2

I have a 10GB .iso file with sensitive information.

How can I fake its format to be a format of my choice (say .mp4)

Is this method valid for any format?

$ cat picture.png myiso.iso.gpg > picture2.png

where picture.png is a random picture, myiso.iso.gpg, a gpg encrypted file with sensitive information and picture2.png the hidden file with fake format.

muru
  • 207,228
user202459
  • 49

3 Answers3

8

Linux does not care about file extension. Changing the file name does NOT let the file command show it is a picture. It will still show it is an ISO.

How do you believe to retrieve the ISO from doing this:

cat picture.png myiso.iso.gpg > picture2.png

Why do you not encrypt the file?

gpg -c {file}

would be enough. It will ask for a password twice. Make it a good one, and don't forget it

If you do not want anyone to see the file start the name of it with a "." and put it into a directory, remove all permissions except for the user and lock it down with chattr -i {file} from a root session.

Rinzwind
  • 309,379
6

This sounds very very much like an A/B problem to me. You want to protect data in such a way people won't suspect that it's sensitive data.

The easiest way to hide data is to just encrypt it using gpg, TrueCrypt, LUKS, or similar encryption utility.

Now, you could use steganography, but that isn't exactly the best idea because the concept of "security by obscurity" still comes into play. Any determined enough attacker will still be able to extract the file or at least find it ("why does this person have a 10GB image or a corrupt MP4? It might be hiding data!"). You're relying on security by obscurity, which is always a bad idea.

Instead, if you want to save something and keep plausible deniability, you just need to make sure that the data looks random and has no headers. LUKS/cryptsetup has an option (--header) that allows you to store the LUKS headers separately from the data (say, on a USB drive you always carry on you), so any attacker using file will only see it as random data. And, if you suspect someone's closing in, just conveniently "lose" the drive.

If you're really paranoid, you can always use hidden volumes in LUKS, which will allow you to have a fake outer volume as well as a more secret inner volume. Why would this be useful? Case in point:

Comic borrowed from XKCD

Even if you're subject to rubber-hose cryptanalysis, you can just give away the outer (non-secret) volume password with only trash data. And, if you've already destroyed the header drive (or didn't take it from its safe place), it's impossible to decrypt and is effectively just a collection of random data.

TL;DR: Don't try steganography. Instead, just remove the encryption header to make it look like random data. If you're really paranoid, make an additional "hidden" volume just to be safe. Your encrypted file won't be cracked because that'll take literally millions of years with specialized equipment. If you get caught/tortured for the password, you can just give a "fake" password to non-important data. Either way, you get 2FA, plausible deniability, and the ability to destroy one of the factors quickly and efficiently.

Or, you can just ignore all of that and just have a normal encrypted file. To counter your comment:

Displaying it as being encrypted shows that it has precious content and is therefore more subject to be cracked by expensive ad hoc hardware.

Encryption is really common nowadays. Almost every smartphone out there has encryption on it. Does every smartphone have precious/sensitive content? Good encryption would take millions of years and hundreds of thousands of dollars to crack with very specialized equipment, it's infeasible to try to crack data just "on a suspicion." True, you might get national secrets, but you might just as easily get some cat pictures (and the latter is far more likely). As the title text for the above XKCD says:

Actual actual reality: nobody cares about his secrets.

Kaz Wolfe
  • 34,680
0

Since none of the answers currently presented answer the question of how to fake a format of a file:

There's two ways of hiding the ISO's data inside a PNG, or MP4 file.

  1. Steganography, the practice of concealing a file, message, image, or video within another file, message, image, or video. The resultant file will be perfectly viewable, like an innocent picture or film. However, this might take a lot of effort to do.
  2. The second way is to simply insert the header of your chosen file format, such as PNG's 8-byte header, into the start of your file to trick any programs opening your file into thinking it's that format. You should also change the file extension, just in case. However, the resultant file is would most probably be corrupted upon view, which might draw suspicion.

Of course, this also means that you might need to break the ISO into portions to make for a more convincing disguise. A 10-GB PNG file is pretty suspicious.

Ignis Incendio
  • 101