Search

A unified understanding of terms and their applicability is essential for every scientific discipline: steganography is no exception. Being divided into several domains (for instance, text steganography, digital media steganography, and network steganography), it is crucial to provide a unified terminology as well as a taxonomy that is not limited to some specific applications or areas. A prime attempt towards a unified understanding of terms was conducted in 2015 with the introduction of a pattern-based taxonomy for network steganography. Six years later, in 2021, the first work towards a pattern-based taxonomy for steganography was proposed. However, this initial attempt still faced several shortcomings, e.g., the lack of patterns for several steganography domains (the work mainly focused on network steganography and covert channels), various terminology issues, and the need of providing a tutorial on how the taxonomy can be used during engineering and scientific tasks, including the paper-writing process. As the consortium who published this initial 2021-study on steganography patterns, in this paper we present the first comprehensive pattern-based taxonomy tailored to fit all known domains of steganography, including smaller and emerging areas, such as filesystem steganography and cyber-physical systems steganography. Besides, to make our contribution more effective and promote the use of the taxonomy to advance research on steganography, we also provide a thorough tutorial on its utilization. Our pattern collection is available at https://patterns.ztt.hs-worms.de.

Synchronized clocks are vital for most communication scenarios in networks of Information Technology (IT) and Operational Technology (OT). The process of time synchronisation requires transmission of high-precision timestamps often originating from external sources. In this paper, we analyze how time synchronization protocols impose a threat by being leveraged as carrier for network covert channels. This paper is an extended version version of our open-access paper [15] in which we performed an in-depth analysis of the Network Time Protocol (NTP) in regards to covert channels. In this extended version, we broaden the view and take a look and time synchronisation in a more general way as we provide two comprehensive threat scenarios regarding covert channels and discuss the applicability of such covert channels to another time synchronisation protocol, namely the Precision Time Protocol, PTP. While the Network Time Protocol (NTP) is the most prevalent protocol for synchronizing clocks in IT networks, the Precision Time Protocol (PTP) is mostly found in networks of Industrial Control Systems (ICS) due to higher demands regarding accuracy and resolution. To illustrate the threat of covert channels in such protocols we describe two threat scenarios, one for the Network Time Protocol and one for the Precision Time Protocol. For NTP we perform a systematic in-depth analysis of covert channels. Our analysis results in the identification of 49 covert channels, by applying a covert channel pattern-based taxonomy. The summary and comparison based on nine selected key attributes show that NTP proofs itself as a plausible carrier for covert channels. The analysis results are evaluated in regards to common behavior of NTP implementations in six major operating systems. Two channels are selected and implemented to be evaluated in network test-beds. By hiding encrypted high entropy data in a high entropy field of NTP we show in our first assessment that practically undetectable channels can be implemented in NTP, motivating the required further research. In our evaluation, we analyze 40,000 NTP server responses from public NTP server providers and discuss potential countermeasures. Finally, we discuss the relevance, applicability and resulting threat of these findings for the Precision Time Protocol.

Steganography embraces several hiding techniques which spawn across multiple domains. However, the related terminology is not unified among the different domains, such as digital media steganography, text steganography, cyber-physical systems steganography, network steganography (network covert channels), local covert channels, and out-of-band covert channels. To cope with this, a prime attempt has been done in 2015, with the introduction of the so-called hiding patterns, which allow to describe hiding techniques in a more abstract manner. Despite significant enhancements, the main limitation of such a taxonomy is that it only considers the case of network steganography. Therefore, this paper reviews both the terminology and the taxonomy of hiding patterns as to make them more general. Specifically, hiding patterns are split into those that describe the embedding and the representation of hidden data within the cover object. As a first research action, we focus on embedding hiding patterns and we show how they can be applied to multiple domains of steganography instead of being limited to the network scenario. Additionally, we exemplify representation patterns using network steganography. Our pattern collection is available under https://patterns.ztt.hs-worms.de.

),which are generated by the partial reduction of oxygen[1]. Bacteria deal with oxidative stress with a set ofdetoxifying enzymes. Superoxide dismutases (SODs)were the first enzymes known to eliminate superoxideby disproportionation to hydrogen peroxide and diox-ygen [1]. Superoxide reductases (SORs) are a new fam-ily of enzymes that were discovered in sulfate-reducingbacteria of the Desulfovibrio genus [2,3], and catalyzethe reduction of superoxide to peroxide. SORs are pre-dominantly found in anaerobic or microaerophilicbacteria such as Desulfovibrio desulfuricans [2] andClostridium acetobutylicum [4], or anaerobic archaeonssuch as Archaeoglobus fulgidus [5] and Pyrococcusfuriosus [6]. In the past decade, SORs from theseorganisms and others have been studied in detail, anda considerable amount of biochemical, crystallographicand spectroscopic information has been reported [7].Methanosarcina mazei is one of the methanogenicarchaeons, which are characterized by the ability togenerate methane as the major end product of energymetabolism [8]. Many Methanosarcina strains are ableto utilize H

Methanosarcina mazei belongs to the group of aceticlastic methanogens and converts acetate into the potent greenhouse gases CO(2) and CH(4). The aceticlastic respiratory chain involved in methane formation comprises the three transmembrane proteins Ech hydrogenase, F(420) nonreducing hydrogenase and heterodisulfide reductase. It has been shown that the latter two contribute to the proton motive force. The data presented here clearly demonstrate that Ech hydrogenase is also involved in energy conservation. ATP synthesis was observed in a cytoplasm-free vesicular system of Ms. mazei that was dependent on the oxidation of reduced ferredoxin and the formation of molecular hydrogen (as catalysed by Ech hydrogenase). Such an ATP formation was not observed in a Deltaech mutant strain. The protonophore 3,5-di-tert-butyl-4-hydroxybenzylidene-malononitrile (SF6847) led to complete inhibition of ATP formation in the Ms. mazei wild-type without inhibiting hydrogen production by Ech hydrogenase, whereas the sodium ion ionophore ETH157 did not affect ATP formation in this system. Thus, we conclude that Ech hydrogenase acts as primary proton pump in a ferredoxin-dependent electron transport system.

Protein MM0632 from the methanogenic archaeon Methanosarcina mazei showed strong superoxide reductase activity and rapidly decomposed superoxide radicals to peroxides. The superoxide reductase activity of the heterologously produced enzyme was determined by a cytochrome c assay and in a test system with NADPH, ferredoxin:NADP(+) reductase, and rubredoxin. Furthermore, EPR spectroscopy showed that MM0632 is the first superoxide reductase that possesses an iron-sulfur cluster instead of a second mononuclear iron center. We propose the name methanoferrodoxin for this new class of superoxide reductase with an [Fe(NHis)(4)(SCys)] site as the catalytic center and a [4Fe-4S] cluster as second prosthetic group that is probably involved in electron transfer to the catalytic center. Methanosarcina mazei grows only under anaerobic conditions, but is one of the most aerotolerant methanogens. It is tempting to speculate that methanoferrodoxin contributes to the protection of cells from oxygen radicals formed by flavoproteins during periodic exposure to oxygen in natural environments.

Methanosarcina mazei belongs to the group of aceticlastic methanogens and converts acetate into the potent greenhouse gases CO(2) and CH(4). The aceticlastic respiratory chain involved in methane formation comprises the three transmembrane proteins Ech hydrogenase, F(420) nonreducing hydrogenase and heterodisulfide reductase. It has been shown that the latter two contribute to the proton motive force. The data presented here clearly demonstrate that Ech hydrogenase is also involved in energy conservation. ATP synthesis was observed in a cytoplasm-free vesicular system of Ms. mazei that was dependent on the oxidation of reduced ferredoxin and the formation of molecular hydrogen (as catalysed by Ech hydrogenase). Such an ATP formation was not observed in a Deltaech mutant strain. The protonophore 3,5-di-tert-butyl-4-hydroxybenzylidene-malononitrile (SF6847) led to complete inhibition of ATP formation in the Ms. mazei wild-type without inhibiting hydrogen production by Ech hydrogenase, whereas the sodium ion ionophore ETH157 did not affect ATP formation in this system. Thus, we conclude that Ech hydrogenase acts as primary proton pump in a ferredoxin-dependent electron transport system.

A continuously growing amount of information of today exists not only in digital form but were actually born-digital. These informations need be preserved as they are part of our cultural and scientific heritage or because of legal requirements. As many of these information are born-digital they have no analog origin, and cannot be preserved by traditional means without losing their original representation. Thus digital long-term preservation becomes continuously important and is tackled by several international and national projects like the US National Digital Information Infrastructure and Preservation Program [1], the German NESTOR project [2] and the EU FP7 SHAMAN Integrated Project [3]. In digital long-term preservation the integrity and authenticity of the preserved information is of great importance and a challenging task considering the requirement to enforce both security aspects over a long time often assumed to be at least 100 years. Therefore in a previous work [4] we showed the general feasibility of the Clark-Wilson security model [5] for digital long-term preservation in combination with a syntactic and semantic verification approach [6] to tackle these issues. In this work we do a more detailed investigation and show exemplarily the influence of the application of such a security model on the use cases and roles of a digital long-term preservation environment. Our goals is a scalable security model - i.e. no fixed limitations of usable operations, users and objects - for mainly preserving integrity of objects but also ensuring authenticity.

Digital long-term preservation has become an important topic not only in the preservation domain, but also due to facilitation by several national and international projects like US National Digital Information Infrastructure and Preservation Program [1], the German NESTOR project [2] and the EU FP7 SHAMAN Integrated Project [3]. The reason for this is that a large part of nowadays produced documents and other goods are digital in nature and even some - called "born-digital" - have no analog master. Thus a great part of our cultural and scientific heritage for the coming generations is digital and needs to be preserved as reliable as it is the case for physical objects even surviving hundreds of years. However, the continuously succession of new hardware and software generations coming in very short intervals compared to the mentioned time spans render digital objects from just some generations ago inaccessible. Thus they need to be migrated on new hardware and into newer formats. At the same time integrity and authenticity of the preserved information is of great importance and needs to be ensured. However this becomes a challenging task considering the long time spans and the necessary migrations which alter the digital object. Therefore in a previous work [4] we introduced a syntactic and semantic verification approach in combination with the Clark-Wilson security model [5]. In this paper we present a framework to ensure the security aspects of integrity and authenticity of digital objects especially images from the time of their submission to a digital long-term preservation system (ingest) up to its latter access and even past this. The framework especially describes how to detect if the digital object has retained both of its security aspects while at the same allowing changes made to it by migration.

The genomic expression patterns of Methanosarcina mazei growing with trimethylamine were measured in comparison to those of cells grown with methanol. We identified a total of 72 genes with either an increased level (49 genes) or a decreased level (23 genes) of mRNA during growth on trimethylamine with methanol-grown cells as the control. Major differences in transcript levels were observed for the mta , mtb , mtt , and mtm genes, which encode enzymes involved in methane formation from methanol and trimethylamine, respectively. Other differences in mRNA abundance were found for genes encoding enzymes involved in isopentenyl pyrophosphate synthesis and in the formation of aromatic amino acids, as well as a number of proteins with unknown functions. The results were verified by in-depth analysis of methyltransferase genes using specific primers for real-time quantitative reverse transcription-PCR (RT-PCR). The monitored transcript levels of genes encoding corrinoid proteins involved in methyl group transfer from methylated C 1 compounds ( mta C, mtb C, mtt C, and mtm C) indicated increased amounts of mRNA from the mtaBC1 , mtaBC2 , and mtaBC3 operons in methanol-grown cells, whereas mRNA of the mtb1-mtt1 operon was found in high concentrations during trimethylamine consumption. The genes of the mtb1-mtt1 operon encode methyltransferases that are responsible for sequential demethylation of trimethylamine. The analysis of product formation of trimethylamine-grown cells at different optical densities revealed that large amounts of dimethylamine and monomethylamine were excreted into the medium. The intermediate compounds were consumed only in the very late exponential growth phase. RT-PCR analysis of key genes involved in methanogenesis led to the conclusion that M. mazei is able to adapt to changing trimethylamine concentrations and the consumption of intermediate compounds. Hence, we assume that the organism possesses a regulatory network for optimal substrate utilization.

Organisms using the thiosulfate-oxidizing Sox enzyme system fall into two groups: group 1 forms sulfur globules as intermediates (Allochromatium vinosum), group 2 does not (Paracoccus pantotrophus). While several components of their Sox systems are quite similar, i.e. the proteins SoxXA, SoxYZ and SoxB, they differ by Sox(CD)2 which is absent in sulfur globule-forming organisms. Still, the respective enzymes are partly exchangeable in vitro: P. pantotrophus Sox enzymes work productively with A. vinosum SoxYZ whereas A. vinosum SoxB does not cooperate with the P. pantotrophus enzymes. Furthermore, A. vinosum SoxL, a rhodanese-like protein encoded immediately downstream of soxXAK, appears to play an important role in recycling SoxYZ as it increases thiosulfate depletion velocity in vitro without increasing the electron yield.