Ask Ubuntu General Room

Android Dev

21:01

Ah, that makes sense:)

P.S. After many "what the heck?" moments I got my steganography program working today... turns out I forgot to change a bitwse OR to a bitwise AND

Nathan Osman

@RobotHumans I agree.

Android Dev

Now I just need to port it to Android :)

Byte Commander

Don't forget to obfuscate the steganography

Depending on how you do it, it's pretty easy to analyze whether there is something hidden (and then to extract it).

Android Dev

@ByteCommander I was thinking that I'd just encrypt the payload

Byte Commander

Not sure, but that would probably still be visible as "something is there"

It works by analyzing the noise in the image and comparing it to what one would expect in a natural photo

I've read a few articles a year ago or so

Nathan Osman

21:05

If the data is encoded with an OTP, it really doesn't matter.

Nobody will be able to retrieve the data.

Android Dev

@ByteCommander Hmmm... well I'm only manipulating the LSB... would that be enough to trigger the detection?

Byte Commander

Yep

Android Dev

@NathanOsman That's what I was thinking. They can know it's there, but they can't get at it

Nathan Osman

Exactly.

RobotHumans

I stopped aiming at the security field. Met some cool people there, but it's all so tedious. I'ld rather just write solutions to math problems or something.

Android Dev

21:07

@ByteCommander How would one obfuscate it? Use a pseudo-rand generator to embed the data in random pixels instead of just iterating through the columns and rows?

Byte Commander

It has been a while...

Nathan Osman

That would still be obvious.

Byte Commander

Steganalysis

Steganalysis is the study of detecting messages hidden using steganography; this is analogous to cryptanalysis applied to cryptography. == Overview == The goal of steganalysis is to identify suspected packages, determine whether or not they have a payload encoded into them, and, if possible, recover that payload. Unlike cryptanalysis, where it is obvious that intercepted data contains a message (though that message is encrypted), steganalysis generally starts with a pile of suspect data files, but little information about which of the files, if any, contain a payload. The steganalyst is usually...

^ probably a good start

Nathan Osman

The problem is that images often have saturated white or black.

So if you're randomly changing the LSB of saturated pixels, it's going to be obvious.

RobotHumans

fractal seeds would probably be an interesting place to start. if you wanted to have an a or b answer to something.

also, undetectable. >.>

Byte Commander

21:10

E.g. if the host image is a JPEG, you can find inconsistencies in the compression artifacts

Android Dev

@NathanOsman True. And it would also probably be suspicious that the image was PNG or Bitmap. The problem is it's incredibly difficult to do the LSB method on a JPEG because the compression is lossy... I think the only way to do it is to manipulate the FFT coefficients..

Byte Commander

Or if the original image is publicly available, one can simply compare.

> In particular, many simple steganographic systems simply modify the least-significant bit (LSB) of a sample;
this causes the modified samples to have not only different noise profiles than unmodified samples, but also for their LSBs to have different noise profiles than could be expected from analysis of their higher-order bits, which will still show some amount of noise. Such LSB-only modification can be detected with appropriate algorithms, in some cases detecting encoding densities as low as 1% with reasonable reliability.

Android Dev

@ByteCommander But, remember that there's a 50% chance that the target bit is already what you need it to be.

Byte Commander

Why does it say "message too long" if it is one line, but sends fine if I add a single line break somewhere? Stupid chat.

@AndroidDev Noise is not nose.

The LSBs are not equally distributed

RobotHumans

that's called javascript - destroyallsoftware.com/talks/wat

Android Dev

21:14

If I really want it to be as undetectable as possible, I could just use Steghide: github.com/StefanoDeVuono/steghide

But I wanted to write my own :D

Byte Commander

NaNNaNNaNNaNNaN Batman?

2

@AndroidDev So did I, back when I researched this, and gave up.

Android Dev

@ByteCommander Before or after you got it working without obfuscation?

Fabby

@ByteCommander upgoated

Android Dev

@ByteCommander - Here's a question though. How should I store the number of bytes comprising the payload so the loop knows when to stop trying to extract bits?

Byte Commander

Don't think I'm an expert, I just read a few articles a year or two ago...

Mateo

21:49

Woo, the screens and touch overlay are here!

Kaz Wolfe

it's not april fool's day yet.

stop doing jokes, companies!

Byte Commander

depends

Nathan Osman

PSA: we are permanently closing this account in favor of opening accounts on Reddit and Instagram. So long and thanks for all the fish! 😉

Tweeted by ChattyCapybaras on March 31, 2017 at 9:53 PM

@Seth ---^

Mateo

Isn't it that day across the world...

Nathan Osman

Yes, it is... "that day".

:D

RobotHumans

22:01

sup @Mateo

Kaz Wolfe

yubikey configured! \o/

it works perfectly :D

Nathan Osman

Fancy.

I should get one.

I only have the U2F one.

Seth

I wish I had bought the 4 too. Or the neo.

@NathanOsman lol

RobotHumans

tries to convince a local CC to build a raspi cluster in an ATX case. it's coming along

Mateo

@RobotHumans not much, working on a multitouch project

One of the screens is DOA though...

Looks like shipping damage

RobotHumans

22:09

nice. I was goofing earlier on a pandas project. back to work stuff between now and Tues though.

Fabby

@KazWolfe Another UbiKey fan! :-)

Kaz Wolfe

yeah, i just got the 4 today.

set it up, has my pgp keys and fido and everything.

Fabby

@NathanOsman What's with the purple?

RobotHumans

@Fabby he's just jealous of you flabricorn

Kaz Wolfe

i should probably order a second yubikey eventually and set up a backup device to be stored in a secure vault somewhere

Fabby

22:13

:D

Nathan Osman

@Fabby We all adopted solid colors. (By "we all" I mean me, Serg, Jacob, and Paranoid.)

Fabby

:D

Elder Geek

Hi all!

Fabby

Another old fart joined the Friday club!!!

Byte Commander

you forgot zach

Fabby

22:19

>:-)

Byte Commander

and anwar

and probably some more stupids...

Elder Geek

:-) The river is receding and I'm a happy guy.

Fabby

River? Receding?

You being flooded?

Elder Geek

Had a bit of a scare earlier today. I live next to a river and the heavy rains brought it to the top of the banks

Nathan Osman

Whoa.

Stack Exchange announces that they are shutting down chat in the long term in favor of Slack.

8

Didn't see that coming.

Kaz Wolfe

22:21

@NathanOsman clever.

Nathan Osman

Alright, how many people clicked that?

Kaz Wolfe

very clever.

Nathan Osman

:D

Kaz Wolfe

My resolver caught that.

Nathan Osman

Wat. Oh.

Fabby

22:22

a Libyan link??? Never!

Nathan Osman

Someone should star that for maximum use.

Elder Geek

Fortunately all is well.

Kaz Wolfe

@Fabby you don't know bit.ly, do you?

Nathan Osman

I'll pin it >:)

Kaz Wolfe

I want room owner!

Nathan Osman

22:23

I'll be hearing about this for days...

RobotHumans

@NathanOsman you got me. still, discord is almost as good. markdown support here is better though

Fabby

@KazWolfe I do... But in this case, I wanted to point out that it's a Libyan TLD link...

Nathan Osman

Oh, I like it here better.

But.

We all know what day it is.

Kaz Wolfe

Yes, March 31.

Nathan Osman

Maybe in some parts.

Fabby

22:24

@NathanOsman Not in your TZ it isn't...

Over here: yes!

Android Dev

@NathanOsman - So I was comparing the checksum of the original payload against that of the recovered payload, and it didn't match. So I though, well, that's odd, I'll just put a check in the loop to make sure that all the bits match... now here's what I don't get: out of 132,000 bytes, 154 of them had a bit flipped from what it was supposed to be. Now how exactly does that make sense?

Elder Geek

Stuck bits in RAM perhaps @AndroidDev

Fabby

@AndroidDev row-knocking hardware bug???

:D

Kaz Wolfe

hmmm... what would happen if i opened a bmp and then used a memory visualizer?

Elder Geek

:-)

Android Dev

22:25

@ElderGeek What would cause a bit to become stuck?

Nathan Osman

@KazWolfe Regrettably, I am familiar with the BMP file format.

@AndroidDev rowhammer.

Byte Commander

@NathanOsman The uploader has not made this video available in your country.

Elder Geek

Faulty hardware

Byte Commander

I saw the title though, but rickroll failed :P

Fabby

@NathanOsman Heh! I was first! (Row-knocking hardware bug = rowhammer)

Kaz Wolfe

22:26

i just memorized the url, and the resolver i have was kind enough to point that out.

Nathan Osman

@ByteCommander That's just lame.

Android Dev

@ElderGeek Hmmm... but if one out of every ~7,000 bits of the RAM was faulty, then how does the OS even run without crashing due to corrupted memory?

I suppose I could run memtest

Fabby

Oh? It was a Rick-Roll? I just clicked it because I actually like that song!

Elder Geek

Well, it's been a long day folks, I'm thinking dinner and downtime. All the best. @AndroidDev It couldn't hurt

Fabby

@ElderGeek This chat is downtime! (for me)

>:-)

Byte Commander

22:29

@Fabby Try this version of it too:

Never Gonna Give You Up (metal cover by Leo Moracchioli)

►

Fabby

@ByteCommander trying

@ByteCommander One of the few times I actually favourite one of your musical suggestions!

>:-) ;-)

Byte Commander

<3

Leo makes a lot of great covers of all kinds of songs

And funny videos

But what I am actually currently listening to is this:

Black Veil Brides - Legion of the Black (FULL MOVIE)

►

45 min music video to the complete concept album

second time already

Black Veil Brides - Faithless (Alive & Burning)

►

Fabby

Listening to Adele's Hello, (which you've posted before)

Ubuntu Questions on U&L

0

Q: Nginx symlinks not indexing

I'm running nginx 1.10.0 on Ubuntu 16.04 Nginx dos not follow symlinks. it even not list the symlink in directory index: as you see in the image wgi is a symlink and it doesn't list in directory index. and I get 404 error when I check localhost/wgi here is my nginx.conf: http { ## # Basic...

Sergiy Kolodyazhnyy

22:51

@Fabby Rick-roll is actually a pretty good song. Also, how do you like my name change ? (That's Serg by the way)

Fabby

I noticed earlier already....

Sergiy Kolodyazhnyy

:3

Fabby

(Could only have been you)

:D

Byte Commander

Oh, less to type again? Good choice :P

@Fabby You still have Nathan's chat script btw? It does emoji embedding now.

edwinksl

looks like i missed the drama here meta.askubuntu.com/questions/16860/…

Fabby

22:57

@ByteCommander Nope... Where to find?

Sergiy Kolodyazhnyy

yeah, there's not too many serg kolos around

Fabby

:-)

Sergiy Kolodyazhnyy

@Fabby on desktop version, next to send and upload image buttons

Fabby

I only have " stored messages" there!

:D

Byte Commander

@SergiyKolodyazhnyy I guess @Fabby meant sechat.quickmediasolutions.com

Oh

You didn't shorten your name

It was just chat cutting the rest after Sergiy off

But you don't need the emojis button, just type it like :) :( :P ;)

Sergiy Kolodyazhnyy

23:04

@ByteCommander nope, i fell asleep . . . and didn't get around to changing it back . . . I think I'll keep it like that for now

Fabby

@ByteCommander Yup :)

:P

Sergiy Kolodyazhnyy

it is more official this way and will go nicely alongside my Ubuntu wiki profile and LinkedIn

speaking of which, feel free to go to Ubuntu wiki and post all the critique of me there :p

Fabby

¯\_(ツ)_/¯

Byte Commander

More official also means less opporTUNAties for fishy puns etc, right?

Sergiy Kolodyazhnyy

No, puns will never stop

Unless salmon stops me

wiki.ubuntu.com/Sergiy%20Kolodyazhnyy

that's my Ubuntu wiki

so . . . at some point , maybe even this year, i might apply for Ubuntu membership

Byte Commander

23:09

cool

Sergiy Kolodyazhnyy

Once I contribute a little more cool stuff

Fabby

@SergiyKolodyazhnyy You shouldn't have mentioned that one... Invite sent!

@SergiyKolodyazhnyy If you do, ping me...

Everyone I vouched for until now has received their membership!

0:-)

Sergiy Kolodyazhnyy

@Fabby eggscepted :)

@Fabby alright, you'll be the first to know :)

Fabby

@SergiyKolodyazhnyy Weird, I see "pending"

Ah!

Takes LinkedIn some time to COMMIT TRANSACTION;

Sergiy Kolodyazhnyy

LinkedIn can be weird sometimes. It sometimes sends me notifications for what's been happening like 2 years ago

wat ?

Fabby

23:15

See LinkdIn msg.

Reply here with "yes/no/complicated"

(I have open messages I need to read on work PC)

SMOKE! BRB...

Sergiy Kolodyazhnyy

well, i already replied there on LinkedIn. Oh well. The answer is Yes

Android Dev

@NathanOsman - Look at this: http://paste.ubuntu.com/24290862/

All of the incorrect bits were 0 but should have been 1. That makes me think I may have dun goofed on the bit setting / shifting....

Fabby

@SergiyKolodyazhnyy So I'll read it twice!!! :D

Android Dev

This is how I'm setting a 1: recoveredData[i] = (byte) (recoveredData[i] | (1 << bit));

And this is how I'm setting a 0: recoveredData[i] &= ~(1 << bit);

Fabby

@AndroidDev Holy moly! That's like an IBM error message!

ERROR: Unknown Error....

:D

Who starred my Rick-Roll message??? :P

Android Dev

23:24

And this is how I'm initially ORing the payload with the pixel's LSB:

if(((data[i] >> bit) & 1) == 1)
{
//We need to write a 1
stegImageIntArray[x][y] = coverImageIntArray[x][y] | 0x00000001;
}

else
{
//We need to write a 0
stegImageIntArray[x][y] = coverImageIntArray[x][y] & 0xFFFFFFFE;
}

Fabby

start by changing if(((data[i] >> bit) & 1) == 1) to if((data[i] >> bit) & 1)

1 = true, 0 = false

1 = Male, 0 = Female

@Zanna ----^

(sorry, I'm old-school) >:-)

Android Dev

@Fabby That fails to compile because "Cannot convert from type int to type boolean"

Fabby

Too bad heather isn't around any more or I would include her as well! ¯\_(ツ)_/¯

@AndroidDev :O

I feel really old-school now...

(I can read C++ but could write C)

Android Dev

@Fabby And it won't let me cast it to a boolean either

Fabby

I should try again... Been >10 years since I wrote any C....

Android Dev

23:29

@Fabby This is Java

Byte Commander

C is horrible

Fabby

C is efficient: Linux kernel is all C

No C++ at all.

Byte Commander

If well written, it does a good job. But it's a pain to write.

Sergiy Kolodyazhnyy

@AndroidDev is that c or java ? c can use ints for boolean evaluation, at least in if statementa

Fabby

@AndroidDev I retract everything I said....

Android Dev

23:30

@SergiyKolodyazhnyy Java

Sergiy Kolodyazhnyy

@ByteCommander nah, it just takes time to master, that's all

Fabby

@ByteCommander It used to be really efficient: no need to write ASM

Byte Commander

Well, you know my opinion...

Fabby

(which I could do too)

Byte Commander

Python 3 all the things!

Fabby

23:31

been >20 years since I wrote any ASM...

@ByteCommander Looks for a bucket before vomiting...

Byte Commander

I can read some easy assembler (knowing maybe 10 commands or so)

Android Dev

@Fabby @SergiyKolodyazhnyy - I think the bug is most likely in either chat.stackexchange.com/transcript/message/36426423#36426423 or chat.stackexchange.com/transcript/message/36426431#36426431

Fabby

I gave up on positional languages since COBOL...

Sergiy Kolodyazhnyy

assembly is PITA, I've had enough of it in microcontroller class

Byte Commander

never said anything

:P

Nathan Osman

23:33

Okay, this one is not an April Fool's joke: Digital Ocean may use data collected from its droplet monitor for marketing purposes. The good news is that you can opt out by not installing the monitor.

Sergiy Kolodyazhnyy

recoveredData[i] = (byte) (recoveredData[i] | (1 << bit));

Fabby

I once found a message in a game:

If you can decipher the next 128 bytes, write to us...

(it was a XOR)

Sergiy Kolodyazhnyy

@NathanOsman And i was going to start using VPN there oO

Byte Commander

/facepalm

Nathan Osman

@SergiyKolodyazhnyy Just don't install the monitor app.

Problem solved.

Fabby

23:34

I wrote them and told them I never wanted to work for them...

Byte Commander

xD

Sergiy Kolodyazhnyy

lol

@NathanOsman yeah, i definitely won't. Although i could always switch to another provider. But DO prices are nice

Ok, gonna drive home. Talk to you guys later

Nathan Osman

Linode is cheaper, by the way.

Fabby

@SergiyKolodyazhnyy "Future Goals Edit this page better Smile :)" should read "Future Goals Edit this page to make it better Smile :)"

Nathan Osman

Their $5 server has twice the RAM.

Fabby

23:37

¯\_(ツ)_/¯

Android Dev

@NathanOsman Do you see anything wrong with my bit setting lines?

Nathan Osman

@AndroidDev where?

Android Dev

@NathanOsman Go from here chat.stackexchange.com/transcript/message/36426391#36426391 down about 5. I posted three messages with code snippets

Nathan Osman

@AndroidDev what language is this?

C?

Android Dev

@NathanOsman Java

Nathan Osman

23:40

Close enough :P

I'm a bit confused with this one:

recoveredData[i] = (byte) (recoveredData[i] | (1 << bit));

Why are you shifting the value 1 left the number of bits in bit?

Also, is OR really the operator you want to use here? It won't change the bit if it is already set.

Android Dev

@NathanOsman To set bit number "bit" to 1. So if for example bit was 3, then it would set the 4th bit to 1

Because of the off by one problem

So the bits go from 0-7

Nathan Osman

Okay.

Android Dev

@NathanOsman I had to look up how to set a specific bit in a byte, and that was what was recommend in a SO answer

89

A: Set specific bit in byte

Use the bitwise or and and operators. To set a bit: my_byte = my_byte | (1 << pos); To un-set a bit: my_byte = my_byte & ~(1 << pos);

@NathanOsman --^

Nathan Osman

Yup, that's correct for setting a bit to 1.

Sorry for getting confused.

Android Dev

You're fine!

If I knew this stuff really well I wouldn't be needing to ask you for help :)

Isn't it kind of odd that all the incorrect bits were 0 and should have been 1 though?

I also tried the program on another computer to make sure that it wasn't a RAM error

Nathan Osman

23:53

The code looks alright to me.

Fabby

Funny: I came into the chat and could read items starred 9 days ago.
Been here 4h and cannot read any of those as they've been replaced by new funny items.

Conclusion: My presence increases the humoristic level of the chat room! :D :D :D

2

Android Dev

@NathanOsman But I just don't get how one out of every 7,000 bytes has one incorrect bit. It's like there is some special, rarely occurring case that my code fails on.

Nathan Osman

Exactly 7000?

What are you using to write the image data to disk after you embed the data in it?

Fabby

38 mins ago, by Android Dev

@NathanOsman - Look at this: http://paste.ubuntu.com/24290862/

All of the incorrect bits were 0 but should have been 1. That makes me think I may have dun goofed on the bit setting / shifting....

@JourneymanGeek some sneaky bastard snuk into the chat without saying hello...

:-) ;-)

How are you doing?

(personally and professionally???)

Android Dev

@NathanOsman Hmm, on second thought it seems that it is much more often then every 7k, more like every 2k, but you should take a quick look here: paste.ubuntu.com/24290862

Transcript for