Hiding in Plain Sight
Nathan Byrd
Principal Application Security Architect | Expert in securing the SDLC with SAST & SCA tools | Advocating for transparent, easy-to-implement security solutions | Open-source enthusiast & retro computing hobbyist
Introduction
Hidden messages and secret codes might sound like the stuff of spy novels, but they can turn up in the most unexpected places—even on a t-shirt. At the recent Vintage Computer Festival Midwest last month, I found myself drawn not just to the retro hardware and vintage computers, but to a quirky piece of event merchandise: the official conference t-shirt.? See, besides being a fantastic piece of geek-wear, this t-shirt is also hiding a bit of a secret right in plain sight. The organizers mentioned it in passing, asking at one point whether anyone had discovered the secret. Though I didn’t have time at the conference, I got a chance to take a closer look recently which led me on a fun little adventure involving steganography, telecommunications history, and even a bit of math.
(article continues below)
The Art of Steganography
Intrigued by the dots’ pattern, I couldn’t help but think about steganography, a technique with a rich history in hiding messages in plain sight. Steganography is the practice of hiding information within an ordinary object or message so that it goes unnoticed by the casual observer. In modern times we often think about steganography as hiding data within images or videos, manipulating the data to encode a secret message, but steganography has a long history, for example with invisible ink used during the U.S. Revolutionary War or using the first letter of each sentence in a message to spell out a short message. In this case, the show organizers decided to have some fun with the design by encoding a simple message on the t-shirt. Let’s take a crack at figuring out what it says. If you want to try to recover the message yourself from the image before continuing, stop here.
Decoding the Message
When trying to find a steganographic message, the first goal is to find some sort of identifiable pattern. The dots on the shirt reminded me of punch cards – a clever nod from the organizers, no doubt. The only problem with this is that punch cards are rectangular, with rows and columns of holes. Looking at the shirt again, the smaller dots could be an alignment pattern, with each row projecting radially from the center outward, or from the edge inward. Using this theory, there are three “columns” inside the smaller dots, and 2 “columns” outside.
The five columns of dots led me to my first dilemma, however. With only 5 positions representing either a 0 or 1 (dot or no dot,) there is only 5 bits of information. ASCII text is encoded with 8 bits, and even older systems only go down to 7 bits. To find the number of combinations possible in a binary system, take 2 to the power of the number of digits, or 5 in this case, so 2^5 is 32. Although this is enough to store the 26 digits in A-Z, it is not enough to encode other information such as numbers, punctuation, etc. Still, it’s a start. And I was pretty sure that the answer would have to do with computer history, so I started looking there. After all, as my brother so eloquently put it, “once upon a time 8 bits must have seemed luxurious.” One possibility was a code invented by Jean-Maurice-émile Baudot eventually known as the International Telegraph Alphabet Number One (or ITA1,) or one of the variations of it. In this system, alpha characters and digits are represented with a special character to switch modes.
While this gave me a starting point, the exact decoding still presented an additional challenge, the determination of the ‘endianness’ or order of the bits, which added another layer of complexity to the puzzle. There are no clues as to whether the largest bit in each column is in the middle or toward the outside.? So, at this point, the easy way to go about this is to try each of the combinations.
The Solution
Armed with a potential code and some educated guesses, I turned to an online Baudot code decoder (https://www.dcode.fr/baudot-code) for help. Fortunately, decoding tools like these make it easy to explore different bit arrangements and quickly reveal hidden messages. For more serious encoding and decryption work, there are quite a few tools available in Kali Linux that can help for most jobs, but for this simple code the www.dcode.fr website was sufficient.
Decoding the message, which in this case used a Baudot variant named “US_TTY” where the columns with no dots also equate to spaces, and with that it turns out that the resulting code is “COMPUTER HOARDING IS SRS BZNS” (and yes, it is ??). As a side note, the ending “SRS BZNS” threw me off for a bit, as it appears at the top of the circle pattern and was the first words that I decoded. Just seeing those letters by themselves made me think that I had the wrong encoding, until I went back and tried the full message instead.
Conclusion
Although this was a fun exercise in digital sleuthing, it's a reminder of how steganography can serve serious purposes, from historical espionage to modern cybersecurity. Even the simplest codes can sometimes conceal important messages. While the hidden message on the t-shirt was all in good fun, it points to the wider and more profound applications of steganography throughout history and into the present day.