information] in either a photo editing software or as a thumbnail inside Windows Explorer, it would be tough to make out if this camouflaged jpg file is different from any standard jpg image.
Let's say you want to hide a confidential PDF document from the tax investigation officers. What you can do is convert that file into a regular jpg image so even if anyone double-clicks this file, all he will see is a preview of the image and nothing else. And when you want to work on the actual PDF, just rename the extension from jpg to pdf.
Here's the full trick:
Step 1: You will need two files - the file you want to hide and one jpg image - it can be of any size or dimensions. [If you want to hide multiple files in one jpeg image, just zip them into one file]
Step 2: Copy the above two files to the C: folder and open the command prompt window.
Step 3: Move to the c: root by typing cd \ [if the files are in another folder, you'll have to change the prompt to that folder]
Step 4: The most important step - type the following command:
copy /b myimage.jpg + filetohide.pdf my_new_image.jpg
To recover the original PDF file, just rename my_new_image.jpg to filename.pdf.
Here we illustrated with an pdf file as that works with simple renaming. If you want to apply this technique to other file formats like XLS, DOC, PPT, AVI, WMV, WAV, SWF, etc, you may have to first compress them in RAR format before executing the copy /b DOS command.
To restore the original file, rename the .jpg file to .rar and extract it using 7-zip or Winrar.
That's it - No advanced Steganography tricks involved here. Just remember to write the correct syntax of the copy command:
copy /b sourceimage.jpg + filetohide.ext targetimage.jpg
More discussions at CMU, Mefi, Facepunch and Digg.
Find this article at: http://labnol.blogspot.com/2006/10/how-to-hide-secret-documents-or.html
web: http://www.labnol.org/ email: amit@labnol.org
Reader Comments
And how do you extract after that the information you've just hided?
Written on 2/10/06 6:27 PM
Just rename extension make a unreadable file. I test several times.
Written on 2/10/06 7:27 PM
I tested this with a PDF document and it opens perfect in Foxit Reader by renaming the jpg to pdf.
However, it is giving a "File Unreadable" error for other formats like PPT or AVI formats. Thanks for pointing that.
In these cases, we have to take an additional step of zipping the file in rar format before concealing it as a jpg file.
Written on 2/10/06 7:46 PM
How would you (or ebay or the nsa) even know they were encrypted or not?
Written on 2/10/06 8:25 PM
Few years back, around 5-6 years back, when there were websites distributing MP3 files, they used to do stuff like this. There used to be a software to do the job.
I thinkm this was the one: http://camouflage.unfiction.com/
Regards,
Deep
Written on 3/10/06 12:01 AM
Good find Deep. You seem to have a great memory.
Here's an overview from their site for other readers:
Camouflage allows you to hide files by scrambling them and then attaching them to the file of your choice. This camouflaged file then looks and behaves like a normal file, and can be stored, used or emailed without attracting attention.
For example, you could create a picture file that looks and behaves exactly like any other picture file but contains hidden encrypted files, or you could hide a file inside a Word document that would not attract attention if discovered. Such files can later be safely extracted.
Written on 3/10/06 12:13 AM
Hi it did not work for me. My os is XP. and i have address 2 jpg files together like this.
copy /b b.jpg+ 1391.jpg final.jpg
When i rename final.jpg to final.rar i am not able to open it in winrar. IS my syntaxt is problem. Can any one help me.
Written on 6/10/06 7:38 PM
copy /b b.jpg+ 1391.jpg final.jpg
I think the syntax is a problem in your case.
You are not hiding a rar file inside final.jpg but a jpeg file itself.
Written on 6/10/06 7:50 PM
Found a proper way of doing this.
Zip all the files need to be hidden.
copy /b b.jpg+zip.zip final.jpg
Written on 6/10/06 10:40 PM
Cool trick. Although in regular steganography you'd never use a lossy format like JPG.
Written on 8/10/06 1:40 PM
Fuckin' NSA as it'd explored the secrecy of all the people and countries round the world........
Written on 15/12/06 1:45 PM
Much easier, more secure way:
http://www.metacafe.com/watch/394161/hide_your_secret/
Written on 21/1/07 10:01 AM
Nice, but...
How do you solve the problem of a JPEG file that was edited after joining the files? Renaming the image to a .rar gives an unreadable rar file.
And how do you explain the image size of a jpeg with a resolution of 1024*768 of > 5MB?
Anyway... normal people won't pay much attention to the file. :)
Written on 18/6/07 11:05 PM
You dont need to change the format to open the hidden file. Make sure you have WinRar installed. Right click on the file and choose Open with, then choose WinRar....it will open it..
Written on 23/8/07 4:22 PM
i am having problems when i try and extract the files back..
i tried to hide a pdf file into a jpg..
it copied successfully..(the size of the file became the size of jpg file + size of pdf file )
later when i tried to extract it,by changing the file extension back to pdf, it was not able to read the file..
what shall i do?
where do you think is the problem?
Written on 7/10/07 8:51 PM