Hiding secrets inside photographs with php

Question

I have created a service that hides text inside photographs. For example:

$img_name = "myimage.jpeg";
$orig_contents = file_get_contents($img_name);
$msg = "My secret.";

$fp = fopen($img_name, "wb"); 
fwrite($fp, $orig_contents . $msg); 
fclose($fp); 

I'm curious: How much information can I hide inside photographs using this method? For example, could I embed chapters of a novel in an image file? I have added fairly large blocks of text without corrupting the image, but I'm wondering if PHP or image viewing applications impose limits on this.

(P.S. I am aware that this type of steganography is insecure; I'm just doing this for fun.)

Answer 1

You should take a look at Steganography. And be aware you are not hidding your data in the image. Anyone who could open the image with a text editor would see your text somewhere in the file (in this case, in the end, which is much worse). If I were you, I'd do the following:

1. Encrypt your data with some decent Algorithm and a strong key
2. Create a function that distributes your data through the file in a pseudo-random way, so that anyone would note that you're trying to put something secret in it (be aware you have to recover it afterwards). In a regular bitmap image, you can use the last bit of each pixel to save your information, since this change made by it would not be perceived by human eye, if you compared the original image with the one that has hidden data.
3. Pray NSA isn't reading this, otherwise you can get some serious trouble :)

Answer 2

No, there's essentially no limit imposed by either PHP or the JPEG format on how much data you'll be able to add to an image using this method. This works because the JPEG format stores all of the image data at the beginning of the file until some marker. After the marker, any data is assumed to be something else like a thumbnail, for example.

One cool trick (that also works with GIF images) is that you can append a ZIP file to the end of an image and the file works as both a JPEG and a ZIP file. It will be readable by both image processing programs or ZIP programs just by changing the file extension.

Answer 3

I think this is not the most secure way to do it, if you really want to hide string into an image, you will probably use a specific pattern to change a pixel every 10 pixels, the idea is simple convert your image to an array of integer, loop through the array and every 10 pixels change the value to the ascii character number.

Changing 1 each 10 pixel won't make a lot of noise.

To make it more secure use encoding, so use your own map to encode ascii, like @fvdalcin proposed.