Traffic Analysis Attacks on a Continuously-Observable Steganographic File System

These attacks are highly effective in detecting file updates and revealing the existence and location of files and suggest that simple randomization techniques are not sufficient to protect steganographic file systems from traffic analysis attacks.

Abstract

A continuously-observable steganographic file system allows to remotely store user files on a raw storage device; the security goal is to offer plausible deniability even when the raw storage device is continuously monitored by an attacker. Zhou, Pang and Tan have proposed such a system in [7] with a claim of provable security against traffic analysis. In this paper, we disprove their claims by presenting traffic analysis attacks on the file update algorithm of Zhou et al. Our attacks are highly effective in detecting file updates and revealing the existence and location of files. For multi-block files, we show that two updates are sufficient to discover the file. One-block files accessed a sufficient number of times can also be revealed. Our results suggest that simple randomization techniques are not sufficient to protect steganographic file systems from traffic analysis attacks. © 2008 Springer-Verlag Berlin Heidelberg.