{"id":31080,"date":"2019-10-31T21:39:19","date_gmt":"2019-10-31T18:39:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/steganografiya-v-fajlovoj-sisteme\/"},"modified":"2019-10-31T21:39:19","modified_gmt":"2019-10-31T18:39:19","slug":"steganografiya-v-fajlovoj-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/steganografiya-v-fajlovoj-sisteme","title":{"rendered":"Steganography in file systems","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hello, Habr. <\/p>\n

<\/p>\n

I want to introduce you to a small project on steganography<\/a><\/noindex>, created in my free time from studies. <\/p>\n

<\/p>\n

I developed a project for hidden information storage in the file system (hereinafter referred to as FS<\/strong>).
\n). This can be applied for stealing confidential information for educational purposes.<\/p>\n

<\/p>\n

\"Steganography<\/p>\n

<\/p>\n

For the proof of concept, I chose a fairly old Linux FS ext2<\/a><\/noindex>. <\/p>\n

\n<\/a><\/noindex><\/p>\n

Implementation<\/h3>\n

<\/p>\n

Implementation Considerations<\/h4>\n

<\/p>\n

If you properly 'examine' the ext2 standard, you can replace it with what is known in the FS Superblocks<\/strong><\/a><\/noindex>, which contains the basic information about the system. I also found Block Bitmap<\/strong><\/a><\/noindex> and Inode Table<\/strong><\/a><\/noindex>. Almost immediately, the idea came up to write information into currently empty blocks of the FS. Now it was necessary to think about protection against a programmer armed with a hex editor<\/a><\/noindex>. <\/p>\n

<\/p>\n

. If the hidden information is stored without encryption, even though it is dispersed throughout the FS, it will still be too noticeable, especially if the programmer knows what to look for. Therefore, it was decided to encrypt all blocks of the original file. I chose a block cipher AES<\/a><\/noindex>, but as you can understand, this is not critical.<\/p>\n

<\/p>\n

To distinguish the required blocks from the others when reading, it was decided to add a special marker to the beginning of each block. This marker was encrypted based on the block number in the original file. This trick immediately allowed not only to find the necessary blocks, but also to know their correct order.<\/p>\n

<\/p>\n

Overall System Principle.<\/p>\n

<\/p>\n

\"Steganography<\/p>\n

<\/p>\n

Write Algorithm<\/h4>\n

<\/p>\n

In steps:<\/p>\n

<\/p>\n