Data Hiding Techniques in Windows OS

A Practical Approach to Investigation

and Defense 1st Edition Nihad Ahmad
Hassan
Visit to download the full and correct content document:
https://textbookfull.com/product/data-hiding-techniques-in-windows-os-a-practical-app
roach-to-investigation-and-defense-1st-edition-nihad-ahmad-hassan/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...

Digital forensics basics: a practical guide using

Windows OS 1st Edition Nihad A. Hassan

https://textbookfull.com/product/digital-forensics-basics-a-
practical-guide-using-windows-os-1st-edition-nihad-a-hassan/

Digital Forensics Basics A Practical Guide Using

Windows OS 1st Edition Nihad A Hassan

https://textbookfull.com/product/digital-forensics-basics-a-
practical-guide-using-windows-os-1st-edition-nihad-a-hassan-2/

Open Source Intelligence Methods and Tools: A Practical

Guide to Online Intelligence 1st Edition Nihad A.
Hassan

https://textbookfull.com/product/open-source-intelligence-
methods-and-tools-a-practical-guide-to-online-intelligence-1st-
edition-nihad-a-hassan/

Geospatial Data Science Techniques and Applications 1st

Edition Hassan A. Karimi

https://textbookfull.com/product/geospatial-data-science-
techniques-and-applications-1st-edition-hassan-a-karimi/
Raspberry Pi OS Text Editors, git, and LXC; A Practical
Approach (Raspberry Pi OS System Administration with
systemd) 1st Edition Robert M. Koretsky

https://textbookfull.com/product/raspberry-pi-os-text-editors-
git-and-lxc-a-practical-approach-raspberry-pi-os-system-
administration-with-systemd-1st-edition-robert-m-koretsky/

Data Mining and Data Warehousing: Principles and

Practical Techniques 1st Edition Parteek Bhatia

https://textbookfull.com/product/data-mining-and-data-
warehousing-principles-and-practical-techniques-1st-edition-
parteek-bhatia/

Emerging security algorithms and techniques Ahmad

https://textbookfull.com/product/emerging-security-algorithms-
and-techniques-ahmad/

Practical Python Data Visualization: A Fast Track

Approach To Learning Data Visualization With Python
Ashwin Pajankar

https://textbookfull.com/product/practical-python-data-
visualization-a-fast-track-approach-to-learning-data-
visualization-with-python-ashwin-pajankar/

Data Protection in the Practical Context Strategies and

Techniques 1st Edition Hannah Yeefen Lim

https://textbookfull.com/product/data-protection-in-the-
practical-context-strategies-and-techniques-1st-edition-hannah-
yeefen-lim/
Data Hiding Techniques
in Windows OS
A Practical Approach to Investigation and Defense

Nihad Ahmad Hassan

University of Greenwich
IT Security and Digital Forensics Consultant;
Founder of www.DarknessGate.com

Rami Hijazi
University of Liverpool
Information Security Consultant;
General Manager, MERICLER Inc.,
Candela Drive, Mississauga, Ontario, Canada

Helvi Salminen
Technical Editor

AMSTERDAM • BOSTON • HEIDELBERG • LONDON • NEW YORK • OXFORD • PARIS

SAN DIEGO • SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO

Syngress is an imprint of Elsevier

Syngress is an imprint of Elsevier
50 Hampshire Street, 5th Floor, Cambridge, MA 02139, United States

Copyright © 2017 Elsevier Inc. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including
photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on
how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such
as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.

This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted
herein).

Notices
Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes
in research methods, professional practices, or medical treatment may become necessary.

Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information,
methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own
safety and the safety of others, including parties for whom they have a professional responsibility.

To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or
damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods,
products, instructions, or ideas contained in the material herein.

Library of Congress Cataloging-in-Publication Data

A catalog record for this book is available from the Library of Congress

British Library Cataloguing-in-Publication Data

A catalogue record for this book is available from the British Library

ISBN: 978-0-12-804449-0

For information on all Syngress publications

visit our website at https://www.elsevier.com/

Publisher: Todd Green

Acquisition Editor: Chris Katsaropoulos
Editorial Project Manager: Anna Valutkevich
Production Project Manager: Priya Kumaraguruparan
Designer: Mark Rogers

Typeset by TNQ Books and Journals

To my mom, Samiha, thank you for everything.
Without you, I’m nothing.

Nihad A. Hassan
Biography

Nihad A. Hassan is an independent computer security Rami Hijazi is the general manager of MERICLER Inc.,
and forensic consultant. He has been actively conducting an education and corporate training firm in Toronto,
research on computer forensic techniques for more than Canada. Rami is an experienced IT professional who lec-
8 years, focusing on techniques in Windows® OS, especially tures on a wide array of topics, including object-oriented
digital steganography techniques. programming, Java, eCommerce, Agile development,
Nihad has completed numerous technical security con- database design, and data handling analysis. Rami also
sulting engagements involving security architectures, pen- works as consultant to Cyber Boundaries Inc., where
etration testing, Windows® OS diagnostic reviews, disaster he is involved in the design of encryption systems and
recovery planning, and computer crime investigation. wireless networks, intrusion detection, and data breach
He has written thousands of pages of technical documenta- tracking, as well as providing planning and develop-
tion for different global companies in the IT and cybersecurity ment advice for IT departments concerning contingency
fields in both Arabic and English. His writing style highlights planning.
information that is simplified and presented in an easy manner,
which gives him an extensive reputation in this field.
Nihad believes that security concerns are best addressed
by well-prepared and security-savvy individuals. Nihad
also enjoys being involved in security training, education,
and motivation. His current works are focused on network
security, penetration testing, computer forensic and antifo-
rensic techniques, and web security assessment. Nihad has
a BSc honors degree in computer science from the Univer-
sity of Greenwich, United Kingdom.
You can reach Nihad through:

InfoSecurity blog http://www.DarknessGate.com

Personal website http://www.ThunderWeaver.com
Email nihadhas@gmail.com

Helvi Salminen has worked full-time in information secu-

rity since June of 1990. Prior to her security career, she had
12 years of experience in systems development. Helvi values
lifelong learning and knowledge sharing, which she has prac-
ticed by studying and teaching in lifelong learning security
education programs at Aalto University and by speaking at
security conferences. She was awarded CISO of the year 2014
in Finland by the Finnish Information Security Association.

xi
Preface
ABOUT THIS BOOK
In brief, this book presents a wide array of ­techniques that
could be used to hide digital data under the Windows®
OS, in addition to different steganographic techniques to
conceal data in multimedia files. The book also presents
different ways to investigate and explore hidden data inside
digital files and the Windows® OS file s­ tructure.
The main focus of this book is teaching Windows®
users how they can exploit data hiding techniques within
Windows® OS and multimedia files to secure their data
and communications. Today, the demand for privacy
is a major concern for computer users. This book will
help those users learn vast arrays of techniques to bet-
ter secure their privacy by teaching them how to conceal
their personal data. Users also learn how to use differ-
ent cryptographic anonymity techniques to conceal their
identity online.
Many books on data hiding techniques are available in
the market. However, none of these books have a practical
approach such as this one. The data hiding topic is usually
approached in most books in an academic way with long
math equations about how each hiding technique algorithm
works behind the scene. These books are usually targeted
for people who work in the academic arenas. We need a
book that teaches professionals and end users alike how
they can hide their data and discover the hidden ones using
a variety of ways, under the most used operating system on
earth, Windows®.
This book will entertain the reader by following a sim-
ple writing style. It focuses on approaching the data hid-
ing topic practically and offers plenty of screen captures
for each technique used. The book is written as a series of
tutorials (you can consider it a cookbook full of delicious
recipes, with each task (hence recipe) presenting a differ-
ent hiding technique). Book contents are completely practi-
cal; a user can read a task and then implement it directly
on his or her PC. Relevant theoretical information will
be presented to enrich the user about terms used in each
hiding technique, making this book quite informative for
different user populations. Techniques discussed in this
book cover all Windows® versions, from Windows® XP to
­Windows®10.
TARGET AUDIENCE
The topic of digital data hiding is quite stimulating. This
book will be valuable for the following user groups:
1. Computer forensic investigators
2. Law enforcement officers and border protection agencies
3. Intelligence services staff
4. Human rights activists
5. Journalists
6. IT professionals
7. Computing and information technology students
8. Business managers in all industries
9. End users
Any computer user will benefit from this book! All
people like to obscure their personal data using simple
methods and they are eager to become more computer
literate and able to override mass surveillance programs
deployed by many governments to monitor online traf-
fic. This book will explain these ideas in an easy-to-
follow manner, making complex technical ideas easy to
assimilate by nontechnical folks.
SUMMARY OF CONTENTS
In the following you will find a brief description about each
chapter’s contents.
Chapter 1, Introduction and Historical Background:
This chapter talks about the history of data hiding since old
civilizations, and presents historical events related to this
subject. This chapter begins by listing old cryptographic
techniques used in ancient times to secure message trans-
mission, and then discusses modern steganography and
encryption techniques used in today’s world.
Chapter 2, Data Hiding Using Simple Methods: In
this chapter, we present many simple techniques that aver-
age computer users can use to hide their personal data. The
techniques presented in this chapter can be used without
using any third-party tool.
Chapter 3, Data Hiding Using Steganographic Tech-
niques: In this chapter, we present different steganographic
techniques to conceal our data in multimedia files. We dem-
onstrate how we can use different tools and techniques to
xiii
xiv Preface
conceal data inside e-documents, web files, images, and
audio and video files. A brief discussion of how each tech-
nique works behind the scene is also included to make this
chapter both informative and practical.
Chapter 4, Data Hiding Under Windows® OS File
Structure: This is an advanced chapter that shows how we
can exploit the Windows® OS NTFS file structure to con-
ceal our data. Many data hiding techniques in this chapter
can be performed without using third-party tools, mostly
by exploiting Windows® OS’s own files. This chapter gives
insight on how hackers can use data hiding techniques to
launch sophisticated attacks against computer systems and
private networks.
Chapter 5, Data Hiding Using Encryption Tech-
niques: This chapter presents different techniques to pro-
tect your private data using encryption. It covers encrypting
a Windows® partition, data disk, and files in addition to
emails, IMs, and VOIP calls. Attacks against full disk
encryption and countermeasures also are described in this
chapter. This chapter also covers using cryptographic ano-
nymity techniques to anonymize your online communica-
tions, making them untraceable.
This chapter can be read alone; in fact, you can consider
it as a minibook dedicated to teaching you practical tricks
and guidelines for online risks and steps to protect yourself
against cyberattacks through encryption and cryptographic
anonymity tools.
Chapter 6, Data Hiding Forensics: This chapter is the
reverse of Chapters 3 and 4 as it looks into how data hiding
forensics investigate different methods to detect concealed
data in digital files and Windows® file structure. In addi-
tion to this the chapter illustrates how we can investigate
Windows®-based machines to determine whether any steg-
anography tools have been installed or used.
Chapter 7, Antiforensic Techniques: This chapter
discusses techniques and gives advice on eliminating your
tracks when using steganography tools to conceal secret
data. It also presents ways to prevent general computer
forensic tools from investigating and exploring your hidden
data. This chapter is the reverse of , Chapter 6.
Chapter 8, Future Trends: We discuss future trends
and advancements in digital data hiding and how new IT
technology affects this subject.
COMMENTS AND QUESTIONS
To comment or ask technical questions about this book,
send email to nihadhas@gmail.com.
We are going to publish a webpage for this book that
lists additional references, tools, examples, and other infor-
mation. You can access this page through the author’s Info-
Sec portal: http://www.DarknessGate.com.
For more information about Syngress books go to
http://store.elsevier.com/Syngress/IMP_76/.
Acknowledgments
When I first thought about creating my first book, Rami
Hijazi was the first person who came to my mind when
seeking advice. I consider him the best man in the field. His
precious feedback has always enlightened my road. Even
after years of working together, I am constantly surprised
by his amazing intelligence, innate humility, and genuine
friendship. Looking forward to working with you again on
another book, Rami!
It is with a deep sense of appreciation that I want to
thank my technical reviewer Helvi Salminen. Helvi plays
two roles in this book; first as a proposal reviewer she pro-
vided me with excellent feedback. The second role is of
course reviewing this text technically. Without her excellent
feedback and dedicated work, producing this text would
have been difficult. Thank you very much, Helvi; I’m look-
ing forward to working with you again on another book.
Book acquisition editor Chris Katsaropoulos, thank you
for believing in my book’s idea and for your moral encour-
agement before and during the writing process. Hope to
work with you again.
Book Editorial Project Manager Anna Valutkevich,
thank you for your diligent support during the writing pro-
cess. You make authoring this book a joyful journey! Hope
to work with you again, Anna!
Mary Ide, thank you very much for your feedback at
the initial stage of book development. Your encouragement
gave me a boost to proceed with this project.
Kandy Zabka, I highly appreciate your encouragement
and practical advice on my book’s proposal. Your initial
feedback has guided my way all the way through the end.
I want to thank Jodi L. Colburn for her precious help at
the start of my career as a computer security professional.
I will always remember your encouragement and faithful
advice.
I want to thank all the Syngress staff who worked behind
the scenes to make this book possible and ready for launch.
I hope you will continue your excellent job in creating
highly valued computer security books. You are simply the
best in this field.
Naturally, I’m saving the best for last. During this book
I use many photos of a baby boy to describe digital steg-
anographic techniques in images. These photos are of my
brother’s son Omran. I want to thank this little baby boy
for adding a pleasant touch to the technical script. I hope
he will become an author like his uncle when he grows up!
Nihad A. Hassan
xv
Chapter 1
Introduction and Historical Background
Chapter Outline
Introduction1
Classical Cipher Types
Substitution Cipher
Monoalphabetic Ciphers
Polyalphabetic Ciphers
Polygraphic Ciphers
Mechanical Substitution Ciphers
Transposition Cipher
Rail Fence
Columnar Transposition
Double Transposition
Other Ciphers and Codes
The One-Time Pad
Morse Code
Book Cipher
Difference Between Substitution and Transposition Cipher 10
Practicing Old Ciphers Using Modern Computing
Modern Cryptography Systems
Secret Key Cryptography
INTRODUCTION
Throughout history, humankind always tried to find the best
ways to communicate efficiently and securely. The evolu-
tion of communication began with shouting out words, then
quickly evolved to the next stage of sophisticated spoken
language; however, the carrier (a human) may forget parts of
the message or simply forget the message completely when
moving from one place to another. A more refined method
was needed, such as writing messages on basic materials
such as stones. Writing was more efficient and represented
a big milestone in human history.
In the Imperial period, the Persian empire was one of the
first civilizations to enhance communications routes; roads
were built across the entire empire to make sending mes-
sages more quick and efficient. The wealth and power of
the Persian empire allowed it to invade more land outside
its borders, which meant sending troops far away from their
central capital, hence new requirements for secure commu-
nication emerged. A method for delivering secure messages
Data Hiding Techniques in Windows OS. http://dx.doi.org/10.1016/B978-0-12-804449-0.00001-4
Copyright © 2017 Elsevier Inc. All rights reserved.
Public Key Cryptography 13
2 Digital Signature 14
2 Cryptographic Hash Function 14
2 Steganography15
2 What Is Steganography? 15
5 Comparing Steganography and Cryptography 15
7 Steganography Types 15
8 Technical Steganography 16
8 Linguistic Steganography 17
8 Digital Steganography 18
9 Watermarking20
9 Watermarking Types 20
9 Visible Watermark 20
9 Invisible Watermark 21
10 Compare Steganography and Watermarking 21
Anonymity21
12 Summary21
12 References21
13 Bibliography22
through cryptographic and message-hiding techniques was
devised.
Many sources give credit to Greece for creating the first
known hiding technique by humans, as we will see later.
Arabs, Chinese, and Romans also created their own meth-
ods to communicate securely, especially during war time.
Cryptography is a type of data hiding by obscuring mes-
sages. We begin discussing it in the first pages of this book
because it is important to understand how old cryptographic
techniques work since new methods are mainly based on
these principles.
Steganography is the science of hiding data; there are
many types and each type has its own techniques in hid-
ing. Combining steganography with encryption to transmit
secret messages is the ideal solution to counter today’s
online risks.
In this chapter we introduce Data Hiding. Interest-
ingly, data hiding combines mystery, fun, history, and new
advancements in computing, making it not only a very
important topic in computer science, but also a type of art.
1
2 Data Hiding Techniques in Windows OS
Starting with the Roman emperor, Julius Caesar, and
his simple cipher method, to the surveillance programs
deployed by National Security Agency (NSA), to monitor
communication and online traffic, this chapter introduces
the history of secret message concealment from past history
to the present.
CLASSICAL CIPHER TYPES
In principle, a cipher constitutes text after we have imple-
mented a specific encryption algorithm to plaintext or a
message. Each letter of the message is shifted to the left
or to the right, making the text unfit for reading. Classical
ciphers are encryption algorithms that have been used in
the past to secure communications. There are many types of
classical cipher methods; however, all of them have become
insecure in today’s standards in data security. The develop-
ment of computer technology and the huge increase in com-
puter processing power makes such algorithms breakable in
a fraction of a minute.
In the following sections, we are going to give a his-
torical review of the main classical ciphers types used in
the past, which are substitution ciphers and transposition
ciphers, along with detailed examples on how to use each
one to encrypt secret messages.
Substitution Cipher
In this cipher, letters or groups of letters are replaced for
other letters or group of letters, thus making the message
scrambled and unreadable. We have three main types of this
cipher: monoalphabetic, polyalphabetic, and ­polygraphic.
Monoalphabetic Ciphers
This is a simple substitution cipher where each letter of the
plaintext (the secret message) is replaced by another letter
from the ciphertext. There are many types of this cipher; the
best known are Caesar shift, Atbash, and Keyword.
Caesar Shift
This technique is named after the Roman Emperor Julius
Caesar, first invented more than 2000 years ago. It works
by substituting one letter of the alphabet by the third letter
in succession; for example, according to Table 1.1. If we
shift the alphabet by three positions we can have the values
shown (the Caesar cipher row) substituted for each letter of
alphabet.
A becomes D, B becomes E, and so forth.
For example, encrypting the following message using
Caesar shift:
Hello my name is Mary
becomes:
KHOOR PB QDPH LV PDUB
We can shift by any number, of course. In this example
we used Caesar shift by three. Remember, Caesar shift does
not use a key.
Atbash Cipher
Atbash is a simple substitution cipher for the Hebrew alpha-
bet. It is considered one of the oldest known substitution
ciphers used. Hebrew is written from right to left just like
Arabic. Naturally, we can use this cipher with different lan-
guages in addition to Hebrew.
In Atbash cipher, the letters of the alphabet are simply
reversed. For example A becomes Z, B becomes Y, and so
forth, as it appears in Table 1.2.
For example, encrypting the following message using
Atbash cipher:
Hello my name is Kandy
becomes:
SVOOL NB MZNV RH PZMWB
Keyword Cipher
This cipher uses a keyword to rearrange the alphabet. It is
similar to the Caesar alphabet with the exception that it uses
a predefined keyword for the beginning of the substitution
alphabet. Letters used in the keyword are not used in the
rest of the cipher alphabet (duplicate letters in the keyword
should be omitted). The keyword is needed to decipher the
secret message.
Let us use the example in Table 1.3 to more fully explain.
We will use the word Rima as the keyword.
Encrypting the following message using the Keyword
cipher:
Hello my name is Kathy
becomes:
EBJJN KY LRKB FS HRTEY
Polyalphabetic Ciphers
Polyalphabetic cipher is a substitution cipher, where the
substituted alphabet is changed multiple times throughout
the message. For example, the letter N may become D after
encoding the first part of the message, but encoded as the
letter W in the next part of the message. The best-known
example of a polyalphabetic cipher is the Vigenère cipher.
There are many variations of the Vigenère cipher, such as
the AutoKey, Beaufort, and Running Key ciphers. Only the
Vigenère cipher will be discussed in detail since the other
methods are merely variations of it.
Vigenère Cipher
This cipher was invented by a French diplomat, Blaise de
Vigenère, in the 16th century. The Vigenère cipher uses a
series of different Caesar ciphers based on a keyword or
passphrase. In a Caesar cipher the letters of the alphabet are
TABLE 1.1 The Ciphertext Alphabet for the Caesar Cipher
Plain A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Caesar D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
cipher

TABLE 1.2 The Ciphertext Alphabet for the Atbash Cipher

Plain A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Atbash Z Y X W V U T S R Q P O N M L K J I H G F E D C B A
cipher

Introduction and Historical Background Chapter | 1

TABLE 1.3 The Ciphertext Alphabet for the Keyword Cipher
Plain A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
Keyword R I M A B C D E F G H J K L N O P Q S T U V W X Y Z
cipher

3
4 Data Hiding Techniques in Windows OS

shifted using one shift value. For example, a Caesar shift by
three makes A become D, B become E, and so on. The Vige-
nère cipher uses several Caesar ciphers, and each cipher has
a different shift value (one could be shifted by three, the
next shifted by five, and so on).
In order to encrypt our secret text we need to have the
Vigenère table. This table consists of the entire English
alphabet written out 26 times in different rows. Each row
is shifted by one position to the left until we reach to
the last letter Z. This means we have 26 Caesar shifts,
and each row is shifted by one as it appears in Vigenère
(Table 1.4).
In order to encrypt our secret message using a Vigenère
cipher we need to use it (Table 1.5) in conjunction with a
key of our choice.
Let us experiment using this cipher by encrypting the
following secret message:
MoveAfterMidnight
(Note: I did not use spaces between words to simplify
the example; however, we can use spaces as we did in
previous ciphers, because spaces do not count in the
ciphertext for letters of correspondence.)
The key, Rima, will be used in the example in Table 1.5.
First, we write our key as many times as necessary to cover
all letters of our secret message.
Now, in order to encrypt our text we need to find the
intersection in the table between our plaintext letter and the
keyword letter. The first letter of the plaintext is M. The cor-
responding letter in the key row is R. We check the M letter

TABLE 1.4 Vigenère Table

Plain Text Letter

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
B B C D E F G H I J K L M N O P Q R S T U V W X Y Z A
C C D E F G H I J K L M N O P Q R S T U V W X Y Z A B
D D E F G H I J K L M N O P Q R S T U V W X Y Z A B C
E E F G H I J K L M N O P Q R S T U V W X Y Z A B C D
F F G H I J K L M N O P Q R S T U V W X Y Z A B C D E
G G H I J K L M N O P Q R S T U V W X Y Z A B C D E F
H H I J K L M N O P Q R S T U V W X Y Z A B C D E F G
I I J K L M N O P Q R S T U V W X Y Z A B C D E F G H
Keyword - Password

J J K L M N O P Q R S T U V W X Y Z A B C D E F G H I
K K L M N O P Q R S T U V W X Y Z A B C D E F G H I J
L L M N O P Q R S T U V W X Y Z A B C D E F G H I J K
M M N O P Q R S T U V W X Y Z A B C D E F G H I J K L
N N O P Q R S T U V W X Y Z A B C D E F G H I J K L M
O O P Q R S T U V W X Y Z A B C D E F G H I J K L M N
P P Q R S T U V W X Y Z A B C D E F G H I J K L M N O
Q Q R S T U V W X Y Z A B C D E F G H I J K L M N O P
R R S T U V W X Y Z A B C D E F G H I J K L M N O P Q
S S T U V W X Y Z A B C D E F G H I J K L M N O P Q R
T T U V W X Y Z A B C D E F G H I J K L M N O P Q R S
U U V W X Y Z A B C D E F G H I J K L M N O P Q R S T
V V W X Y Z A B C D E F G H I J K L M N O P Q R S T U
W W X Y Z A B C D E F G H I J K L M N O P Q R S T U V
X X Y Z A B C D E F G H I J K L M N O P Q R S T U V W
Y Y Z A B C D E F G H I J K L M N O P Q R S T U V W X
Z Z A B C D E F G H I J K L M N O P Q R S T U V W X Y
 Introduction and Historical Background Chapter | 1 5

TABLE 1.5 The Ciphertext Alphabet for the Vigenère Cipher Using the Word Rima as a Key
Key R I M A R I M A R I M A R I M A R
Plaintext M O V E A F T E R M I D N I G H T
Encrypted D W H E R N F E I U U D E Q S H K
text

FIGURE 1.1 Excerpt from the Vigenère table showing only rows corresponding to our chosen keyword.

in the top horizontal row and move down until we reach the
R row (keyword row). The intersection takes place at the
letter D as it appears in Table 1.5. Repeat the same process
with the remaining letters.
Decryption is performed by using the keyword and
the ciphertext as follows: we search for the position of the
ciphertext in the row that corresponds to row of the matched
key. For example, to decrypt the first letter we look for the
letter D in the R row of the table; the matched letter is M
in the top plaintext row (horizontal top row). To decrypt the
second letter we search for W in the I row of the table; the
matching letter is O. We repeat the same process until we
match each letter in the ciphertext with its correspondent in
the keyword (Fig. 1.1).
Keyword: RIMARIMARIMARIMAR
Ciphertext: DWHERNFEIUUDEQSHK
AutoKey Cipher
This cipher uses the same encryption and decryption process
of the Vigenère cipher with one exception. Undoubtedly, in
the Vigenère cipher we have to repeat the keyword many
times, until the number of letters becomes equal with the
plaintext that we are going to encrypt. In AutoKey cipher,
we incorporate the plaintext into the keyword. For example:
Plaintext: MoveAfterMidNight
Keyword: Rima
AutoKey Keyword would become:
RimaMoveAfterMidNight
We continue the encryption and decryption as we did in
the Vigenère cipher.
Polygraphic Ciphers
In polygraphic ciphers each letter of the plaintext is substi-
tuted with two or more groups of letters, numbers, graphic
symbols, or other group of characters. By using this cipher
each word in the plaintext would be replaced by another
word, character, or number, thus making these ciphers very
hard to break using frequency analysis techniques.
Polygraphic ciphers were originally developed to hide
frequencies of ciphertext characters. Popular phrases are
replaced many times randomly during the message; for
example, the word Attack could be replaced by SY YF BL
for the first time during the message and then replaced by
FY YF BL in the next occurrence. This makes analyzing the
secret message using frequency analysis techniques very
hard to implement.
There are many types of polygraphic ciphers such as
Playfair, Bifid, Trifid, and Four-square. The best known one
is Playfair cipher, which we describe in detail next.
Playfair Cipher
This cipher was invented by a British scholar, Sir Charles
Wheatstone, in 1854; however, the cipher was named after
the Scottish scientist and liberal politician, Lord Lyon Play-
fair. Lord Playfair promoted this cipher technique widely.
It was used for tactical purposes by the British forces in
the Second Boer War and in World War I. It was also used
again by both British and Australian forces during World
War II.
Playfair was preferred by the British forces because it
is fast to learn and needs no equipment to implement; how-
ever, it was not used for top secret communications. Its use
6 Data Hiding Techniques in Windows OS

was limited to protecting communications during combat as bigram and make it even. It is not necessary to add the letter
enemy forces were able to decrypt Playfair cipher, but only X; if the pair consists of two X letters we can break it using
after a fair amount of time. It was successful because the infor- another letter like Z, for example.
mation decrypted would be useless to the enemy by then [1]. Now we take each group of letters and find them in
the table, first considering the following three Playfair
How to Encrypt Using Playfair Cipher? To encrypt using encryption rules:
Playfair, we first need to have a secret key. This key is made
1. If both letters are in the same column, take the letter
up of 25 letters; no repeated letters in sequence are allowed.
below each one; if one of the two letters is at the end of
For example, if two R’s happen to occur in sequence only the
the column, go back to the top of the column and take
first one is used; the second one is skipped.
the first letter.
Next, we need to create our Playfair table, which will
For example, to encrypt the pair letters EX, both are in
be a five-by-five table that begins with our chosen key. The
the same column, the first letter E becomes K (we took the
rest of the alphabet is inserted into the table without repeat-
letter below it directly), and the second letter X is at
ing the letters used in the keyword. Make sure that the table
the end of the column, so we return back to the top of the
consists of only 25 letters. Usually I and J are combined
column and select N. Now EX becomes KN after imple-
into one (insert either I or J) letter, or we have the option to
menting Playfair encryption using the table (see Fig. 1.2).
remove Q or X from the table.
2. If letters are both in the same row, take the letter to the
Let us now experiment creating our Playfair table. We
right of each one. Again if one of the letters is at the end
first need to have a secret keyword: London.
of the row, return to the beginning of that same row from
This is not a perfect keyword because it repeats two let-
the left and take the first letter in the row.
ters, O and N, but we will use it to demonstrate how repeated
For example, to encrypt the pair FG, the letter on the
letters in the keyword will be skipped in the table.
right side of F is G. The second letter G is at the end of
Let us now construct our Playfair five-by-five table
the row so we return back to the beginning of the same
(Table 1.6). We begin by writing the keyword without mod-
ifying its letter order, skipping repeated letters. (We will
begin writing from left to right and top to bottom.)
We insert the secret key, London, without repeating let-
ters (LOND). Remember to count the I and J as only I. We
insert the remaining alphabet row by row from left to right
and top to bottom without repeating the letters that existed
previously in the secret key, which were inserted before.
Next, we need to split up the secret message (plaintext)
into a group of two letters; if the plaintext consists of an odd
number of letters we should add X or Q at the end to make
it even. For example the sentence, Move after Midnight
Rima, would look like MO VE AF TE RM ID NI GH TR
IM AX. We then add X to the word Rima to make the final
plaintext number of letters even. We should also consider
not having one pair in the plaintext that contains double let- FIGURE 1.2 Letters in the same column case.
ters in succession after splitting it; if we have such a case
we should insert the letter X. For example, SUMMIT would
become SU MX MI TX. We separate the MM pair with X and
added X to the end of the word in order to complete the last

TABLE 1.6 Playfair Table With the Keyword LONDON

L O N D A
B C E F G
H I K M P
Q R S T U
V W X Y Z
FIGURE 1.3 Letters are in the same row case.

row from the left and take the letter B. Now FG becomes
GB (see Fig. 1.3).
3. If the letters are on different rows and columns of your
table, form a rectangle with two letters on the horizontal
opposite corners of the rectangle.
According to the previous example (see Fig. 1.4),
to encrypt the pair PV, we should form a rectangle,
where P becomes H and V becomes Z. The result of
encrypting of PV becomes HZ. We should pay close
attention to the last rule. The order of letters is very
important; the letter that comes first in the plaintext
is encrypted first, so in the previous example PV
becomes HZ, not ZH.
Let us now return to our example: we want to encrypt
the text, Move after Midnight Rima.
Secret Keyword: London
First, divide the text you want to encrypt into pairs. Put
X at the end of the plaintext if it consists of an odd number
of letters. If a pair has repeated letters in succession after
splitting it up, you will need to insert X inside it. Using
Table 1.6, the following applies (Table 1.7):
MO VE AF TE RM ID NI GH TR IM AX
How to Decrypt Using Playfair Cipher? Decrypting the
Playfair cipher is easy. We do the same encryption steps but
in reverse. Indeed, we need to have the secret key to complete
the decryption successfully. The next step would be creating
FIGURE 1.4 Letters are on different rows and columns case.
TABLE 1.7 Playfair Ciphertext According to Table 1.6
Plaintext MO VE AF TE
Rule Numbera 3 3 3 3
Playfair cipher ID XB DG SF
aWe have three rules as we mentioned before: (1) Pairs are on the same column, (2) pairs are on the same row, and (3) pairs are on different rows and on
different columns.
Introduction and Historical Background Chapter | 1 7
our Playfair five-by-five tables and do the decryption using
the reverse steps of encryption.
Mechanical Substitution Ciphers
Mechanical substitution ciphers were invented and used in
the period between World War I and the widespread avail-
ability of computers (some governments started to take
advantage of computers in ciphering in 1950, others waited
until 1960). The most famous and secure machine was the
Enigma machine, especially versions developed by the Ger-
man army exclusively for this purpose.
The Enigma Machine
With the increase of wireless communication starting in
1900, the need for a ciphering technique that replaces the
old and time-consuming handwritten ciphers to secure com-
munications was essential. From this point in history, differ-
ent countries seriously started investing in the development
of mechanical cipher machines.
As with many modern products, it is difficult to figure out
who has invented it before the others, but the concept of using
rotating disks to encrypt messages was invented in many
countries almost simultaneously. The leading inventors were
Edward Hebern in the United States, Arvid Damm in Swe-
den, Hugo Koch in The Netherlands, and Arthur Scherbius
in Germany. Many sources reference Hebern as the pioneer
in this field because he tried to manufacture and market his
machines commercially on a wide basis before the others [2].
In 1917, Hebern developed his cipher machine with
rotating disks; each disk would perform a substitution cipher.
He built his machine through combining the mechanical
parts of a standard typewriter with the electrical parts of an
electric typewriter, connecting the two through a scrambler.
It should be noted that Enigma is the brand name of a
series of rotor cipher machines, developed before and dur-
ing World War II by various countries (United States, Japan,
United Kingdom, to name a few). Some of the variations
developed were compatible with each other, although many
others were not [3].
The famous German Enigma machine was invented
by the German engineer Arthur Scherbius at the end of
World War I in 1918. Its early adoption was for commercial
use, but the weight and size of the early models (A and B
models) made them unattractive for military use. Enigma
RM ID NI GH TR IM AX
3 3 2 3 2 2 3
TI MO OK BP US KP NZ
8 Data Hiding Techniques in Windows OS

TABLE 1.8 Rail Fence Imaginary Table

M . . . A . . . R . . . N . . . T . . . A
. O . E . F . E . M . D . I . H . R . M .
. . V . . . T . . . I . . . G . . . I . .

evolved through several stages such as adding a reflector
to its engine, making it lighter and smaller in size (Enigma
C and D). In 1926, however, the commercial Enigma was
purchased by the German navy and adapted for military
use. The German army developed many versions of Enigma
before and during World War II; the most famous one was
Enigma M4, which was used exclusively in the U-Boot
division of the German navy. The Enigma M4 played a
vital role in the Battle of the Atlantic, where many historical
sources reference capturing its codebooks as a major turn-
ing point in World War II events.
Basically, the Enigma engine was composed mainly of
three physical rotors, each one taking a letter and output-
ting it as a different one to the next rotor in line. The letter
passes through all the three rotors and finally bounces off a
reflector, which also gives it another letter at the end. The
same process is repeated in reverse order, and the last letter
passes back through all three rotors in the other direction
until reaching the lightboard.
The board then lights up, showing the corresponding
encrypted output at the same time, and the first of the three
rotors clicks round one position. This results in changing
the second letter output even though it was the same letter
as the previous one.
You can check the Cipher Machines website for an illus-
tration of how Enigma machines work [4].
You can also download an open source exact simulation
of the Enigma cipher machine used during World War II
from the following link for practice on your own desktop:
http://users.telenet.be/d.rijmenants/en/enigmasim.htm.
Transposition Cipher
This is an encryption method where plaintext letters (or group
of characters) are reordered according to a predefined system
to hide messages sent. Transposition cipher is considered as an
alternative type of cipher used in ancient civilizations. It has
many different implementations; the following are only a few.
Rail Fence
Considered one of the oldest implementations of transposi-
tion ciphers, used by ancient Greeks in a mechanical system
called Scytale, Rail Fence derives its name from the way in
which it is encoded.
The plaintext is written downward and diagonally on
successive rails of an imaginary fence, then moving up
when we reach the bottom rail. When we reach the top rail,
the message is written downward again until the whole
plaintext is completed [5].
The key for the rail fence cipher is just the number of
rails. The number of practical keys that we can use is small.
Let us practice using this cipher by encrypting the following
text using a key of three rails, shown in Table 1.8:
Move after midnight Rima
The ciphertext is read off along the rows:
MARNTAOEFEMDIHRMVTIGI
(Note: Spaces between words in plaintext are ignored in
ciphertext.)
Decrypting the message is easy if the row boundaries
are known. Just write down the rows in order:
MARNTA
OEFEMDIHRM
VTIGI
Then reconstruct the rail again (three rails) and read it as
we did in Table 1.8.
Columnar Transposition
This is a fairly easy cipher to implement. In this cipher the
message is written out in rows of fixed length. What deter-
mines the number of rows and how the column is shifted is the
actual keyword. Let us practice encryption using this cipher.
Let’s select FRANCE as a keyword, and encrypt the
following text:
Move after midnight Jodi
The row length is the same as the length of the keyword,
and the number of columns is also determined according to
the number of keyword letters (in this case, 6) (Table 1.9).
We’ve added three X’s to make our secret message fit in
the rectangle. This is called regular columnar transposition. An
irregular columnar transposition leaves these characters blank.
Now we need to reorder the columns according to the
alphabetical order of the keyword (Table 1.10).
The ciphertext is read off along the columns (do not
count the keyword letters):
VRGIAITXFDJXMTNOEMHXOEID
To decipher the message, the recipient has to work out the
column lengths by dividing the message length by the key
 Introduction and Historical Background Chapter | 1 9

TABLE 1.9 Columnar Transposition Cipher With the TABLE 1.10 Columnar Transposition Cipher Ordered
Keyword FRANCE According to the English Alphabet Order
F R A N C E A C E F N R
M O V E A F V A F M E O
T E R M I D R I D T M E
N I G H T J G T J N H I
O D I X X X I X X O X D

TABLE 1.11 One-Time Pad Cipher for Encrypting HELLO KANDY

Plaintext H E L L O K A N D Y
One-time pad C Y H U I P H G T R
Ciphertext J C S F W Z H T W P

length. In this case, message length is 24 and the keyword
length is 6, so this column length would subsequently be 4.
Now we create our grid with six columns (keyword)
while each column contains four characters from the
ciphertext. Finally we rearrange the column according to
our keyword [6].
Double Transposition
This is just the same as the columnar cipher with an addi-
tional layer of security. We run the produced cipher through
the encryption again using a different keyword, thus making
the message extremely difficult to decipher.
Other implementations of the transposition cipher are
Route, Myszkowski transposition, Disrupted transposition,
and Grilles.
Other Ciphers and Codes
The One-Time Pad
This ciphering technique is considered one the few ciphering
techniques that have been proven to be unbreakable if used
correctly. What we mean by unbreakable if used correctly is
that during the last year of World War II (1943) and shortly
after, a counterintelligence project called Venona was initiated
by the US army’s Signal Intelligence Services (this agency
is now known by the name NSA) to decrypt the Soviet one-
time pad message. Many sources mention that more than 3000
messages were decrypted during the life span of this project
(1943–1980). The main reason for cracking this cipher was
using a nonrandom key material for encrypting messages sent
by the Soviet Union [7]. You can read more about this project
in an article published by the New York Times [8].
It works by pairing the plaintext with a secret key;
now each character from the plaintext is combined with its
correspondent from the secret key to produce the ciphertext.
Let us practice using it (Table 1.11).
Plaintext: Hello Kandy
One-time pad: CYHUIPHGTR
The first letter from the plaintext is H, its position in
the English alphabet is 8, and the one-time pad letter that
corresponds to it is C, which has the position 3. We calcu-
late both number positions and subtract 1 from the result:
(8 + 3) − 1 = 10. The number 10 is equal to the position of
letter J in the English alphabet and this becomes our first
encrypted letter. Each letter is enciphered in this method,
with the alphabet wrapping around to the beginning if the
addition results in a number beyond 26 (Z).
The ciphertext is JCSFWZHTWP
To decrypt the message, we subtract the first letter of the
ciphertext from the one-time pad and add one to the result.
The resulting number will point to the letter in the alphabet
that is corresponding to our plaintext letter.
To decrypt the first letter, J, we subtract J from C and
add 1 to the result (what we mean by subtraction is the value
position of each letter in the alphabet: J = 10 AND C = 3):
(10 − 3) + 1 = 8, which equals the letter H in the alphabet.
One-time pad is considered an impractical ciphering
technique as it requires that the key material be as long as
the plaintext, and the secret key should be random and used
only once. Furthermore, the key should be kept secret, not
told to anyone except the sender and receiver, since the key
and the ciphertext will reveal the entire secret message.
Morse Code
Morse code, originally named after its inventor, Samuel
Finley Breese Morse (1791–1872), an American inventor
and painter. is a system in which letters are represented by
10 Data Hiding Techniques in Windows OS
dots and dashes. Morse code was used over telegraph lines
to send messages in the United States since 1835.
Morse’s original code was not quite the same as the one
in use today as it included pauses as well as dahs and dits.
However, a conference in Berlin in 1851 established an
international version, shown in Fig. 1.5.
The most well-known use of Morse code is for sending
the distress signal: SOS. The SOS signal is sent as:
...---...
Although the telegraph has fallen out of widespread use
since the start of the 21st century, replaced by the telephone,
fax machine, and Internet, it set the groundwork for the
communications revolution that led to those later innova-
tions.
Book Cipher
Book cipher uses a large text or a complete book to encrypt
a secret message. This means the cipher key could be a com-
plete book, and without it the message cannot be decrypted.
FIGURE 1.5 Chart of the Morse code letters and numerals [9].
Each word in the plaintext message is replaced with a
number that represents the location of word from the book
being used. For example, the word Move could appear in
the book as word number 1075; we replace it with this
­number to form our ciphertext, and then repeat the same
process with the remaining words. Finally we will have a
cipher similar to this:
Plaintext: Move after Midnight
Ciphertext: 1075 145 1256
To decrypt the message we count the number of words
in the book and write down each one to form our plaintext
message again.
Difference Between Substitution and
Transposition Cipher
In substitution cipher we replace each letter of the plaintext
with another letter, symbol, or number; for the decryption,
the reverse substitution has to be performed. However, in
 Introduction and Historical Background Chapter | 1 11

transposition cipher we just rearrange the plaintext let-
ters in a different order; for example, when encrypting the
word Attack using a Caesar shift (shift of three), it results
in DWWDFN. In simple transposition cipher we can sim-
ply reorder the plaintext, and then Attack would become
KCATTA. We simply reverse the text.
The simplest form of substitution cipher is when each
character is replaced by exactly one other character (mono-
alphabetic ciphers). This encryption can be broken with
statistical methods (frequency analysis) because in every
language characters appear with a particular probability
(Fig. 1.6). Examples of similar weak ciphers are Caesar
Shift, Atbash, and Keyword.
The basic use of frequency analysis is to first count the
frequency of ciphertext letters and then associate guessed
plaintext letters with them (Table 1.12). The first one who
studied frequencies of letters was the Muslim Arab math-
ematician Al-Kindi (c.801–873 CE), who formally devel-
oped this method.
Polyalphabetic cipher was adopted to reduce the effec-
tiveness of frequency analysis attacks on the ciphertext,
because each letter in the ciphertext is shifted by a different
amount, determined according to the key used. Nonethe-
less, any resulting frequencies in the ciphertext would not
represent the frequencies of the actual message. This makes
conducting frequency analysis attacks harder in this cipher
but not impossible to crack!
Polygraphic cipher (like the Playfair cipher) is also harder
to break using a frequency analysis technique. Playfair
encrypts pairs of letters (digraphs) instead of one letter in a
monoalphabetic cipher, which means we have more than 600
possible digraphs rather than the 26 possible monographs.

FIGURE 1.6 A typical distribution of letters in English language text [10].

TABLE 1.12 Frequency of Common Letter Combinations in the English Language

Most common trigraphs in order of
frequency
The most common two-letter words in
order of frequency
The most common four-letter words in
order of frequency
THE, AND, THA, ENT, ION, TIO, FOR, NDE, HAS, NCE, TIS, OFT, MEN
of, to, in, it, is, be, as, at, so, we, he, by, or, on, do, if, me, my, up, an, go, no, us, am
That, with, have, this, will, your, from, they, know, want, been, good, much, some, time,
very, when, come, here, just, like, long, make, many, more, only, over, such, take, than,
them, well, were
12 Data Hiding Techniques in Windows OS
Transposition cipher is also susceptible to many dif-
ferent attacks. A single columnar transposition could be
attacked by guessing possible column lengths, writing the
message out in its columns, and then looking for possible
anagrams. Nowadays with the advance of computer sys-
tems many classical algorithms mentioned before could be
broken in a fraction of a second. The best methods now to
secure encryption is to combine both substitution and trans-
position ciphers to create a powerful encryption schema
(AES and DES algorithms combine both ciphers to create
very powerful algorithms).
The techniques mentioned earlier are considered obso-
lete in today’s world, but knowing these techniques remain
useful for understanding cryptography and the workings of
more complex modern ciphers.
Practicing Old Ciphers Using Modern
Computing
There are numerous websites that offers functionality for prac-
ticing encryption/decryption of different ciphering algorithms.
However, I do not recommend using these websites because
they may not be accurate enough (although some of them
can be professional and are maintained by specialists in the
field). CrypTool is a tool developed and maintained by a set
of famous German and European universities (Fig. 1.7). The
CrypTool website describes this tool as follows:
CrypTool 1 (CT1) is an open-source Windows program for
cryptography and cryptanalysis. It’s the most wide-spread
e-learning software of its kind.
FIGURE 1.7 Screen capture of the CrypTool program.
There is another version of this tool with more advanced
features and covers more encryption algorithms, defined by
its creators as follows:
CrypTool 2 is the modern successor of CrypTool 1, it provides
a graphical user interface for visual programming. So
workflows can be visualized and controlled to enable intuitive
manipulation and interaction of cryptographic functions.
Both tools can be downloaded from https://www.cryp-
tool.org/en/. It should be noted that practicing algorithms
using this tool is fun and simple.
MODERN CRYPTOGRAPHY SYSTEMS
Cryptography is the practice of hiding information by
obscuring it, thus making it unreadable for any unintended
recipients. Modern cryptography intersects the disciplines
of mathematics, computer science, and electrical engi-
neering. Applications of cryptography include ATM cards,
authentication and digital signatures, secure network com-
munications, disk encryption, electronic commerce, cable
television networks, and so on.
Basically there are three types of cryptography systems:
l Secret key cryptography (symmetrical encryption)
l Public key cryptography (asymmetrical encryption)
l Cryptographic hash function
In cryptography, a key is a piece of information used by
an algorithm to alter information. This is aimed at ­making this
information scrambled and is visible only to people who have
the corresponding key to recover the desired information.
 Introduction and Historical Background Chapter | 1 13

Secret Key Cryptography
In secret key cryptography, both the sender and receiver
must use the same key to encrypt and decrypt a message as
shown in Fig. 1.8 (for obvious reasons it was named sym-
metrical encryption). This imposes a security risk as we
need to deliver the key to the recipient of the message in a
secure way to decrypt the message. If intruders get hold of
the key, they will be able to decrypt the secret message, thus
compromising the entire system.
Public Key Cryptography
In public key cryptography, we use two keys: one for encryp-
tion and the second for decryption. We can distribute the
public key everywhere without compromising the private
key. A user will use his friend’s public key to encrypt the
message. The receiver will use his/her private key (which
should be kept secret) to decrypt this message.
Although the two keys are different, two parts of this
key pair are mathematically linked. The public key is used
to encrypt plaintext or to verify a digital signature, whereas
the private key is used to decrypt ciphertext or to create a
digital signature. Messages encrypted with a public key can
only be decrypted using the same private key pair.
This method is far more secure than the symmetric cryp-
tography, as the sender and receiver can exchange their pub-
lic keys using any communication method while keeping
their private keys secret to decrypt the messages received.
Let us demonstrate how public key cryptography works
using this simple example (Fig. 1.9):
1. Sophy wants to communicate secretly with Nihad, so
Sophy encrypts a message using Nihad’s public key
(which he made available to everyone through his web-
site or on his email signature) and sends the encrypted
message to him.
2. When Nihad receives the encrypted message, he uses
his private key to decrypt the message so he can read it.
3. If Nihad wants to send an encrypted reply to Sophy, he
will use her public key to encrypt the message and send
it back to her.
4. When Sophy receives Nihad’s reply, she will use her pri-
vate key to decrypt the message so she is able to read it.

Plain Plain
Text Encrypted Text Text

Sender Encrypt Decrypt Receiver

Secret key
We use the same Key to encrypt and decrypt the
message
www.DarknessGate.com

FIGURE 1.8 Demonstration of a secret key cryptography system.

Plain Plain
Text Encrypted Text Text

Sender Encrypt Decrypt Receiver

Recipient 's Recipient 's

Public key Private key
Two Different Keys used One
for Encryption and the second
 www.DarknessGate.com for Decryption
FIGURE 1.9 Demonstration of asymmetric cryptography: public and private key pair.
14 Data Hiding Techniques in Windows OS

Digital Signature
After we learned how public/private keypair works, we need
a method to make sure that the person who sends us the
encrypted message is who he pretends to be. For example
in our last demonstration, we said that if Sophy wants to
send a secure message to Nihad she should encrypt it using
Nihad’s public key, and Nihad will use his private key to
decrypt the received message.
However, how can Nihad make sure that this message
was sent from Sophy? What if another person (Mary, for
example) sent him the message pretending to be Sophy!
Here comes the digital signature’s role in authenticating the
sender of the message.
Sophy can encrypt the message using her private key and
send it to Nihad. Nihad now has to use Sophy’s public key to
decrypt the message. Because Sophy’s private key is secret
(and should always be so), Nihad knows that this message
originated from Sophy and not from anyone else because only
a formula in such a way that it is extremely unlikely that some
other text will produce the same hash value.
Hashing is widely used in information security and
forensic systems. If we want to send an encrypted file,
we will first calculate the file hash. Then we will encrypt
the file along with the generated hash number (we can put
it in a text file) and send it to the recipient. The recipient
will decrypt the file and calculate his hash number. If both
hashes are the same there is very high probability that mes-
sage has not been tampered with [11].
The ideal cryptographic hash function has four main
properties [12]:
l It is easy to compute the hash value for any given ­message.
l It is almost impossible to generate a message from a
given hash.
l It is impossible to modify a message without changing
the hash.
l It is impossible to find two different messages with the

Sophy knows her private key. This is similar to a paper letter, same hash.
where a signature on the letter serves as a proof that this mes-
There are many different hashing algorithms: MD2,
sage was written by the person who signed it with his own
MD5, SHA, and SHA-1 are examples.
signature. Encrypting with a private key can thus be regarded
as an equivalent alternative to placing one’s signature on the
message. This is why it is being called creating a digital signa-
ture for the message (Fig. 1.10). How to Calculate File Hash?
In order to send the message secretly after signing it, Many tools can be used to calculate a file hash under
Sophy has to encrypt the message again using Nihad’s public Windows® machines. Febooti Hash & CRC is one tool
key and then send it to him. On the other end, Nihad has to that is very easy to use (Fig. 1.11).
decrypt the message using his private key and then decrypt To install it on your PC follow these steps:
1. Go to http://www.febooti.com/downloads (if the
the result again using Sophy’s public key so he can read the
link changed search for Hash & CRC).
message and also make sure it originated from Sophy.
2. Download the file to your PC (it is 0.9 MB and
works on both 32- and 64-bit machines).
Cryptographic Hash Function 3. After installing the program, right-click on any file that
you want to calculate its hash and select Properties.
The hash function is another secure way of encryption. Hashing 4. From the Properties window, select the Hash/
is the act of generating a number from a string of text. The hash CRC tab.
is substantially smaller than the text itself, and is generated by

Message
Signed by
X.509
Certificate

Create Signature Verify Signature Receiver

Sender

Sender's Sender's
Private Key Public Key
 www.DarknessGate.com

FIGURE 1.10 Digital signature using X.509 certificate.


FIGURE 1.11 Calculate hash using the Hash/CRC tool.
STEGANOGRAPHY
What Is Steganography?
Steganography is the science of hiding information.
It is among the few disciplines that have the honor to
be described as an art in addition to being a science.
Whereas the goal of cryptography is to make data unread-
able by a third party, the goal of steganography is to hide
data from a third party. Steganography is usually used in
conjunction with encryption for additional security of
sensitive data. By hiding encrypted data inside an hon-
est-looking carrier, a secret message has less possibility
of being discovered by outside parties during informa-
tion exchange.
Hiding secret messages inside what seem to be ordi-
nary messages is nothing new. The word steganography
itself originated in Greece and it means covered writ-
ing. It includes a vast array of techniques that could
be used to conceal the existence of a hidden message.
The first recorded use of this term was in 1499 AD by
a German scholar name Johannes Trithemius in his
Steganographia, a three-volume work describing dif-
ferent techniques of concealing secret messages in text.
These volumes also suggested different techniques to
hide messages using cryptography and a system of rapid
learning [13].
Introduction and Historical Background Chapter | 1 15
Although the term steganography appeared first in the
15th century, throughout history there have been number
of techniques used for hiding messages, especially during
wars. Different civilizations implemented steganography
techniques in different ways. The first recorded one took
place in 440 BC in ancient Greece when Demaratus sent
a warning about a forthcoming attack to Greece by writing
it directly on the wooden backing of a wax tablet before
applying its beeswax surface [14].
The Roman Empire also used steganography tech-
niques around 300 AD through human skin, where
Roman generals used slaves as carriers for their secret
messages during wars. The slave’s head would be shaved
clean, and the secret message is tattooed on his head
using small letters. After a month, the slave’s hair would
grow back, covering the secret message. Then the slave
was sent across hostile land with little fear that the secret
message may get exposed by the enemy. Upon reaching
the final destination, a quick head shave revealed the
secret message. The reply could be sent by another slave
in the same way.
In ancient China, secret messages were written on fine
silk or papers and then rolled it into a ball and covered by a
layer of wax. The messenger swallowed the ball and kept it
in his stomach until he reached his final destination.
If we compare historical methods of steganography
with the new modern ones we are going to see in coming
chapters, we find that the major changes between both was
in the carrier of secret data only. Historical methods relied
on physical steganography (technique) such as invisible
ink, animal skin, eggs, human skin, and engraved symbols.
Modern methods, however, are heavily dependent on digital
media like digital images, audio, video files, transmission
protocols, and electronic waves as new carriers of the con-
cealed data.
Comparing Steganography and Cryptography
Both steganography and cryptography share the goal in pro-
viding secret communications, but they differ in the meth-
ods used to achieve this goal. Some researchers argue that
steganography is a form of cryptography because it is used
to cover communications. In this book, nonetheless, we will
talk about steganography as a separate field to simplify pre-
senting information for readers. Because digital steganogra-
phy has evolved a lot in the last years, it is only right to put
it in its own category in modern computer science.
Table 1.13 describes some main differences between
both techniques.
Steganography Types
There are different types of stenography: linguistic, techni-
cal, and digital (Fig. 1.12). The focus of this book is on
digital stenography used mostly on computers; however, we
16 Data Hiding Techniques in Windows OS

TABLE 1.13 Compare Steganography and Cryptography

No. Context Steganography Cryptography

1 Hidden message status
2 Outside party
3 Level of development
4 Ciphertext status
5 Carrier file
6 Types of secret files
7 Output result
Message does not appear (hidden) Message appears scrambled
Communication is hidden from outside parties Third parties know a communication
exists but they cannot read the contents
Still undergoing development Matured technology
Structure of the message remains the same Cryptography modifies message struc-
ture through a cryptographic algorithm
Image, audio, video, text, Internet protocols Mostly text files
Image, audio, text, almost all types of digital files Mostly text files
Stego file Ciphertext

Steganography

Technical Linguistic Digital

Steganography Steganography Steganography

Invisible ink SemaGrams Open Codes Text

Microdots Audio/Video
Visual Text Covered
Jargon Code
Semagrams Semagrams Ciphers

Image

Null Cipher Grille Cipher

Network

FIGURE 1.12 Classification of steganographic methods.

are going to cover other types in brief to make this book as
inclusive as possible.
Technical Steganography
Technical steganography uses different scientific methods
to obscure messages. We will mention two: invisible ink
and microdot.
Invisible Ink
Invisible ink is a colorless ink (such as acid, milk, lemon
juice, etc.) that does not visibly appear on paper after writ-
ing with it. It requires the use of flame, light, or other chem-
During the US revolution, both British and American
rebels used invisible ink to exchange secret messages. The
secret writing was inserted between lines of an ordinary let-
ter. They were written using a mixture of ferrous sulfate and
water. The recipient then put the paper above a candle flame
or treated it with a chemical material such as sodium car-
bonate to reveal the message’s hidden contents.
You can practice writing a secret message in your home
using the following steps:
l Use milk as ink. Use a brush to write your secret mes-
sage on a piece of paper.
l Let your paper dry once done writing.

ical material to make the font appear in an attempt to reveal l In order to reveal the message, put the paper above a
hidden messages. candle flame, or expose the paper to a heat source.

Microdots
Microdots are text or images reduced to a very small size
(about 1 mm in diameter) to prevent detection by unintended
recipients. This method was used widely during World War
II. Microdots have often been about the size and shape of a
period or the title of a lowercase i or j [15].
The Germans often credited the invention of microdots
to themselves; however Alexander Foote, a Soviet agent in
World War II, said in his book, Handbook for Spies, that the
Soviet intelligence service had used this method before World
War II. Microdots were used extensively during the war by
all parties, especially the French and Germans, by sending
their hidden messages across enemy lines by balloons and
pigeons. During World War II German spies used to photo-
graph secret messages and reduce their size to 1 mm (one
dot). Then they would insert this dot into another ordinary
message. Upon receiving the message, the secret message
would be extracted and enlarged again to become readable.
The first reported usage of this technique was during
the Franco-Prussian War in 1870. It was conducted through
shrinking messages to reduce their size during transmission.
Linguistic Steganography
Linguistic steganography is the art of using written natural
language to hide the presence of secret messages. It is fur-
ther classified as open codes and semagrams.
Semagrams
Semagrams hide information by the use of symbols or
signs. It has two types: visual and text.
Visual Semagrams A visual semagram uses innocent-
looking or everyday physical objects to convey a message;
for example, a sender can post a picture on his Facebook
profile showing a natural landscape at dawn, and this picture
may indicate to the recipient a special meaning like Attack at
Dawn. Another example is by modifying a website’s layout
or color, a sender can change the website theme to a different
color to communicate a secret message to the recipient.
These signs are difficult to detect and have the advantage of
normality in an everyday world.
Text Semagrams A text semagram hides a message by
modifying the appearance of the carrier text. Capitalized
letters, accentuation, peculiar handwriting, blank spaces in
between words, or handwritten text can all be used as signals
for a predefined purpose.
Open Codes
In open codes steganography a message is hidden inside a
legitimate innocent piece of text that will not draw the atten-
tion of a regular observer. Some may argue that this method
is not suitable or secure enough for hiding messages; how-
ever, the following example will clear this point.
Introduction and Historical Background Chapter | 1 17
A human observer is different from computer surveil-
lance software that is used by many governments to monitor
Internet traffic when it comes to steganalysis.
For example, if a political activist wants to send a
secret message (email) to someone else in another coun-
try by using the open codes technique, he can simply hide
his secret message using one of the open code techniques
described next and he can almost assure that his message
will not draw the attention of any automated monitoring
programs that could be used by his government to monitor
Internet traffic. This could be achieved by taking advantage
of the nonintelligent nature of computer systems. However,
this does not mean that it is safe to send top secret mes-
sages using an open code technique. A specialist observer
can easily extract the hidden message from the regular text
if the message was sent for analysis by a human.
Misspellings Since automated monitoring machines are
programmed to track specific keywords, it is difficult for them
to know all possible variations of spelling for a specific word.
For example, we can misspell the following phrase as follows:
Regular text: Meet me tomorrow
Misspelled text: mt m tmrow
You can use this technique to hide only some words that
you think the automated machines may be programmed to
capture, as it is not practical to hide long messages using
this technique.
Jargon Code Is using a language that is only meaningful for
a group of people, the Internet is full of jargon code. These
days, for example, many people use specific chat acronyms
and text shorthand during online chat like:
2BZ4UQT: Too Busy For You Cutey
4eva: Forever
ADBB: All Done Bye Bye
Covered Cipher Covered Cipher uses a particular method
or secret way to hide the classified message inside another
innocent looking message. The secret message could only be
recovered by the person who knows how it was concealed. It
has two types: null and grille.
Null Cipher Use a set of rules to hide a secret message in
an open carrier, like reading the second letter of every word.
A famous example of this technique is a message sent by the
German Embassy in Washington, DC to the headquarters in
Berlin during World War I:
PRESIDENT’S EMBARGO RULING SHOULD
HAVE IMMEDIATE NOTICE. GRAVE SITUATION
AFFECTING INTERNATIONAL LAW. STATEMENT
FORESHADOWS RUIN OF MANY NEUTRALS.
YELLOW JOURNALS UNIFYING NATIONAL
EXCITEMENT IMMENSELY.
18 Data Hiding Techniques in Windows OS
If we took the first letter from each word we will have
the following message:
Pershing sails from NY June 1.
The Germans returned another message, apparently as a
check on the first:
APPARENTLY NEUTRAL’S PROTEST IS
THOROUGHLY DISCOUNTED AND IGNORED.
ISMAN HARD HIT. BLOCKADE ISSUE AFFECTS
PRETEXT FOR EMBARGO ON BYPRODUCTS,
EJECTING SUETS AND VEGETABLE OILS.
Taking the second letter in each word the same secret
message as the first will emerge:
Pershing sails from NY June 1.
The advantage of this method is that a secret message
could be hidden inside another open carrier that contains
ordinary text that may not grab the attention of any observer
[16].In Chapter 3, we will investigate a modern type of null
cipher that allows us to hide our secret message digitally
using SPAM messages as a carrier.
Grille Cipher Grille cipher was invented by Gerolamo
Cardano. Grilles are a kind of transposition cipher that
can also include aspects of steganography. They are best
thought of as pieces of cardboard with holes cut into them
in a specific pattern. The secret message is written in the
holes, and then the rest of the message is filled in around
it. The only way the message is readable is by the recipient
who has the correct grille.
Digital Steganography
The advance of computers and the widespread use of online
communication nowadays had allowed us to begin embed-
ding secret messages inside digital files like images and
audio files. This could be achieved by adding secret bits or
replacing the current bits inside digital files. Such hiding
methods are considered difficult to crack and notice for both
human observer and automated programs used by govern-
ments to monitor online traffic.
Some may argue that using cryptography techniques
is more secure for transmitting extremely sensitive infor-
mation and business documents; however, there are cases
when we are not able to use cryptography because it is not
allowed by law or simply because we have something to
hide and do not want to grab attention. Along comes stegan-
ography to solve this problem.
There are basically two popular approaches for imple-
menting steganography in digital files:
1. Adding bits to a file: Hidden messages could be inserted in
the file header of different digital files. In many image for-
mats file headers usually store information like the image’s
size, resolution, number of colors, and so on. Such places
are ideal for storing our hidden messages. In Chapter 2 you
will see how you can hide large amounts of data inside an
image header without tampering the image’s appearance
or quality. We can also insert secret messages after the end-
of-file (EOF) marker. Each digital file has an EOF marker
that signals the end of file. Everything after this mark
will not be read by the program. The disadvantage of this
method is that the size of the carrier file will increase if our
secret message was large.
2. Using Least Significant Bit (LSB): In this method we
do not add new bits to our carrier file, we simply substi-
tute the last significant bit with one bit from our secret
message. Each byte is composed of 8 bits, however, the
last bit of each byte is not significant to the file itself.
Fortunately we can change it without affecting the qual-
ity of the original file. This bit is called the LSB and
here is where we are going to hide our bit. By using this
method the size of the carrier file will not increase.
In this book we will often refer to the secret message
(hidden message) by the name covert file and the carrier
message by the name overt file.
Steganography Protocols Types
There are basically three (protocols) in which steganogra-
phy can be implemented digitally:
1. 
Pure steganography: In this method, steganography is
implemented without using a key (stego-key); we just
insert the hidden message inside the carrier file. This
method is considered the least secure because the secu-
rity of the system depends entirely on its secrecy.
2. 
Private key steganography: This requires exchang-
ing a secret key between the sender and the receiver
before the communication can occur. In this process the
secret message is embedded inside the overt file (any
supported digital file) using a stego-key and then sent
over a public channel like the Internet to the recipient,
who also needs to have the same stego-key in order
to extract the hidden message and read it. The disad-
vantage of this protocol is that the stego-key should be
transferred in advance between the two parties and in a
secure method. If, at any point, an intruder gets hold of
the key, bearing in mind that he/she suspects that there
is a hidden message transmitted, he/she will be able to
decrypt the secret message and thus compromise the
whole system.
3. 
Public key steganography: This is similar to the pub-
lic key cryptography. In this protocol the sender will
encrypt the hidden message with the recipient’s public
key and send it to him/her. The receiver will then use
his/her private key in order to reconstruct the hidden
message.
This protocol takes advantage of the secret features of
the pubic key cryptography (hence no need to exchange

private keys between parties, which eliminates the pos-
sibility of stealing the key while transmitting it). In
order to compromise this protocol an intruder needs first
to know about the existence of the hidden message. He/
she, then, can find a way to break the encryption algo-
rithm (which is extremely difficult to achieve) in order
to extract and read the hidden message.
 A major disadvantage of the last two methods is that
encrypting secret messages before hiding it inside a car-
rier file will make it susceptible to an automated monitor-
ing system. Monitoring programs used by governments
and big organizations can easily detect encrypted files
and steganography embedding algorithm signatures
(more on this on Chapter 6), resulting in launching an
alarm for further investigation by humans.
Steganography Types According to Host File Type
There are several approaches in categorizing steganographic
systems. We can categorize them according to the type of
overt file used for secret communication or according to the
overt file modifications applied in the embedding process
(Fig. 1.13). In this section we will follow the first approach
in categorizing steganographic systems. This helps us to
keep our approach on data hiding more practical and under-
stood by most computer professionals and end users alike.
We can divide digital steganography according to the
host file used (carrier or overt file) as follows.
Text Steganography Text steganography is a type of
steganography that uses text to conceal messages inside
it. This could be achieved by changing text formatting
or the characteristics of the text. This type is considered
impractical, though, because it cannot hide large volumes of
data without grabbing someone’s attention. Some examples
are the hidden text feature in MS Office®, which can be
applied by inserting small spaces between words to store
bits; white space manipulation to store bits in front of each
line or section in the document; shifting lines up or down
to store bits; making text white on a white background; and
storing hidden text inside document metadata.
Image Steganography Image Steganography is a technique
that has become more popular in recent years because of the
Digital
Steganography
Audio/Video Image Text Network
FIGURE 1.13 Classification of digital steganography according to host
file type.
Introduction and Historical Background Chapter | 1 19
flood of electronic images available online with the advent
of digital cameras, smart phones, and high-speed Internet
that simplify distribution of large images. In addition to its
popularity among users, digital images have more capability
to store large amounts of hidden data inside their structure, as
we will see in Chapter 3.
Image steganography works by embedding an encrypted
message (or the original message without encryption) into
a graphic file. This produces what is called a stego-image.
This stego-image is then transmitted to the receiver,
who then extracts the message from the carrier file using
a predefined shared secret between the sender and the
receiver. During the transmission of the stego-image,
unauthenticated persons can only observe the transmis-
sion of an image but can’t recognize the existence of the
hidden message.
Audio/Video Steganography Audio steganography takes
advantage of physical characteristics of the human auditory
system. For example, the human ear can listen to noise in
the audible frequency range between 20 Hz and 20 kHz.
Audio steganography works by embedding a secret message
inside a digitized audio signal, which results in changing the
binary sequence of the corresponding audio file without any
noticeable change to the human ear.The human ear is not able
to recognize a low tone frequency signal in the presence of
a higher frequency; this is called frequency masking. This
discovered property is used in different ways to exploit audio
files for embedding data inside it secretly.
Audio steganography uses the following techniques for
hiding secret messages:
l LSB coding
l Parity coding
l Phase coding
l Spread spectrum
l Echo hiding
Audio steganography is also part of the more common
term of digital watermarking (antipiracy techniques), which
is widely used in counterpiracy systems. This technique
enable us to know whether a specific audio/video is illegally
recorded (copy version) and when this happened.
Video uses a combination of both images and audio to
deliver its contents. Hidden data is usually embedded inside
video images. The continual stream of images and sound
will make it very hard for humans to know there is hidden
data inside the video file (more on this in Chapter 3).
Network Steganography Network steganography works
by exploiting different networking protocol features to
hide its secret message. We can also consider concealing
data messages inside images, then sending them across
the Internet as a kind of networking stego. In this book,
however, we will only refer to the methods where we can
20 Data Hiding Techniques in Windows OS
exploit hidden areas inside networking protocol channels as
networking steganography.
There are basically two ways in which we can hide our
secret messages using network steganography:
1. Exploiting some networking protocols in unused header
space to conceal data.
2. Masking secret messages as ordinary network traffic.
Some working examples of networking steganography are:
1. Hiding messages inside network protocols, like hiding
in IPv4, IPv6, TCP, or UDP headers.
2. Concealing secret messages by masking their contents to
appear as a regular traffic, for example, masking a mes-
sage to appears as HTML code and sending it through
port 80 to look like ordinary Internet traffic.
3. Exploiting HTTP GET requests to convey their mes-
sages to a web server.
4. Hiding inside DNS queries.
In Chapter 3 we will expand our discussion on hiding
data inside digital files to include plenty of working exam-
ples on how we can achieve this practically in addition to
offering a detailed description of how each technique works
behind the scene.
Digital Steganography Techniques
In the previous section we’ve categorized steganography
according to the overt file used. In the digital steganogra-
phy techniques section we will talk about how this could be
achieved with respect to the overt file modifications.
In order to hide our secret message inside digitalized files
we need to use one (or more) of the following techniques.
Injunction In this technique we insert our secret message
in a trivial location that will not be read by an overt file
application. For example, each file has an EOF marker
that points where the file ends. Some files allow us to
insert secret data beyond the EOF marker, so if we have
a JPEG image that contains secret data beyond the EOF,
any application (Windows® Photo Viewer, for example) will
read the image and stop when it reaches the EOF marker.
Everything beyond the EOF marker will be hidden without
affecting image quality or appearance. The main drawback
of this method is that the size of the overt file will increase
dramatically if the volume of secret data is big, thus making
it more suspicious for observers. In addition, investigating
for hidden data beyond the EOF is very easy and could be
done automatically by many tools.
Substitution Substitution works by embedding secret
messages inside the overt file without adding any additional
bits to it. It looks for insignificant bits in the overt file that
will not affect the file itself if replaced with the secret
message bits. This technique is more secure than the
injunction technique because it does not add anything new
to the overt file, making its size the same as the original one.
However, the volume of data that can be hidden is limited
to the amount of insignificant bits in the overt file.For
example, the image file is composed of many bytes, each
byte containing 8 bits. If we replace the least bit in each
byte of the image with our secret message bit we can have
our secret message hidden completely without modifying
image appearance or size.
Generation In this method a new overt file will be
produced based on the information that existed in the secret
message. This will produce a new overt file that contains
the secret data.For example, we can hide our secret message
by producing another bigger message that looks similar to
SPAM messages. A website called Spammimic [17] uses
such a technique to hide and transmit secret messages.
In Chapter 3 we will expand our discussion on each
steganographic technique based on the modifications of the
overt file.
WATERMARKING
With the increased number of digital files published
online, it is necessary to find a method to identify the
legal owner of a specific file. A digital watermark is a kind
of marker embedded into audio, video, or image files. A
digital watermarks is usually used to verify the content is
genuine and from an authorized source and that content
has not been altered or reproduced. Furthermore, it is used
for protecting against digital piracy by defining ownership
and usage rights of digital contents in addition to tracking
it online.
Famous artists usually watermark their pictures in case
someone tries to steel their work as the watermark will be
copied along with the image and reproduce itself with each
copy.
Watermarking Types
Watermarks could be categorized in two ways:
l Technique used to embed the watermark in the overt file
l Visibility of the inserted watermark
To simplify the discussion in this section we will catego-
rize it according to its visibility.
Visible Watermark
As its name implies, visible watermarks appear clearly on
the digital file that we want to protect. Copyright owners
usually use symbols or text to prove the ownership of their
files. Fig. 1.14 displays a copyright notice by its owner.

FIGURE 1.14 Demonstration of visible watermark on a picture.
Invisible Watermark
This is a hidden watermark embedded in a digital file’s
binary data without altering its visual representation. We
can store such marks in image EXIF property fields (as we
will see in Chapters 2 and 6). Some specialized software can
detect and uncover invisible watermarks. Its primary usage
is to prove the ownership of the file and to track it online
by inserting some metadata. Removing an invisible water-
mark completely could be done using specialized software
(as we will see in Chapters 6 and 7). EXIF metadata can
also be removed in Windows® machines by right-clicking
Photo ≫ Properties ≫ Details ≫ Remove Properties and Per-
sonal Information or we can simply (if it is hidden in EXIF
property) open the image in any image editor and save it
again as a copy to remove the hidden watermark from the
photo. The last two methods will not guarantee completely
removing all tags.
Compare Steganography and Watermarking
They do not share the same goal, although embedding a hidden
watermark inside a digital file is considered a type of stegan-
ography, but the ultimate goal is to track copyright infringe-
ments and prove the ownership of the file in case of a dispute,
and steganography’s goal is to hide data secretly. Steganogra-
phy tries to hide as much data as possible while watermarking
tends to hide a small amount of data inside the overt file.
ANONYMITY
The most recent addition to the field of data hiding is ano-
nymity. Anonymity is concerned with hiding any traces
between the sender and message receiver. It uses a com-
bination of encryption algorithms to encrypt messages and
cryptographic anonymity tools to hide your identity during
the transmission.
Introduction and Historical Background Chapter | 1 21
Shortly after the Edward Snowden scandal (he leaked
classified information from NSA about running illegal
surveillance program to the press in 2013), a mass media
campaign was launched inside and outside the United States
against this program. Large numbers of privacy groups,
social activists, journalists groups, and encryption software
vendors began to ask the public to encrypt everything from
emails to IM instant messages.
Snowden’s scandal raised public awareness toward tak-
ing their privacy online seriously. In order to anonymize
your online activities you need to follow a set of procedures
when surfing the Internet, sending emails, and chatting with
friends. In Chapter 5 we will discuss how we can protect
ourselves online using a combination of hiding techniques,
encryption and cryptographic anonymity tools.
SUMMARY
In this chapter we began our journey from the past to discover
the old cryptographic systems, which played vital roles dur-
ing wars and in sending diplomatic messages in ancient times.
This knowledge is crucial to understand the new encryption
techniques and how they work in modern time.
After listing the major cryptographic techniques we talked
about steganography, its types, and techniques, and how was
implemented in ancient civilizations to the present day.
We also talked briefly about digital watermarking and
online anonymity. We postpone our deep discussion of
these two subjects to Chapters 3 and 5, respectively.
In Chapter 2 we will begin our practical hiding journey
by introducing the reader to many simple techniques that
could be used to hide our files in Windows®. So let us begin
hiding your secret information!
REFERENCES
[1] Wikipedia, Playfair Cipher [Online]. Available from: http://en.
wikipedia.org/wiki/Playfair_cipher (accessed 14.03.15).
[2] Wikipedia, Rotor machine [Online]. Available from: https://en.
wikipedia.org/wiki/Rotor_machine (accessed 18.03.15).
[3] Wikipedia, Enigma Machine [Online]. Available from: https://en.
wikipedia.org/wiki/Enigma_machine (accessed 26.03.15).
[4] Cipher Machines, The History and Technology of the Enigma Cipher
Machine [Online]. Available from: http://ciphermachines.com/
enigma (accessed 29.03.15).
[5] Wikipedia, Rail Fence [Online]. Available from: http://en.wikipedia.
org/wiki/Rail_fence_cipher (accessed 30.03.15).
[6] Wikipedia, Columnar Transposition [Online]. Available from: http://
en.wikipedia.org/wiki/Transposition_cipher#Columnar_transposition
(accessed 11.05.15).
[7] Wikipedia, Venona project [Online]. Available from: http://
en.wikipedia.org/wiki/Venona_project (accessed 14.05.15).
[8] New York Times, Venona Decoding Soviet Espionage in America
[Online]. Available from: https://www.nytimes.com/books/first/h/
haynes-venona.html (accessed 15.07.15).
22 Data Hiding Techniques in Windows OS
[9] Wikimedia Commons: Morse code; copyright James Kanjo GNU Free
Documentation License|this is a visually updated/enhanced image based
on the original 1922 Chart of the Morse Code Letters and Numer-
als [Online]. Available from: https://commons.wikimedia.org/wiki/
File:International_Morse_Code.PNG (accessed 15.07.15).
[10] Wikipedia, Frequency analysis of English alphabet [Online]. Avail-
able from: https://commons.wikimedia.org/wiki/File:English_letter_
frequency_(alphabetic).svg#/media/File:English_letter_frequency_
(alphabetic).svg (accessed 19.07.15).
[11] Webopedia, Defining computer Hashing [Online]. Available from: http://
www.webopedia.com/TERM/H/hashing.html (accessed 17.06.15).
[12] Wikipedia, Cryptographic Hash Function Main Properties [Online].
Available from: http://en.wikipedia.org/wiki/Cryptographic_hash_
function (accessed 11.02.15).
[13] Wikipedia, Johannes Trithemius; Steganogrphia book [Online].
Available from: https://en.wikipedia.org/wiki/Johannes_Trithemius
(accessed 17.06.15).
[14] Project Gutenberg, The History of Herodotus—Vol. 1 by Herodo-
tus [Online]. Available from: http://www.gutenberg.org/files/2707/
2707-h/2707-h.htm (accessed 17.06.15).
[15] Wikipedia, Microdot [Online]. Available from: http://en.wikipedia.
org/wiki/Microdot (accessed 17.06.15).
[16] D. Kahn, The Codebreakers, The Macmillan Company, New York,
NY, 1967.
[17] Spammimic, Hiding in Spam emails [Online]. Available from: http://
www.spammimic.com (accessed 17.06.15).
BIBLIOGRAPHY
[1] Johannes Trithemius Main Page [Online]. Available from: http://
www.renaissanceastrology.com/trithemius.html (accessed 17.06.16).
[2] G. Kessler, An Overview of Steganography for the Computer Foren-
sics Examiner [Online]. Available from: http://www.garykessler.net/
library/fsc_stego.html (accessed 17.06.15).
[3] Steganography Types and Some Tools. http://www.hackersonline-
club.com/steganography (accessed 17.06.15).
[4] Spy Techniques During USA Revolutionary War [Online]. Available
from: http://www.mountvernon.org/george-washington/the-revolu-
tionary-war/george-washington-spymaster/spy-techniques-of-the-
revolutionary-war/ (accessed 17.06.15).
[5] Software Anti-Piracy Systems and Methods Utilizing Certificates
With Digital Content [Online]. Available from: http://www.google.
com/patents/US7639834 (accessed 17.06.15).
Another random document with
no related content on Scribd:
marry? For him it would be all very well, but what about her? Mrs.
Burgess, a good sort and no chatterbox, in whom he had confided,
thought this absence of his in England, ostensibly to see lawyers
might serve to make Daisy reconsider, think what it meant. It was a
question of her position, Mrs. Burgess said; the social barrier; giving
up her children. She’d be a widow with a past one of these days,
draggling about in the suburbs, or more likely, indiscriminate (you
know, she said, what such women get like, with too much paint). But
Peter Walsh pooh-poohed all that. He didn’t mean to die yet.
Anyhow she must settle for herself; judge for herself, he thought,
padding about the room in his socks smoothing out his dress-shirt,
for he might go to Clarissa’s party, or he might go to one of the Halls,
or he might settle in and read an absorbing book written by a man he
used to know at Oxford. And if he did retire, that’s what he’d do—
write books. He would go to Oxford and poke about in the Bodleian.
Vainly the dark, adorably pretty girl ran to the end of the terrace;
vainly waved her hand; vainly cried she didn’t care a straw what
people said. There he was, the man she thought the world of, the
perfect gentleman, the fascinating, the distinguished (and his age
made not the least difference to her), padding about a room in an
hotel in Bloomsbury, shaving, washing, continuing, as he took up
cans, put down razors, to poke about in the Bodleian, and get at the
truth about one or two little matters that interested him. And he would
have a chat with whoever it might be, and so come to disregard
more and more precise hours for lunch, and miss engagements, and
when Daisy asked him, as she would, for a kiss, a scene, fail to
come up to the scratch (though he was genuinely devoted to her)—
in short it might be happier, as Mrs. Burgess said, that she should
forget him, or merely remember him as he was in August 1922, like a
figure standing at the cross roads at dusk, which grows more and
more remote as the dog-cart spins away, carrying her securely
fastened to the back seat, though her arms are outstretched, and as
she sees the figure dwindle and disappear still she cries out how she
would do anything in the world, anything, anything, anything....
He never knew what people thought. It became more and more
difficult for him to concentrate. He became absorbed; he became
busied with his own concerns; now surly, now gay; dependent on
women, absent-minded, moody, less and less able (so he thought as
he shaved) to understand why Clarissa couldn’t simply find them a
lodging and be nice to Daisy; introduce her. And then he could just—
just do what? just haunt and hover (he was at the moment actually
engaged in sorting out various keys, papers), swoop and taste, be
alone, in short, sufficient to himself; and yet nobody of course was
more dependent upon others (he buttoned his waistcoat); it had
been his undoing. He could not keep out of smoking-rooms, liked
colonels, liked golf, liked bridge, and above all women’s society, and
the fineness of their companionship, and their faithfulness and
audacity and greatness in loving which though it had its drawbacks
seemed to him (and the dark, adorably pretty face was on top of the
envelopes) so wholly admirable, so splendid a flower to grow on the
crest of human life, and yet he could not come up to the scratch,
being always apt to see round things (Clarissa had sapped
something in him permanently), and to tire very easily of mute
devotion and to want variety in love, though it would make him
furious if Daisy loved anybody else, furious! for he was jealous,
uncontrollably jealous by temperament. He suffered tortures! But
where was his knife; his watch; his seals, his note-case, and
Clarissa’s letter which he would not read again but liked to think of,
and Daisy’s photograph? And now for dinner.
They were eating.
Sitting at little tables round vases, dressed or not dressed, with their
shawls and bags laid beside them, with their air of false composure,
for they were not used to so many courses at dinner, and
confidence, for they were able to pay for it, and strain, for they had
been running about London all day shopping, sightseeing; and their
natural curiosity, for they looked round and up as the nice-looking
gentleman in horn-rimmed spectacles came in, and their good
nature, for they would have been glad to do any little service, such
as lend a time-table or impart useful information, and their desire,
pulsing in them, tugging at them subterraneously, somehow to
establish connections if it were only a birthplace (Liverpool, for
example) in common or friends of the same name; with their furtive
glances, odd silences, and sudden withdrawals into family jocularity
and isolation; there they sat eating dinner when Mr. Walsh came in
and took his seat at a little table by the curtain.
It was not that he said anything, for being solitary he could only
address himself to the waiter; it was his way of looking at the menu,
of pointing his forefinger to a particular wine, of hitching himself up to
the table, of addressing himself seriously, not gluttonously to dinner,
that won him their respect; which, having to remain unexpressed for
the greater part of the meal, flared up at the table where the Morrises
sat when Mr. Walsh was heard to say at the end of the meal, “Bartlett
pears.” Why he should have spoken so moderately yet firmly, with
the air of a disciplinarian well within his rights which are founded
upon justice, neither young Charles Morris, nor old Charles, neither
Miss Elaine nor Mrs. Morris knew. But when he said, “Bartlett pears,”
sitting alone at his table, they felt that he counted on their support in
some lawful demand; was champion of a cause which immediately
became their own, so that their eyes met his eyes sympathetically,
and when they all reached the smoking-room simultaneously, a little
talk between them became inevitable.
It was not very profound—only to the effect that London was
crowded; had changed in thirty years; that Mr. Morris preferred
Liverpool; that Mrs. Morris had been to the Westminster flower-show,
and that they had all seen the Prince of Wales. Yet, thought Peter
Walsh, no family in the world can compare with the Morrises; none
whatever; and their relations to each other are perfect, and they
don’t care a hang for the upper classes, and they like what they like,
and Elaine is training for the family business, and the boy has won a
scholarship at Leeds, and the old lady (who is about his own age)
has three more children at home; and they have two motor cars, but
Mr. Morris still mends the boots on Sunday: it is superb, it is
absolutely superb, thought Peter Walsh, swaying a little backwards
and forwards with his liqueur glass in his hand among the hairy red
chairs and ash-trays, feeling very well pleased with himself, for the
Morrises liked him. Yes, they liked a man who said, “Bartlett pears.”
They liked him, he felt.
He would go to Clarissa’s party. (The Morrises moved off; but they
would meet again.) He would go to Clarissa’s party, because he
wanted to ask Richard what they were doing in India—the
conservative duffers. And what’s being acted? And music.... Oh yes,
and mere gossip.
For this is the truth about our soul, he thought, our self, who fish-like
inhabits deep seas and plies among obscurities threading her way
between the boles of giant weeds, over sun-flickered spaces and on
and on into gloom, cold, deep, inscrutable; suddenly she shoots to
the surface and sports on the wind-wrinkled waves; that is, has a
positive need to brush, scrape, kindle herself, gossiping. What did
the Government mean—Richard Dalloway would know—to do about
India?
Since it was a very hot night and the paper boys went by with
placards proclaiming in huge red letters that there was a heat-wave,
wicker chairs were placed on the hotel steps and there, sipping,
smoking, detached gentlemen sat. Peter Walsh sat there. One might
fancy that day, the London day, was just beginning. Like a woman
who had slipped off her print dress and white apron to array herself
in blue and pearls, the day changed, put off stuff, took gauze,
changed to evening, and with the same sigh of exhilaration that a
woman breathes, tumbling petticoats on the floor, it too shed dust,
heat, colour; the traffic thinned; motor cars, tinkling, darting,
succeeded the lumber of vans; and here and there among the thick
foliage of the squares an intense light hung. I resign, the evening
seemed to say, as it paled and faded above the battlements and
prominences, moulded, pointed, of hotel, flat, and block of shops, I
fade, she was beginning, I disappear, but London would have none
of it, and rushed her bayonets into the sky, pinioned her, constrained
her to partnership in her revelry.
For the great revolution of Mr. Willett’s summer time had taken place
since Peter Walsh’s last visit to England. The prolonged evening was
new to him. It was inspiriting, rather. For as the young people went
by with their despatch-boxes, awfully glad to be free, proud too,
dumbly, of stepping this famous pavement, joy of a kind, cheap,
tinselly, if you like, but all the same rapture, flushed their faces. They
dressed well too; pink stockings; pretty shoes. They would now have
two hours at the pictures. It sharpened, it refined them, the yellow-
blue evening light; and on the leaves in the square shone lurid, livid
—they looked as if dipped in sea water—the foliage of a submerged
city. He was astonished by the beauty; it was encouraging too, for
where the returned Anglo-Indian sat by rights (he knew crowds of
them) in the Oriental Club biliously summing up the ruin of the world,
here was he, as young as ever; envying young people their summer
time and the rest of it, and more than suspecting from the words of a
girl, from a housemaid’s laughter—intangible things you couldn’t lay
your hands on—that shift in the whole pyramidal accumulation which
in his youth had seemed immovable. On top of them it had pressed;
weighed them down, the women especially, like those flowers
Clarissa’s Aunt Helena used to press between sheets of grey
blotting-paper with Littré’s dictionary on top, sitting under the lamp
after dinner. She was dead now. He had heard of her, from Clarissa,
losing the sight of one eye. It seemed so fitting—one of nature’s
masterpieces—that old Miss Parry should turn to glass. She would
die like some bird in a frost gripping her perch. She belonged to a
different age, but being so entire, so complete, would always stand
up on the horizon, stone-white, eminent, like a lighthouse marking
some past stage on this adventurous, long, long voyage, this
interminable (he felt for a copper to buy a paper and read about
Surrey and Yorkshire—he had held out that copper millions of times.
Surrey was all out once more)—this interminable life. But cricket was
no mere game. Cricket was important. He could never help reading
about cricket. He read the scores in the stop press first, then how it
was a hot day; then about a murder case. Having done things
millions of times enriched them, though it might be said to take the
surface off. The past enriched, and experience, and having cared for
one or two people, and so having acquired the power which the
young lack, of cutting short, doing what one likes, not caring a rap
what people say and coming and going without any very great
expectations (he left his paper on the table and moved off), which
however (and he looked for his hat and coat) was not altogether true
of him, not to-night, for here he was starting to go to a party, at his
age, with the belief upon him that he was about to have an
experience. But what?
Beauty anyhow. Not the crude beauty of the eye. It was not beauty
pure and simple—Bedford Place leading into Russell Square. It was
straightness and emptiness of course; the symmetry of a corridor;
but it was also windows lit up, a piano, a gramophone sounding; a
sense of pleasure-making hidden, but now and again emerging
when, through the uncurtained window, the window left open, one
saw parties sitting over tables, young people slowly circling,
conversations between men and women, maids idly looking out (a
strange comment theirs, when work was done), stockings drying on
top ledges, a parrot, a few plants. Absorbing, mysterious, of infinite
richness, this life. And in the large square where the cabs shot and
swerved so quick, there were loitering couples, dallying, embracing,
shrunk up under the shower of a tree; that was moving; so silent, so
absorbed, that one passed, discreetly, timidly, as if in the presence of
some sacred ceremony to interrupt which would have been impious.
That was interesting. And so on into the flare and glare.
His light overcoat blew open, he stepped with indescribable
idiosyncrasy, leant a little forward, tripped, with his hands behind his
back and his eyes still a little hawklike; he tripped through London,
towards Westminster, observing.
Was everybody dining out, then? Doors were being opened here by
a footman to let issue a high-stepping old dame, in buckled shoes,
with three purple ostrich feathers in her hair. Doors were being
opened for ladies wrapped like mummies in shawls with bright
flowers on them, ladies with bare heads. And in respectable quarters
with stucco pillars through small front gardens lightly swathed with
combs in their hair (having run up to see the children), women came;
men waited for them, with their coats blowing open, and the motor
started. Everybody was going out. What with these doors being
opened, and the descent and the start, it seemed as if the whole of
London were embarking in little boats moored to the bank, tossing
on the waters, as if the whole place were floating off in carnival. And
Whitehall was skated over, silver beaten as it was, skated over by
spiders, and there was a sense of midges round the arc lamps; it
was so hot that people stood about talking. And here in Westminster
was a retired Judge, presumably, sitting four square at his house
door dressed all in white. An Anglo-Indian presumably.
And here a shindy of brawling women, drunken women; here only a
policeman and looming houses, high houses, domed houses,
churches, parliaments, and the hoot of a steamer on the river, a
hollow misty cry. But it was her street, this, Clarissa’s; cabs were
rushing round the corner, like water round the piers of a bridge,
drawn together, it seemed to him because they bore people going to
her party, Clarissa’s party.
The cold stream of visual impressions failed him now as if the eye
were a cup that overflowed and let the rest run down its china walls
unrecorded. The brain must wake now. The body must contract now,
entering the house, the lighted house, where the door stood open,
where the motor cars were standing, and bright women descending:
the soul must brave itself to endure. He opened the big blade of his
pocket-knife.

Lucy came running full tilt downstairs, having just nipped in to the
drawing-room to smooth a cover, to straighten a chair, to pause a
moment and feel whoever came in must think how clean, how bright,
how beautifully cared for, when they saw the beautiful silver, the
brass fire-irons, the new chair-covers, and the curtains of yellow
chintz: she appraised each; heard a roar of voices; people already
coming up from dinner; she must fly!
The Prime Minister was coming, Agnes said: so she had heard them
say in the dining-room, she said, coming in with a tray of glasses.
Did it matter, did it matter in the least, one Prime Minister more or
less? It made no difference at this hour of the night to Mrs. Walker
among the plates, saucepans, cullenders, frying-pans, chicken in
aspic, ice-cream freezers, pared crusts of bread, lemons, soup
tureens, and pudding basins which, however hard they washed up in
the scullery seemed to be all on top of her, on the kitchen table, on
chairs, while the fire blared and roared, the electric lights glared, and
still supper had to be laid. All she felt was, one Prime Minister more
or less made not a scrap of difference to Mrs. Walker.
The ladies were going upstairs already, said Lucy; the ladies were
going up, one by one, Mrs. Dalloway walking last and almost always
sending back some message to the kitchen, “My love to Mrs.
Walker,” that was it one night. Next morning they would go over the
dishes—the soup, the salmon; the salmon, Mrs. Walker knew, as
usual underdone, for she always got nervous about the pudding and
left it to Jenny; so it happened, the salmon was always underdone.
But some lady with fair hair and silver ornaments had said, Lucy
said, about the entrée, was it really made at home? But it was the
salmon that bothered Mrs. Walker, as she spun the plates round and
round, and pulled in dampers and pulled out dampers; and there
came a burst of laughter from the dining-room; a voice speaking;
then another burst of laughter—the gentlemen enjoying themselves
when the ladies had gone. The tokay, said Lucy running in. Mr.
Dalloway had sent for the tokay, from the Emperor’s cellars, the
Imperial Tokay.
It was borne through the kitchen. Over her shoulder Lucy reported
how Miss Elizabeth looked quite lovely; she couldn’t take her eyes
off her; in her pink dress, wearing the necklace Mr. Dalloway had
given her. Jenny must remember the dog, Miss Elizabeth’s fox-
terrier, which, since it bit, had to be shut up and might, Elizabeth
thought, want something. Jenny must remember the dog. But Jenny
was not going upstairs with all those people about. There was a
motor at the door already! There was a ring at the bell—and the
gentlemen still in the dining-room, drinking tokay!
There, they were going upstairs; that was the first to come, and now
they would come faster and faster, so that Mrs. Parkinson (hired for
parties) would leave the hall door ajar, and the hall would be full of
gentlemen waiting (they stood waiting, sleeking down their hair)
while the ladies took their cloaks off in the room along the passage;
where Mrs. Barnet helped them, old Ellen Barnet, who had been with
the family for forty years, and came every summer to help the ladies,
and remembered mothers when they were girls, and though very
unassuming did shake hands; said “milady” very respectfully, yet had
a humorous way with her, looking at the young ladies, and ever so
tactfully helping Lady Lovejoy, who had some trouble with her
underbodice. And they could not help feeling, Lady Lovejoy and Miss
Alice, that some little privilege in the matter of brush and comb, was
awarded them having known Mrs. Barnet—“thirty years, milady,”
Mrs. Barnet supplied her. Young ladies did not use to rouge, said
Lady Lovejoy, when they stayed at Bourton in the old days. And Miss
Alice didn’t need rouge, said Mrs. Barnet, looking at her fondly.
There Mrs. Barnet would sit, in the cloakroom, patting down the furs,
smoothing out the Spanish shawls, tidying the dressing-table, and
knowing perfectly well, in spite of the furs and the embroideries,
which were nice ladies, which were not. The dear old body, said
Lady Lovejoy, mounting the stairs, Clarissa’s old nurse.
And then Lady Lovejoy stiffened. “Lady and Miss Lovejoy,” she said
to Mr. Wilkins (hired for parties). He had an admirable manner, as he
bent and straightened himself, bent and straightened himself and
announced with perfect impartiality “Lady and Miss Lovejoy ... Sir
John and Lady Needham ... Miss Weld ... Mr. Walsh.” His manner
was admirable; his family life must be irreproachable, except that it
seemed impossible that a being with greenish lips and shaven
cheeks could ever have blundered into the nuisance of children.
“How delightful to see you!” said Clarissa. She said it to every one.
How delightful to see you! She was at her worst—effusive, insincere.
It was a great mistake to have come. He should have stayed at
home and read his book, thought Peter Walsh; should have gone to
a music hall; he should have stayed at home, for he knew no one.
Oh dear, it was going to be a failure; a complete failure, Clarissa felt
it in her bones as dear old Lord Lexham stood there apologising for
his wife who had caught cold at the Buckingham Palace garden
party. She could see Peter out of the tail of her eye, criticising her,
there, in that corner. Why, after all, did she do these things? Why
seek pinnacles and stand drenched in fire? Might it consume her
anyhow! Burn her to cinders! Better anything, better brandish one’s
torch and hurl it to earth than taper and dwindle away like some Ellie
Henderson! It was extraordinary how Peter put her into these states
just by coming and standing in a corner. He made her see herself;
exaggerate. It was idiotic. But why did he come, then, merely to
criticise? Why always take, never give? Why not risk one’s one little
point of view? There he was wandering off, and she must speak to
him. But she would not get the chance. Life was that—humiliation,
renunciation. What Lord Lexham was saying was that his wife would
not wear her furs at the garden party because “my dear, you ladies
are all alike”—Lady Lexham being seventy-five at least! It was
delicious, how they petted each other, that old couple. She did like
old Lord Lexham. She did think it mattered, her party, and it made
her feel quite sick to know that it was all going wrong, all falling flat.
Anything, any explosion, any horror was better than people
wandering aimlessly, standing in a bunch at a corner like Ellie
Henderson, not even caring to hold themselves upright.
Gently the yellow curtain with all the birds of Paradise blew out and it
seemed as if there were a flight of wings into the room, right out,
then sucked back. (For the windows were open.) Was it draughty,
Ellie Henderson wondered? She was subject to chills. But it did not
matter that she should come down sneezing to-morrow; it was the
girls with their naked shoulders she thought of, being trained to think
of others by an old father, an invalid, late vicar of Bourton, but he
was dead now; and her chills never went to her chest, never. It was
the girls she thought of, the young girls with their bare shoulders, she
herself having always been a wisp of a creature, with her thin hair
and meagre profile; though now, past fifty, there was beginning to
shine through some mild beam, something purified into distinction by
years of self-abnegation but obscured again, perpetually, by her
distressing gentility, her panic fear, which arose from three hundred
pounds’ income, and her weaponless state (she could not earn a
penny) and it made her timid, and more and more disqualified year
by year to meet well-dressed people who did this sort of thing every
night of the season, merely telling their maids “I’ll wear so and so,”
whereas Ellie Henderson ran out nervously and bought cheap pink
flowers, half a dozen, and then threw a shawl over her old black
dress. For her invitation to Clarissa’s party had come at the last
moment. She was not quite happy about it. She had a sort of feeling
that Clarissa had not meant to ask her this year.
Why should she? There was no reason really, except that they had
always known each other. Indeed, they were cousins. But naturally
they had rather drifted apart, Clarissa being so sought after. It was
an event to her, going to a party. It was quite a treat just to see the
lovely clothes. Wasn’t that Elizabeth, grown up, with her hair done in
the fashionable way, in the pink dress? Yet she could not be more
than seventeen. She was very, very handsome. But girls when they
first came out didn’t seem to wear white as they used. (She must
remember everything to tell Edith.) Girls wore straight frocks,
perfectly tight, with skirts well above the ankles. It was not becoming,
she thought.
So, with her weak eyesight, Ellie Henderson craned rather forward,
and it wasn’t so much she who minded not having any one to talk to
(she hardly knew anybody there), for she felt that they were all such
interesting people to watch; politicians presumably; Richard
Dalloway’s friends; but it was Richard himself who felt that he could
not let the poor creature go on standing there all the evening by
herself.
“Well, Ellie, and how’s the world treating you?” he said in his genial
way, and Ellie Henderson, getting nervous and flushing and feeling
that it was extraordinarily nice of him to come and talk to her, said
that many people really felt the heat more than the cold.
“Yes, they do,” said Richard Dalloway. “Yes.”
But what more did one say?
“Hullo, Richard,” said somebody, taking him by the elbow, and, good
Lord, there was old Peter, old Peter Walsh. He was delighted to see
him—ever so pleased to see him! He hadn’t changed a bit. And off
they went together walking right across the room, giving each other
little pats, as if they hadn’t met for a long time, Ellie Henderson
thought, watching them go, certain she knew that man’s face. A tall
man, middle aged, rather fine eyes, dark, wearing spectacles, with a
look of John Burrows. Edith would be sure to know.
The curtain with its flight of birds of Paradise blew out again. And
Clarissa saw—she saw Ralph Lyon beat it back, and go on talking.
So it wasn’t a failure after all! it was going to be all right now—her
party. It had begun. It had started. But it was still touch and go. She
must stand there for the present. People seemed to come in a rush.
Colonel and Mrs. Garrod ... Mr. Hugh Whitbread ... Mr. Bowley ...
Mrs. Hilbery ... Lady Mary Maddox ... Mr. Quin ... intoned Wilkin. She
had six or seven words with each, and they went on, they went into
the rooms; into something now, not nothing, since Ralph Lyon had
beat back the curtain.
And yet for her own part, it was too much of an effort. She was not
enjoying it. It was too much like being—just anybody, standing there;
anybody could do it; yet this anybody she did a little admire, couldn’t
help feeling that she had, anyhow, made this happen, that it marked
a stage, this post that she felt herself to have become, for oddly
enough she had quite forgotten what she looked like, but felt herself
a stake driven in at the top of her stairs. Every time she gave a party
she had this feeling of being something not herself, and that every
one was unreal in one way; much more real in another. It was, she
thought, partly their clothes, partly being taken out of their ordinary
ways, partly the background, it was possible to say things you
couldn’t say anyhow else, things that needed an effort; possible to
go much deeper. But not for her; not yet anyhow.
“How delightful to see you!” she said. Dear old Sir Harry! He would
know every one.
And what was so odd about it was the sense one had as they came
up the stairs one after another, Mrs. Mount and Celia, Herbert Ainsty,
Mrs. Dakers—oh and Lady Bruton!
“How awfully good of you to come!” she said, and she meant it—it
was odd how standing there one felt them going on, going on, some
quite old, some....
What name? Lady Rosseter? But who on earth was Lady Rosseter?
“Clarissa!” That voice! It was Sally Seton! Sally Seton! after all these
years! She loomed through a mist. For she hadn’t looked like that,
Sally Seton, when Clarissa grasped the hot water can, to think of her
under this roof, under this roof! Not like that!
All on top of each other, embarrassed, laughing, words tumbled out
—passing through London; heard from Clara Haydon; what a chance
of seeing you! So I thrust myself in—without an invitation....
One might put down the hot water can quite composedly. The lustre
had gone out of her. Yet it was extraordinary to see her again, older,
happier, less lovely. They kissed each other, first this cheek then
that, by the drawing-room door, and Clarissa turned, with Sally’s
hand in hers, and saw her rooms full, heard the roar of voices, saw
the candlesticks, the blowing curtains, and the roses which Richard
had given her.
“I have five enormous boys,” said Sally.
She had the simplest egotism, the most open desire to be thought
first always, and Clarissa loved her for being still like that. “I can’t
believe it!” she cried, kindling all over with pleasure at the thought of
the past.
But alas, Wilkins; Wilkins wanted her; Wilkins was emitting in a voice
of commanding authority as if the whole company must be
admonished and the hostess reclaimed from frivolity, one name:
“The Prime Minister,” said Peter Walsh.
The Prime Minister? Was it really? Ellie Henderson marvelled. What
a thing to tell Edith!
One couldn’t laugh at him. He looked so ordinary. You might have
stood him behind a counter and bought biscuits—poor chap, all
rigged up in gold lace. And to be fair, as he went his rounds, first with
Clarissa then with Richard escorting him, he did it very well. He tried
to look somebody. It was amusing to watch. Nobody looked at him.
They just went on talking, yet it was perfectly plain that they all knew,
felt to the marrow of their bones, this majesty passing; this symbol of
what they all stood for, English society. Old Lady Bruton, and she
looked very fine too, very stalwart in her lace, swam up, and they
withdrew into a little room which at once became spied upon,
guarded, and a sort of stir and rustle rippled through every one,
openly: the Prime Minister!
Lord, lord, the snobbery of the English! thought Peter Walsh,
standing in the corner. How they loved dressing up in gold lace and
doing homage! There! That must be, by Jove it was, Hugh
Whitbread, snuffing round the precincts of the great, grown rather
fatter, rather whiter, the admirable Hugh!
He looked always as if he were on duty, thought Peter, a privileged,
but secretive being, hoarding secrets which he would die to defend,
though it was only some little piece of tittle-tattle dropped by a court
footman, which would be in all the papers to-morrow. Such were his
rattles, his baubles, in playing with which he had grown white, come
to the verge of old age, enjoying the respect and affection of all who
had the privilege of knowing this type of the English public school
man. Inevitably one made up things like that about Hugh; that was
his style; the style of those admirable letters which Peter had read
thousands of miles across the sea in the Times, and had thanked
God he was out of that pernicious hubble-bubble if it were only to
hear baboons chatter and coolies beat their wives. An olive-skinned
youth from one of the Universities stood obsequiously by. Him he
would patronise, initiate, teach how to get on. For he liked nothing
better than doing kindnesses, making the hearts of old ladies
palpitate with the joy of being thought of in their age, their affliction,
thinking themselves quite forgotten, yet here was dear Hugh driving
up and spending an hour talking of the past, remembering trifles,
praising the home-made cake, though Hugh might eat cake with a
Duchess any day of his life, and, to look at him, probably did spend a
good deal of time in that agreeable occupation. The All-judging, the
All-merciful, might excuse. Peter Walsh had no mercy. Villains there
must be, and God knows the rascals who get hanged for battering
the brains of a girl out in a train do less harm on the whole than
Hugh Whitbread and his kindness. Look at him now, on tiptoe,
dancing forward, bowing and scraping, as the Prime Minister and
Lady Bruton emerged, intimating for all the world to see that he was
privileged to say something, something private, to Lady Bruton as
she passed. She stopped. She wagged her fine old head. She was
thanking him presumably for some piece of servility. She had her
toadies, minor officials in Government offices who ran about putting
through little jobs on her behalf, in return for which she gave them
luncheon. But she derived from the eighteenth century. She was all
right.
And now Clarissa escorted her Prime Minister down the room,
prancing, sparkling, with the stateliness of her grey hair. She wore
ear-rings, and a silver-green mermaid’s dress. Lolloping on the
waves and braiding her tresses she seemed, having that gift still; to
be; to exist; to sum it all up in the moment as she passed; turned,
caught her scarf in some other woman’s dress, unhitched it, laughed,
all with the most perfect ease and air of a creature floating in its
element. But age had brushed her; even as a mermaid might behold
in her glass the setting sun on some very clear evening over the
waves. There was a breath of tenderness; her severity, her prudery,
her woodenness were all warmed through now, and she had about
her as she said good-bye to the thick gold-laced man who was doing
his best, and good luck to him, to look important, an inexpressible
dignity; an exquisite cordiality; as if she wished the whole world well,
and must now, being on the very verge and rim of things, take her
leave. So she made him think. (But he was not in love.)
Indeed, Clarissa felt, the Prime Minister had been good to come.
And, walking down the room with him, with Sally there and Peter
there and Richard very pleased, with all those people rather inclined,
perhaps, to envy, she had felt that intoxication of the moment, that
dilatation of the nerves of the heart itself till it seemed to quiver,
steeped, upright;—yes, but after all it was what other people felt,
that; for, though she loved it and felt it tingle and sting, still these
semblances, these triumphs (dear old Peter, for example, thinking
her so brilliant), had a hollowness; at arm’s length they were, not in
the heart; and it might be that she was growing old but they satisfied
her no longer as they used; and suddenly, as she saw the Prime
Minister go down the stairs, the gilt rim of the Sir Joshua picture of
the little girl with a muff brought back Kilman with a rush; Kilman her
enemy. That was satisfying; that was real. Ah, how she hated her—
hot, hypocritical, corrupt; with all that power; Elizabeth’s seducer; the
woman who had crept in to steal and defile (Richard would say,
What nonsense!). She hated her: she loved her. It was enemies one
wanted, not friends—not Mrs. Durrant and Clara, Sir William and
Lady Bradshaw, Miss Truelock and Eleanor Gibson (whom she saw
coming upstairs). They must find her if they wanted her. She was for
the party!
There was her old friend Sir Harry.
“Dear Sir Harry!” she said, going up to the fine old fellow who had
produced more bad pictures than any other two Academicians in the
whole of St. John’s Wood (they were always of cattle, standing in
sunset pools absorbing moisture, or signifying, for he had a certain
range of gesture, by the raising of one foreleg and the toss of the
antlers, “the Approach of the Stranger”—all his activities, dining out,
racing, were founded on cattle standing absorbing moisture in sunset
pools).
“What are you laughing at?” she asked him. For Willie Titcomb and
Sir Harry and Herbert Ainsty were all laughing. But no. Sir Harry
could not tell Clarissa Dalloway (much though he liked her; of her
type he thought her perfect, and threatened to paint her) his stories
of the music hall stage. He chaffed her about her party. He missed
his brandy. These circles, he said, were above him. But he liked her;
respected her, in spite of her damnable, difficult upper-class
refinement, which made it impossible to ask Clarissa Dalloway to sit
on his knee. And up came that wandering will-o’-the-wisp, that
vagulous phosphorescence, old Mrs. Hilbery, stretching her hands to
the blaze of his laughter (about the Duke and the Lady), which, as
she heard it across the room, seemed to reassure her on a point
which sometimes bothered her if she woke early in the morning and
did not like to call her maid for a cup of tea; how it is certain we must
die.
“They won’t tell us their stories,” said Clarissa.
“Dear Clarissa!” exclaimed Mrs. Hilbery. She looked to-night, she
said, so like her mother as she first saw her walking in a garden in a
grey hat.
And really Clarissa’s eyes filled with tears. Her mother, walking in a
garden! But alas, she must go.
For there was Professor Brierly, who lectured on Milton, talking to
little Jim Hutton (who was unable even for a party like this to
compass both tie and waistcoat or make his hair lie flat), and even at
this distance they were quarrelling, she could see. For Professor
Brierly was a very queer fish. With all those degrees, honours,
lectureships between him and the scribblers he suspected instantly
an atmosphere not favourable to his queer compound; his prodigious
learning and timidity; his wintry charm without cordiality; his
innocence blent with snobbery; he quivered if made conscious by a
lady’s unkempt hair, a youth’s boots, of an underworld, very
creditable doubtless, of rebels, of ardent young people; of would-be
geniuses, and intimated with a little toss of the head, with a sniff—
Humph!—the value of moderation; of some slight training in the
classics in order to appreciate Milton. Professor Brierly (Clarissa
could see) wasn’t hitting it off with little Jim Hutton (who wore red
socks, his black being at the laundry) about Milton. She interrupted.
She said she loved Bach. So did Hutton. That was the bond between
them, and Hutton (a very bad poet) always felt that Mrs. Dalloway
was far the best of the great ladies who took an interest in art. It was
odd how strict she was. About music she was purely impersonal.
She was rather a prig. But how charming to look at! She made her
house so nice if it weren’t for her Professors. Clarissa had half a
mind to snatch him off and set him down at the piano in the back
room. For he played divinely.
“But the noise!” she said. “The noise!”
“The sign of a successful party.” Nodding urbanely, the Professor
stepped delicately off.
“He knows everything in the whole world about Milton,” said Clarissa.
“Does he indeed?” said Hutton, who would imitate the Professor
throughout Hampstead; the Professor on Milton; the Professor on
moderation; the Professor stepping delicately off.
But she must speak to that couple, said Clarissa, Lord Gayton and
Nancy Blow.
Not that they added perceptibly to the noise of the party. They were
not talking (perceptibly) as they stood side by side by the yellow
curtains. They would soon be off elsewhere, together; and never had
very much to say in any circumstances. They looked; that was all.
That was enough. They looked so clean, so sound, she with an
apricot bloom of powder and paint, but he scrubbed, rinsed, with the
eyes of a bird, so that no ball could pass him or stroke surprise him.
He struck, he leapt, accurately, on the spot. Ponies’ mouths quivered
at the end of his reins. He had his honours, ancestral monuments,
banners hanging in the church at home. He had his duties; his
tenants; a mother and sisters; had been all day at Lords, and that
was what they were talking about—cricket, cousins, the movies—
when Mrs. Dalloway came up. Lord Gayton liked her most awfully.
So did Miss Blow. She had such charming manners.
“It is angelic—it is delicious of you to have come!” she said. She
loved Lords; she loved youth, and Nancy, dressed at enormous
expense by the greatest artists in Paris, stood there looking as if her
body had merely put forth, of its own accord, a green frill.
“I had meant to have dancing,” said Clarissa.
For the young people could not talk. And why should they? Shout,
embrace, swing, be up at dawn; carry sugar to ponies; kiss and
caress the snouts of adorable chows; and then all tingling and
streaming, plunge and swim. But the enormous resources of the
English language, the power it bestows, after all, of communicating
feelings (at their age, she and Peter would have been arguing all the
evening), was not for them. They would solidify young. They would
be good beyond measure to the people on the estate, but alone,
perhaps, rather dull.
“What a pity!” she said. “I had hoped to have dancing.”
It was so extraordinarily nice of them to have come! But talk of
dancing! The rooms were packed.
There was old Aunt Helena in her shawl. Alas, she must leave them
—Lord Gayton and Nancy Blow. There was old Miss Parry, her aunt.
For Miss Helena Parry was not dead: Miss Parry was alive. She was
past eighty. She ascended staircases slowly with a stick. She was
placed in a chair (Richard had seen to it). People who had known
Burma in the ’seventies were always led up to her. Where had Peter
got to? They used to be such friends. For at the mention of India, or
even Ceylon, her eyes (only one was glass) slowly deepened,
became blue, beheld, not human beings—she had no tender
memories, no proud illusions about Viceroys, Generals, Mutinies—it
was orchids she saw, and mountain passes and herself carried on
the backs of coolies in the ’sixties over solitary peaks; or descending
to uproot orchids (startling blossoms, never beheld before) which
she painted in water-colour; an indomitable Englishwoman, fretful if
disturbed by the War, say, which dropped a bomb at her very door,
from her deep meditation over orchids and her own figure journeying
in the ’sixties in India—but here was Peter.
“Come and talk to Aunt Helena about Burma,” said Clarissa.
And yet he had not had a word with her all the evening!
“We will talk later,” said Clarissa, leading him up to Aunt Helena, in
her white shawl, with her stick.
“Peter Walsh,” said Clarissa.
That meant nothing.
Clarissa had asked her. It was tiring; it was noisy; but Clarissa had
asked her. So she had come. It was a pity that they lived in London
—Richard and Clarissa. If only for Clarissa’s health it would have
been better to live in the country. But Clarissa had always been fond
of society.
“He has been in Burma,” said Clarissa.
Ah. She could not resist recalling what Charles Darwin had said
about her little book on the orchids of Burma.
(Clarissa must speak to Lady Bruton.)
No doubt it was forgotten now, her book on the orchids of Burma, but
it went into three editions before 1870, she told Peter. She
remembered him now. He had been at Bourton (and he had left her,
Peter Walsh remembered, without a word in the drawing-room that
night when Clarissa had asked him to come boating).
“Richard so much enjoyed his lunch party,” said Clarissa to Lady
Bruton.
“Richard was the greatest possible help,” Lady Bruton replied. “He
helped me to write a letter. And how are you?”
“Oh, perfectly well!” said Clarissa. (Lady Bruton detested illness in
the wives of politicians.)
“And there’s Peter Walsh!” said Lady Bruton (for she could never
think of anything to say to Clarissa; though she liked her. She had
lots of fine qualities; but they had nothing in common—she and
Clarissa. It might have been better if Richard had married a woman
with less charm, who would have helped him more in his work. He
had lost his chance of the Cabinet). “There’s Peter Walsh!” she said,
shaking hands with that agreeable sinner, that very able fellow who
should have made a name for himself but hadn’t (always in
difficulties with women), and, of course, old Miss Parry. Wonderful
old lady!
Lady Bruton stood by Miss Parry’s chair, a spectral grenadier,
draped in black, inviting Peter Walsh to lunch; cordial; but without
small talk, remembering nothing whatever about the flora or fauna of
India. She had been there, of course; had stayed with three
Viceroys; thought some of the Indian civilians uncommonly fine
fellows; but what a tragedy it was—the state of India! The Prime
Minister had just been telling her (old Miss Parry huddled up in her
shawl, did not care what the Prime Minister had just been telling
her), and Lady Bruton would like to have Peter Walsh’s opinion, he
being fresh from the centre, and she would get Sir Sampson to meet
him, for really it prevented her from sleeping at night, the folly of it,
the wickedness she might say, being a soldier’s daughter. She was
an old woman now, not good for much. But her house, her servants,
her good friend Milly Brush—did he remember her?—were all there
only asking to be used if—if they could be of help, in short. For she
never spoke of England, but this isle of men, this dear, dear land,
was in her blood (without reading Shakespeare), and if ever a