Optical file system steganography

Being in search of interesting information about steganography, I came across an interesting article about steganography in the file system , and after some time, she suggested me the idea of ​​creating steganography in the optical disk file system.

Probably, nowadays, there are almost no people left who would use discs in everyday life, because they were replaced by a more worthy option in the face of flash drives .

After some thought, I decided that the disks could still be used for some time, for example, inside their file system, you could hide some secret information and then transfer it to another so that no one suspected anything.
')
This is what we are going to do, namely: we will use the python library, which will help us encode information from a text file, and then hide it in the depths of our disk.



But before we begin, let's first analyze some little things, as well as define the concept of an optical disk.

What is an optical disk

Optical disc (optical disc) is a collective name for information carriers made in the form of discs, which are read using optical (laser) radiation.



Each disk on a computer is represented in a specific format as an image , which contains all the information and the disk structure, and is used to work with information without optical media, as well as archiving data on solid media.
The standard format for optical disks is iso9660 , but there is still
Keep in mind that the image contains less information than the original CD. The disc contains service information, which can, in particular, be used for copy protection. We will work with ISO9660.

Inside view

And now let's look at the structure of iso9660 from the inside, you can find detailed information here , here and here , and for those who know English, also here . From myself I’ll just say that basically it consists of 2 descriptors: Boot Record and Primary Volume Descriptor (PVD) , you can open any iso in 010editor and see for yourself.



Boot Record can be used by systems that need to initialize many types of data before making the disk available, although ISO 9660 does not indicate what information in Boot Record or how to use it at all.

PVD is the starting point in the identification of iso9660, it looks like this:





For lovers of schemes:



More information can be found here.

And we move on.

ISO initialization

We will work with the root directory, we will create our own directories in it and add the necessary files.

For this we will use the pycdlib library, you can read it well by following the link.

Let's go over to writing the program, but who does not want to go step by step, you will find the source code via the link to my repository in the githab:

#     import base64 import pycdlib 

Preparing text files

Now we need to prepare our files, which we drop into the structure of our iso.

The course of action is as follows:

1. We take the source text in certain files and read it into variables; nothing prevents us from taking a lot of text, but for the demonstration I took only a couple of sentences in each file; we will continue to manipulate these variables
2. After we read the sentences, we need to encode the contents. We will encode using base64
3. We write the encoded content into new files called UP and DOWN . Files are so called because I decided to make a permutation so that 1 part of 1st file and 1 part of 2nd file (ie upper parts) are recorded in UP , and in DOWN 2 part of 1st file and 2 part of 2nd file ( Ie the lower parts)

 with open('/home/ul/stegist1.txt','rb') as stegist1:#   for line1 in stegist1.readlines(2): print(line1)#   1  for line2 in stegist1.readlines(2): print(line2)#   1  stegist1.close() enc_line1=base64.b64encode(line1)#     base64 enc_line2=base64.b64encode(line2) with open('/home/ul/stegist2.txt','rb') as stegist2: for line3 in stegist2.readlines(2):#   2  print(line3) for line4 in stegist2.readlines(2):#   2  print(line4) stegist2.close() enc_line3=base64.b64encode(line3)#   print(enc_line3) enc_line4=base64.b64encode(line4) print(enc_line4) with open('/home/ul/UP.txt','ab') as up:#  UP    up.write(enc_line1) up.write(enc_line3) with open('/home/ul/DOWN.txt','ab') as down:#  DOWN    down.write(enc_line2) down.write(enc_line4) 

Concealment

It's time to go to the same pycdlib library, which I spoke about at the beginning. It’s not difficult to work with it: we create an object through which we further add various files and directories inside.

 iso=pycdlib.PyCdlib() #   PyCdlib iso.new(rock_ridge='1.09')#  rockridge(    iso   ) iso.add_directory(iso_path='/A1',rr_name='a1')#  (  ) iso.add_directory(iso_path='/B1',rr_name='b1') iso.add_directory(iso_path='/B1/B2',rr_name='b1b2') iso.add_directory(iso_path='/A1/A2',rr_name='a1a2') iso.add_file('/home/ul/stegistup.txt', iso_path='/A',rr_name='a')#   up iso.add_file('/home/ul/stegistdown.txt', iso_path='/B',rr_name='b')#   down iso.write('papastegisto.iso')#  iso () 

As we can see, our text successfully recorded



I want to notice that we can create a certain path, for example / A , either a file or a folder.

If we first specify the creation of a directory in / A , and then specify the creation of a file in / A, an error message is displayed, it doesn’t matter that we put the file in a folder.

ISO9660 File System Extensions

There are 2 main extensions for the iso file system, these are: RockRidge and Joilet .

Rockidge

This is an ISO 9660 file system extension designed to store file attributes used in POSIX operating systems (ie, Unix-compatible).

Rock Ridge extensions are written on top of the ISO 9660 file system so that an optical disc with Rock Ridge can be read by software designed to work with ISO 9660.

Joilet

This is an extension of the ISO 9660 file system, created to relax restrictions on the file name imposed in ISO 9660. The specification was developed by Microsoft and supported by all versions of Microsoft Windows since Windows 95 and Windows NT 4.0.
The default is used on all CD-ROMs with data released after 1995.


In fact, there is also a 3 extension for the iso file system, it is called Romeo .

This is an extension of ISO 9660 for MS Windows 95, there is little information on it on the Internet, and, most likely, this extension is not used anywhere else.

More information on extensions and file systems for CD / DVD can be found here , and now let's go back to our program.

The resulting code to encode information from a file and place files with encoded information in iso looks like this:

 #     import base64 import pycdlib #   with open('/home/ul/stegist1.txt','rb') as stegist1: #  for line1 in stegist1.readlines(2): print(line1) #  for line2 in stegist1.readlines(2): print(line2) #  enc_line1=base64.b64encode(line1) print(enc_line1) enc_line2=base64.b64encode(line2) print(enc_line2) with open('/home/ul/stegist2.txt','rb') as stegist2: #  for line3 in stegist2.readlines(2): #  print(line3) for line4 in stegist2.readlines(2): #  print(line4) enc_line3=base64.b64encode(line3) #  print(enc_line3) enc_line4=base64.b64encode(line4) print(enc_line4) with open('/home/ul/UP.txt','ab') as up: #  UP    up.write(enc_line1) up.write(enc_line3) with open('/home/ul/DOWN.txt','ab') as down: #  DOWN    down.write(enc_line2) down.write(enc_line4) #   iso iso=pycdlib.PyCdlib() iso.new(rock_ridge='1.09') iso.add_directory(iso_path='/A1',rr_name='a1') iso.add_directory(iso_path='/B1',rr_name='b1') iso.add_directory(iso_path='/B1/B2',rr_name='b1b2') iso.add_directory(iso_path='/A1/A2',rr_name='a1a2') iso.add_file('/home/ul/stegistup.txt', iso_path='/A',rr_name='a') iso.add_file('/home/ul/stegistdown.txt', iso_path='/B',rr_name='b') iso.write('papastegisto.iso') 

And I remind you that the full code is also on the link to the githab
Now let's get to the final part - we write our resulting iso to disk
You can record what you want, but I will use Nero 7
We will use CD-R

As we can see, the program has successfully written to disk.



Now we can transfer it to the disk to the people we want.

Decoding

Why should we do all this if the information cannot be decoded back, right?

If you are interested in the method, you can write a program that will withdraw and decode the attached files, it will be used by “your people”.

And that is all. My task was to demonstrate one of the possible ways of hiding information, using disks, which, it would seem, have sunk into oblivion.



I would be glad to see your suggestions, additions, corrections and other feedback.

PS I want to express special thanks to @PavelMSTU for advice and motivational kicks.