Probabilistically detecting steganography within MP3 files

A powerful application named MP3Stegazaurus was recently created by Illinois Institute of Technology (IIT) student Mikhail Zaturenskiy which exploits a not-so-well-known feature present in MP3 files. [8] By overwriting areas that are either skipped or ignored by MP3 playing and decoding applications, MP3Stegazaurus can use any MP3 file to safely store covert information in a manner that is difficult, if not impossible, for the average user to detect. This is especially true since it leaves an MP3 file's audio information untouched. As a result of research and work which took place during the first half of a student project, the author developed MP3StegDetector; an application which examines the interesting, non-audio-information-containing portions of MP3 files in order to determine and report whether, and where, steganography may be present. In addition to detecting the potential presence of steganography, MP3StegDetector extracts and outputs the information contained within each of the interesting portions of a given MP3 file. If a complete file such as a JPEG image, PDF document, or AES-encrypted file is identified within this extracted information, MP3StegDetector will extract and recompose it. In order to determine exactly where in MP3 files these interesting portions exist, the author carried out extensive research on the MP3 file's post-encoding format. This research is included in this document along with details of how MP3StegDetector's various scanning functions and features have been implemented.