Multimedia Security & Forensics (CY-702 (D)) - Unit 1 Short Notes

UNIT 1: Foundations of Multimedia Security and Forensics

I. Fundamentals of Multimedia Systems

Compression Techniques

• Discrete Cosine Transform (DCT):

  • Converts spatial domain pixel data into frequency domain.

  • High-frequency components (details) are quantized coarsely → lossy compression.

  • Core of JPEG, MPEG standards.

  • Why lossy? Human vision less sensitive to high-frequency loss; enables high compression ratios.

• Lossy Compression Characteristics:

  • Irreversible data loss.

  • High compression efficiency.

  • Quality degradation at high compression ratios.

Interdisciplinary Industry Landscape

• Industry Convergence: Telecom, computing, entertainment, and publishing firms merge to offer end-to-end multimedia solutions.

• Examples:

  • Apple (hardware + software + content via iTunes/App Store).

  • Amazon (e-commerce + AWS + Prime Video).

  • Disney+ (content + streaming tech).

Virtual Reality as Multimedia Application

• Aspects:

  • Immersion: 3D audio/visuals, haptic feedback.

  • Interactivity: Real-time user input affects environment.

  • Presence: Feeling of "being there" via head-mounted displays.

  • Synchronization: Multi-sensory data alignment (audio/video/haptic).

Quality of Service (QoS) in Multimedia Delivery

• Factors Affecting QoS:

  • Bandwidth, latency, jitter, packet loss.

  • Codec efficiency, synchronization accuracy.

• Resource Management for QoS:

  • Types of Managed Resources:

    • CPU (encoding/decoding), memory (buffering), network bandwidth, disk I/O.

  • Techniques: Traffic shaping, priority queuing, admission control.

Operating System Resource Management

• Layered Architecture:

  • Hardware → Kernel → System Libraries → Shell/Applications.

  • Each layer abstracts complexity, provides services (e.g., device drivers manage hardware).

• Examples:

  • Windows: HAL (Hardware Abstraction Layer), kernel-mode drivers.

  • Linux: System call interface, VFS (Virtual File System).

Multimedia Communication Protocols

• Key Protocols:

  • RTP/RTCP: Real-time transport (audio/video) and control.

  • RTSP: Streaming control (play/pause).

  • HTTP/HTTPS: Progressive download, adaptive streaming (HLS/DASH).

  • SIP: Session initiation for VoIP/video calls.

[!TIP]

Exam Focus: DCT’s role in lossiness, QoS factors, OS layers, and RTP/RTSP are frequently asked. Distinguish RTP (data) from RTCP (control).

II. Security Threats and Attacks in Multimedia Systems

Classification of Attacks

• Active Attacks: Modify/inject data (e.g., content tampering, DoS).

• Passive Attacks: Eavesdrop/monitor (e.g., traffic sniffing, metadata analysis).

Web Application Security

• SQL Injection:

  • Primary Risk: Unauthorized data access, modification, or deletion from database.

  • Example: ' OR '1'='1 bypasses authentication.

• HTTP Strict Transport Security (HSTS):

  • Forces HTTPS connections → prevents SSL stripping MITM attacks.

  • Critical for protecting streaming credentials and payment data.

Wireless Network Security

• Packet Sniffing:

  • Captures wireless frames to analyze traffic, extract credentials, or reconstruct media streams.

  • Tools: Wireshark, Aircrack-ng.

• Social Engineering Tactics:

  1. Rogue Access Points (evil twin).

  2. Phishing for Wi-Fi credentials.

  3. Pretexting (posing as IT support).

Social Engineering Mitigation

• Employee Training Programs:

  • Simulated phishing exercises.

  • Security awareness workshops.

  • Clear reporting policies for suspicious activities.

[!TIP]

Common Pitfall: Confusing active (data alteration) vs passive (eavesdropping) attacks. SQLi’s risk is data breach, not just service disruption.

III. Authentication and Watermarking for Multimedia

Importance of Multimedia Authentication

• Ensuring Content Integrity: Detect tampering (e.g., edited video, forged audio).

• Authentication Mechanisms:

  • Digital signatures (hash + asymmetric encryption).

  • Watermarking (robust/fragile).

  • Digital certificates (for source verification).

Watermarking Techniques

Scenario-Based Selection Factors

[!TIP]

Exam Strategy: For watermarking scenarios, weigh aesthetic impact vs protection needs. Stock photos prioritize quality → invisible; portfolios prioritize deterrence → visible.

IV. Digital Forensics for Multimedia

Digital Evidence Extraction

1. Identification: Recognize potential evidence (files, logs).

2. Preservation: Create forensic image (bit-by-bit copy); hash verification (SHA-256).

3. Acquisition: Use write-blockers; collect volatile data (RAM).

4. Examination: Analyze with tools (e.g., EnCase, FTK).

5. Analysis: Reconstruct events, detect anomalies.

6. Presentation: Document chain of custody; expert testimony.

Forensic Tools:

• General: EnCase, FTK, Autopsy.

• Multimedia: Mediology Forensics, Amped FIVE (video), Audacity (audio), ExifTool (metadata).

Metadata in Digital Forensics

• Significance:

  • Authentication: EXIF data (camera model, timestamps) verifies source.

  • Analysis: GPS coordinates, editing software traces (e.g., Adobe Photoshop history).

  • Tamper Detection: Inconsistent timestamps or missing metadata flags manipulation.

Printer and Scanner Forensics

• Role in Risk Mitigation:

  • Identify device signatures (dot patterns, banding) → trace document origin.

  • Detect forgery (e.g., scanned signatures vs printed).

• Case Study: United States v. Darryl (2008):

  • Forged check examined; scanner artifacts revealed non-original creation.

  • Printer model identified from halftone patterns → linked to defendant’s office.

Audio Forensics

• Authentication & Validation:

  • Spectrogram Analysis: Detect edits, noise inconsistencies.

  • Voice Identification: Compare formant frequencies, cadence.

  • Legal Context: Chain of custody, tool validation (e.g., Oxygen Forensic Detective), expert certification (ACE, IAI).

Computer Forensics: Scope and Necessity

• Scope: Investigation of digital devices (computers, mobile, IoT) for evidence.

• Necessity:

  • Cybercrime (hacking, fraud).

  • Incident response (data breaches).

  • Legal compliance (e.g., GDPR, HIPAA).

Multimedia Content Forensics

• Techniques:

  • Error Level Analysis (ELA): Highlights compression inconsistencies → tampering.

  • Copy-Move Detection: Identifies duplicated regions (forgeries).

  • Lighting/Shadow Analysis: Inconsistencies indicate compositing.

• Applications: Deepfake detection, copyright infringement, news verification.

[!TIP]

Key Tools: ExifTool for metadata, Amped FIVE for video. Always maintain chain of custody—court admissibility depends on it.

V. Penetration Testing for Multimedia Systems

Legal and Ethical Considerations

• Impact on Organizational Decision-Making:

  • Risk of Lawsuits: Unauthorized testing = illegal (CFAA, GDPR fines).

  • Authorization: Signed "Get Out of Jail Free" (GOJF) agreement mandatory.

  • Reputation: Accidental service disruption damages trust.

  • Ethical Boundaries: No data exfiltration beyond proof-of-concept.

Penetration Testing Types

Reconnaissance Phase

• DNS Reconnaissance Purpose:

  • Map external attack surface: subdomains, IP ranges, mail servers.

  • Tools: dig, nslookup, Sublist3r, Shodan.

• Target System Architecture Analysis:

  • Identify OS, frameworks, versions → tailor exploits (e.g., Windows vs Linux payloads).

Vulnerability Assessment

• Scanning Tools and Techniques:

  • Network: Nmap (port scanning), Nessus, OpenVAS.

  • Web: Burp Suite, OWASP ZAP (SQLi, XSS scanning).

• Exploitation Considerations:

  • Architecture-Dependent: 32-bit vs 64-bit shellcode; Windows vs Linux commands.

Wireless Penetration Testing

• Specific Techniques and Tools:

  • Packet Injection: Aircrack-ng suite (aireplay-ng deauth attacks).

  • WPA/WPA2 Cracking: Handshake capture (airodump-ng), brute-force (hashcat).

  • Rogue APs: Create fake hotspot to capture credentials.

Cloud Security in Penetration Testing

• Considerations for Multimedia Cloud Deployments:

  • Shared Responsibility Model: Test configs (S3 buckets, IAM policies).

  • Container Security: Docker/Kubernetes misconfigurations.

  • API Endpoints: Cloud storage URLs often expose sensitive media.

Capture the Flag (CTF) Competitions

• Simulation of Real-World Scenarios:

  • Attack-Defend: Teams attack/defend a network (mirrors red/blue teaming).

  • Forensics Challenges: Analyze pcap files, stego images.

  • Web Exploits: Find flags via SQLi, XSS, file inclusion.

Case Study: Penetration Test of rgpvonline.com

• Objectives:

  • Identify web application vulnerabilities (SQLi, XSS, CSRF).

  • Assess cloud storage misconfigurations (public S3 buckets).

  • Evaluate authentication mechanisms.

• Methodology:

  1. Recon: DNS enumeration, tech fingerprinting (Wappalyzer).

  2. Scanning: Burp Suite automated scans, Nmap.

  3. Exploitation: Manual SQLi via sqlmap, privilege escalation.

  4. Reporting: Detailed findings with CVSS scores, remediation steps.

[!TIP]

OWASP Top 10 is critical for app pentesting. Cloud pentesting requires permission from provider (AWS/Azure). Always document every step for legal protection.

VI. Cryptography in Multimedia Security

RSA Algorithm Application

• Achieving Secure Communication:

  1. Key Generation:

     • Choose primes $p, q$; compute $$\displaystyle n = p \times q $$, $$\displaystyle \phi(n) = (p-1)(q-1) $$.

     • Select $e$ (public exponent, gcd$$\displaystyle (e, \phi(n)) = 1 $$).

     • Compute $$\displaystyle d = e^{-1} \mod \phi(n) $$.

  2. Encryption: $$\displaystyle c = m^e \mod n $$ (public key $(e,n)$).

  3. Decryption: $$\displaystyle m = c^d \mod n $$ (private key $d$).

• Multimedia Use: Encrypt media keys (AES) with RSA; digital signatures for content authenticity.

\boxed{c = m^e \mod n \quad \text{and} \quad m = c^d \mod n}

Decryption Concepts

• Role in Multimedia Security:

  • Unlock encrypted media streams (DRM systems like Widevine).

  • Verify digital signatures (hash decryption with public key).

  • Reverse watermark extraction (if watermark encrypted).

Cryptography Audit Documentation

• Key Elements for Reporting:

  • Scope: Systems/crypto algorithms audited.

  • Methodology: Tools (e.g., Cryptool, OpenSSL), test cases.

  • Findings: Weak keys, protocol vulnerabilities (e.g., TLS 1.0).

  • Risk Assessment: CVSS scores, impact on confidentiality/integrity.

  • Recommendations: Key rotation policies, algorithm upgrades (AES-256).

Stakeholder Engagement

• Importance in Cryptographic Implementation:

  • Alignment: Ensure crypto solutions meet business needs (e.g., latency vs security trade-offs).

  • User Adoption: Training on key management, avoiding workarounds.

  • Budget Approval: Justify costs of HSMs, certificates.

  • Compliance: Meet regulatory standards (PCI-DSS, HIPAA).

[!TIP]

RSA Security: Use $$\displaystyle e = 65537 $$ (common); key size ≥ 2048-bit. Never implement custom crypto—use vetted libraries (OpenSSL).

VII. Simulations and Case Studies

Capture the Flag (CTF) Competitions

• Simulation of Real-World Scenarios:

  • Time Pressure: Mimic incident response deadlines.

  • Multi-Domain: Combines web hacking, forensics, crypto, steganography.

  • Team Collaboration: Mirrors real security teams (red/blue/purple).

  • Learning: Expose to novel attack vectors (e.g., multimedia stego in images).

Case Study: Penetration Test of rgpvonline.com

• Objectives:

  • Assess web application security (student portal, payment gateway).

  • Test for data leakage (student PII, marks).

  • Evaluate network segmentation between academic/admin systems.

• Methodology:

  • Recon: DNS enumeration (sublist3r), Shodan for exposed services.

  • Vulnerability Scanning: Burp Suite Professional, Nessus.

  • Exploitation: SQLi in login form (sqlmap), file upload RCE.

  • Post-Exploitation: Lateral movement to database server.

  • Reporting: Executive summary + technical details with proof-of-concept.

[!TIP]

CTF Skills Transfer: Practice Hack The Box or TryHackMe for hands-on. For case studies, focus on methodology over specific tools—examiners value structured approach.