14 DAY TRIAL // Hiding data in plain sight is not a difficult task these days, especially if you are familiar with digital steganography and the programs capable to mask information into a regular file.
This sort of applications allows you to insert a file of any kind into an image or audio item. The structure of the original file is not affected in any way, so it can be opened with any program that supports it. Generally, the only tell is the size of the resulting file.
OpenPuff is part of this category of software, but it is more complex from a security standpoint; also, it has support for more file formats as carriers than many of the applications of the same feather we’ve tested.
It is absolutely free of charge and you do not have to install it because it is portable. Looks are far from impressive, but in this case it is functionality that counts most. The interface is straightforward and offers access to the main features: steganography (hide or reveal data) and signing of the carrier file (volatile marking).
The list of supported carriers includes images (BMP, JPG, PCX, PNG, TGA), audio files (AIFF, MP3, NEXT/SUN, WAV), video (3GP, FLV, MP4, MPG, SWF, VOB) and PDFs.
Setting a protective password for the hidden data is the first step in the procedure. You get to set as much as three countersigns (minimum 8 characters, maximum 32 characters) if you want; however, two of them are optional.
The size of the injected file is quite important because each carrier can store only a certain amount of data. But OpenPuff offers the possibility to hide as much as 256MB in multiple files (carrier chain). The amount of data you can hide is available in the lower part of the “Carrier selection” panel.
This can also be adjusted from the fourth step of the data hiding procedure (“Bit selection options”). The application provides the possibility to choose the amount of bits to be used by the carrier to obfuscate information. OpenPuff presents such options for all supported carrier formats.
One of the main advantages in OpenPuff is support for deniable steganography. This feature allows you to protect sensitive information by adding less important data as a decoy. Thus, even if someone manages to find out you’re hiding something in a file, you can easily give up the less sensitive information and protect the real file.
Obviously, the decoy file has to be password-protected in order to keep all suspicion at bay, and the same three-countersign option is available.
Hiding information in various files is not the only form of protection. Before being obfuscated, the data is not only encrypted, scrambled, whitened and encoded.
According to OpenPuff documentation, the data is first encrypted with the two 256-bit keys, using multi-cryptography. Next, everything is scrambled so that any data stream pattern is eliminated.
Another step is whitening the data, which means mixing it with random noise. On top of all this, OpenPuff encodes the data that also involves using bits from the original carrier as input. Only after all this takes place, is the processed stream injected into the carriers.
All carriers can be signed so that the receiver knows that they come from the source they expected. The mark is absolutely invisible, but it is out in the open because it is not protected in any way. This means that anyone can load a watermarked file in OpenPuff and check it out.
OpenPuff does have a learning curve, especially for beginner users and if you take a look in the documentation file, but it is not rocket science to work with.
Novices might have trouble with revealing the data because the carriers need to be in the same order they were when they received the information. For more advanced users, OpenPuff is the perfect solution for hiding data.
Hiding the information takes a while to complete because the application has to analyze the carriers first and then process the data (encryption, scrambling, etc.), but these steps are absolutely necessary in order to reach the best steganography results.
The Good
The information can be protected by a total of three passwords and the data is encrypted (multi-cryptography), scrambled and whitened in order to eliminate any suspicion. Also, it allows you to add a decoy file.
