WEBVTT - How Steganography Works 0:00:04.240 --> 0:00:12.160 Get in touch with technology with text stuff from dot com. Kaiser, Everyone, 0:00:12.160 --> 0:00:15.560 and welcome to tex Stuff. I am Jonathan Strickland, your 0:00:15.560 --> 0:00:19.880 beloved host. Today I have a special guest in the studio, 0:00:20.520 --> 0:00:23.040 a dear friend of mine, someone I have worked with 0:00:23.160 --> 0:00:28.960 on stage and another podcasts and radio plays, Ariel Kristen caston. 0:00:29.120 --> 0:00:32.520 Welcome to tex Stuff. Hi everybody, thank you for letting 0:00:32.520 --> 0:00:34.960 me be on tech Stuff. Jonathan, I'm super excited. I'm 0:00:35.080 --> 0:00:38.680 very excited to Ariel and I we we've been friends 0:00:38.720 --> 0:00:41.080 for more than a decade. Now, oh man, make me 0:00:41.120 --> 0:00:45.800 feel old. Oh well, joined the club. So Ariel, I 0:00:46.159 --> 0:00:48.239 asked her what she wanted to cover. She told me 0:00:48.280 --> 0:00:50.800 that we could cover whatever we wanted. So I looked 0:00:50.800 --> 0:00:53.120 back and there was an email message that was sent 0:00:53.200 --> 0:00:56.960 in a listener request. Peter sent this in via email, 0:00:57.040 --> 0:01:00.680 and this is an ancient listener request, folks. So, Peter, 0:01:00.800 --> 0:01:02.600 I apologize that it took so long for us to 0:01:02.640 --> 0:01:04.200 get there, but I'm really excited that we get to 0:01:04.200 --> 0:01:07.440 cover it today. Here's what Peter wrote. He said, I 0:01:07.520 --> 0:01:12.120 recently bought a book called Data Hiding that is about steganography. 0:01:12.680 --> 0:01:14.560 I look to see if this is something you have 0:01:14.640 --> 0:01:17.319 covered but found you had not. I think that this 0:01:17.400 --> 0:01:20.399 would be an extremely interesting topic. You would be able 0:01:20.440 --> 0:01:22.480 to cover the ways in which data can be hidden, 0:01:23.040 --> 0:01:26.040 as well as who uses such techniques like al Qaeda, 0:01:26.160 --> 0:01:30.520 the n s A, malware, authors, hobbyists, et cetera. Yeah, 0:01:30.600 --> 0:01:34.280 we're going to cover steganography, which is not what I 0:01:34.280 --> 0:01:37.480 originally thought it was. I originally thought it was the 0:01:37.520 --> 0:01:41.880 study of stegasaurasaurs. Yeah, I thought it was the study 0:01:42.080 --> 0:01:46.160 of dinosaur calligraphy. So we were both on the wrong track, 0:01:46.200 --> 0:01:51.320 as it turns out. Uh yeah, So what actually is steganography. Well, 0:01:51.520 --> 0:01:54.600 steganography is the art of hiding something within something else. 0:01:54.920 --> 0:01:56.840 It can be simple, like a hidden message in a 0:01:56.880 --> 0:02:00.680 painting or photograph, or it can be something really complicated, 0:02:00.800 --> 0:02:03.840 like an electronic file or message hidden in another file 0:02:03.960 --> 0:02:08.799 or message. Yeah. Yeah, So it's essentially the the art 0:02:08.880 --> 0:02:11.600 of being able to send a message without people even 0:02:11.680 --> 0:02:15.440 knowing that you've done so, right, That's that's the goal 0:02:15.560 --> 0:02:21.160 of steganography. So the parties in steganography there there are, 0:02:21.560 --> 0:02:23.079 you know, this is how we break it down. You've 0:02:23.120 --> 0:02:25.960 got the sender, that's the person who's created the message 0:02:25.960 --> 0:02:29.560 and wants to communicate something you have the receiver, which 0:02:29.600 --> 0:02:32.200 is the person who the message is intended to go to. 0:02:33.080 --> 0:02:38.160 You have the carrier message, which is the the the 0:02:38.240 --> 0:02:42.320 construct that hides the secret message. So this could be 0:02:42.400 --> 0:02:44.839 whatever like, it could be a painting, the boring note 0:02:44.840 --> 0:02:47.920 about your cousin's children, or it could be a soccer 0:02:48.000 --> 0:02:50.240 ball that happens to have a secret asage written on 0:02:50.280 --> 0:02:53.160 the inside of it. Wilson was a secret it could 0:02:53.280 --> 0:02:58.040 be that Wilson in Castaway was in fact a stagana Graham, 0:02:58.160 --> 0:03:02.880 which is the other element. So, by the way, there 0:03:02.880 --> 0:03:05.519 are a lot of Greek words and Greek names and 0:03:05.639 --> 0:03:08.960 some Roman names, so Latin as well. That's going to 0:03:09.000 --> 0:03:10.840 be all of those are gonna be popping up. There 0:03:10.880 --> 0:03:14.799 also a couple of other names from other cultures. I'm 0:03:14.800 --> 0:03:19.600 an ignorant American, so my pronunciation is going to be awful, 0:03:19.840 --> 0:03:22.400 and I can barely grasp the American language, which I've 0:03:22.400 --> 0:03:24.600 grown up with all my life, so mine will be worse. Yeah, 0:03:24.639 --> 0:03:27.720 So just just letting you guys know that ahead of time. 0:03:27.760 --> 0:03:33.120 So the staganogram, I'm never going to get that, otherwise 0:03:33.160 --> 0:03:35.080 known as the secret message. We're just gonna I'm going 0:03:35.120 --> 0:03:38.040 to call it secretsages from now on and then potentially 0:03:38.120 --> 0:03:40.840 third parties. So, in other words, people who might come 0:03:40.880 --> 0:03:43.760 into contact with this message. The goal is to make 0:03:43.760 --> 0:03:46.400 sure that those third parties are never aware that there 0:03:46.440 --> 0:03:48.080 is a message there in the first place, and if 0:03:48.080 --> 0:03:51.000 it's done right, they won't be Yeah. So in other words, 0:03:51.200 --> 0:03:55.040 you could have a messenger, a go between carry this 0:03:55.160 --> 0:03:57.520 thing from one person to the other and never know 0:03:57.920 --> 0:04:00.880 that there was something hidden in there. Although sometimes it's 0:04:00.920 --> 0:04:04.560 good if they're confident, because you need to get a 0:04:04.560 --> 0:04:07.560 message to the person who needs to decipher it on 0:04:07.600 --> 0:04:10.040 how to decipher it right, right. If the person who 0:04:10.080 --> 0:04:14.880 receives the message isn't aware of the method to find it, 0:04:14.880 --> 0:04:17.520 it doesn't do them a lot of good. So if 0:04:17.560 --> 0:04:20.200 if you have been able to collude with your receiver, 0:04:20.320 --> 0:04:23.120 like if I'm sending a message to Ariel, and Ariel 0:04:23.160 --> 0:04:26.359 and I have decided ahead of time, Hey, if I 0:04:26.400 --> 0:04:28.440 ever need to send you a message, this is how 0:04:28.440 --> 0:04:30.080 I'm going to do it, and this is how you're 0:04:30.080 --> 0:04:32.919 going to see what the message is, then we're okay. 0:04:33.200 --> 0:04:35.479 But if if it's a situation where Ariel and I 0:04:35.520 --> 0:04:37.599 have been separated for a long time and I need 0:04:37.640 --> 0:04:40.120 to send her a message and I needed to be secret. 0:04:40.440 --> 0:04:42.080 I've got to figure out a way to give her 0:04:42.120 --> 0:04:46.200 instructions as to how to retrieve that message. And sometimes 0:04:46.200 --> 0:04:50.000 that involves, you know, paying somebody, like just tell her 0:04:50.560 --> 0:04:53.719 to wash the wax off and we'll explain what that 0:04:53.760 --> 0:04:58.640 means a little bit later. So they're wash the wax off, 0:04:58.680 --> 0:05:01.040 it's good advice to live by their Yeah, sure, yeah, 0:05:01.120 --> 0:05:05.320 I mean just in general. So we've got the elements here. 0:05:05.360 --> 0:05:09.800 Those are your basic elements to to have. Steganography actually 0:05:09.839 --> 0:05:12.280 makes sense, and now we need to talk about the 0:05:12.320 --> 0:05:17.600 difference between that and a related art cryptography, which, yes, 0:05:17.880 --> 0:05:23.960 cryptography is the art of making and solving codes. Uh, 0:05:24.000 --> 0:05:26.640 but anybody can see that it's a code. Right, So 0:05:27.000 --> 0:05:29.680 if I send a coded message to Arial, it may 0:05:29.720 --> 0:05:32.720 be that any third party can't see what the message is, 0:05:32.760 --> 0:05:35.200 but they know I'm trying to communicate to her. Yeah, 0:05:35.240 --> 0:05:36.920 because why else would he send me a piece of 0:05:36.920 --> 0:05:42.200 paper that says music of viage Unless I've just fallen 0:05:42.200 --> 0:05:46.320 asleep at my keyboard, Then clearly I'm trying to say something, 0:05:46.360 --> 0:05:49.240 so and then I'm just wasting my time trying to decipherate. Right, 0:05:49.480 --> 0:05:54.320 So cryptography keys in people that something's going on. It 0:05:54.400 --> 0:05:58.120 lets people know there's some sort of communication. And uh. 0:05:58.440 --> 0:06:02.360 You might have a pretty simple type of code, like 0:06:02.520 --> 0:06:05.919 a simple cipher where you know the old classic, uh, 0:06:06.080 --> 0:06:09.320 substitution cipher, where you substitute one letter for another, the 0:06:09.480 --> 0:06:12.640 simplest being let's shift all the letters over by one. 0:06:13.240 --> 0:06:16.919 So and uh, whenever I write the letter B, I 0:06:17.000 --> 0:06:19.480 really mean the letter A. Whenever I write the letter C, 0:06:19.720 --> 0:06:22.320 I really mean the letter B. This is what's called 0:06:22.880 --> 0:06:27.080 a really bad cipher. It's easy to figure out. I 0:06:27.080 --> 0:06:29.039 don't know when I try to do the cryptograms in 0:06:29.080 --> 0:06:31.760 puzzle books, has such a hard time, And it's the 0:06:31.800 --> 0:06:35.120 same thing. Well, sometimes a substitution cipher can get a 0:06:35.120 --> 0:06:38.480 little more complicated. So for example, when you substitute one 0:06:38.560 --> 0:06:42.200 letter for another, then the next time you substitute a letter, 0:06:42.320 --> 0:06:45.560 you actually shift over again. So in other words, the 0:06:45.600 --> 0:06:47.960 first time you only shift over one letter, the second 0:06:48.000 --> 0:06:49.960 time you shift over two letters, the third time you 0:06:50.000 --> 0:06:53.320 shift over three letters. So if you know the algorithm, 0:06:53.440 --> 0:06:55.960 if you know the pattern, then when you get the message, 0:06:56.000 --> 0:06:58.440 you can reverse that and you know to look for it. 0:06:58.720 --> 0:07:00.560 If you don't know the pattern, then you have to 0:07:00.600 --> 0:07:02.720 spend more time trying to figure out what the pattern is. 0:07:03.320 --> 0:07:07.279 And while that still is a fairly simple example, things 0:07:07.360 --> 0:07:11.800 like the um the Enigma machine in World War Two, 0:07:11.800 --> 0:07:15.040 which was the Germans way of sending coded messages. They 0:07:15.040 --> 0:07:18.680 had this machine that had three different the basic one, 0:07:18.680 --> 0:07:21.680 I had three different dials that they would set, and 0:07:21.680 --> 0:07:24.120 then I had a typewriter and a bunch of lamps, 0:07:24.560 --> 0:07:26.880 and when you pressed down a key of a letter, 0:07:27.440 --> 0:07:31.280 a lamp would light up, indicating a different letter. So 0:07:31.360 --> 0:07:34.920 let's say I typed the letter E to type in Enigma, 0:07:35.640 --> 0:07:42.000 but the letter for in lights up. Then it would 0:07:42.040 --> 0:07:46.000 actually go a certain number of steps, so that the 0:07:46.080 --> 0:07:50.040 next letter I type would be a totally unpredictable letter. 0:07:50.160 --> 0:07:53.760 If I didn't have an Enigma machine of my own. Well, 0:07:53.800 --> 0:07:56.920 that's really good, because if I tried to write a cipher, 0:07:56.960 --> 0:07:58.800 I would totally lose place of where I was if 0:07:58.800 --> 0:08:02.360 I was constantly shifting the letter yeah, and my message 0:08:02.360 --> 0:08:06.760 would be nonsensical, both decrypted and encrypted. Yeah, exactly, that 0:08:06.800 --> 0:08:09.280 that is. That's the reason why the Germans were using 0:08:09.280 --> 0:08:12.440 a machine so that way it could be predictable. But 0:08:12.680 --> 0:08:16.440 only if both parties had the same style of Enigma 0:08:16.480 --> 0:08:19.680 machine and they both knew what the initial settings were, 0:08:20.200 --> 0:08:25.440 so part of the communication would include a a key 0:08:25.440 --> 0:08:27.720 saying this is what you need to set it to. 0:08:28.520 --> 0:08:32.280 Although technically they were all supposed to have a communication 0:08:32.400 --> 0:08:34.760 telling them what settings to use each day, and they 0:08:34.760 --> 0:08:38.760 were never supposed to repeat those settings. Eventually people got 0:08:38.840 --> 0:08:42.560 lazy and that's how those codes were eventually broken by 0:08:42.600 --> 0:08:46.200 Alan Turing, which you can see in that film The 0:08:46.280 --> 0:08:51.240 Imitation Game, The Imitation Game exactly. So steganography obviously is 0:08:51.280 --> 0:08:55.160 different from cryptography, and that yes, you're still sending secret messages, 0:08:55.200 --> 0:08:58.800 but the message itself, the existence of the message is secret. 0:08:59.000 --> 0:09:02.160 Anybody any lay then looking at the message or the 0:09:02.160 --> 0:09:05.640 photo or the paper won't know it's there, right, so 0:09:06.120 --> 0:09:09.880 you you can still encrypt it, you can still use cryptography. 0:09:09.960 --> 0:09:13.000 In fact, using both together makes a lot of sense. 0:09:13.679 --> 0:09:17.400 But ultimately with steganography, if you've hidden the message well 0:09:17.520 --> 0:09:19.840 enough and people are not if people don't know to 0:09:19.920 --> 0:09:23.199 look for it, it's safe to be in plain text 0:09:23.640 --> 0:09:27.520 to whomever you're sending it to, depending upon what method 0:09:27.559 --> 0:09:29.200 you use, because there are a lot of different ones, 0:09:29.280 --> 0:09:33.760 right um um. A great way to further explain it 0:09:33.800 --> 0:09:36.600 is to go back to the Greek cryptography means secret 0:09:36.640 --> 0:09:41.880 writing and steganography means covered writing. I pause there because 0:09:42.200 --> 0:09:45.720 I was really surprised I said it correctly. Well, every 0:09:45.720 --> 0:09:48.280 time I say it correctly, I will also be surprised. 0:09:48.679 --> 0:09:51.560 Uh yeah. So that really that gets down to the 0:09:51.559 --> 0:09:54.120 heart of it, right, and the combination of the two 0:09:54.200 --> 0:09:58.480 allows you to have more secure communication. Now, there's an 0:09:58.640 --> 0:10:03.480 art to find being hidden messages that have been concealed 0:10:03.520 --> 0:10:07.120 in this way. Yes, it is called stag analysis, which 0:10:07.400 --> 0:10:09.679 I try to look up what the Greek of that meant, 0:10:09.720 --> 0:10:14.840 and it meant covered, breaking up, loosening of Yeah, so 0:10:14.960 --> 0:10:17.720 it's it's all very repetitive. It just means you're uncovering 0:10:17.840 --> 0:10:21.760 the secret message, right. So depending upon the type of 0:10:22.320 --> 0:10:27.160 uh steganogram that has been sent, you would use a 0:10:27.200 --> 0:10:31.200 different method to find the meaning. So when we're talking 0:10:31.240 --> 0:10:35.079 about the modern version of steganography, we're really talking about 0:10:35.120 --> 0:10:39.959 ones and zeros digital information. So steag analysis is largely 0:10:40.000 --> 0:10:43.680 concerned with that because that's that's the main way messages 0:10:43.720 --> 0:10:46.439 are set these days, is through a digital file of 0:10:46.480 --> 0:10:50.800 some sort that to an outside view looks like a 0:10:50.840 --> 0:10:54.200 normal file. There's nothing that seems remarkable about it. But 0:10:54.240 --> 0:10:57.240 if you were to analyze the actual digital information of 0:10:57.280 --> 0:11:00.840 that file, you would start to see pattern that would 0:11:00.840 --> 0:11:04.720 indicates something hanky is going. Yes, and insteak analysis, there 0:11:04.720 --> 0:11:08.520 are two steps to deciphering and the first is detecting 0:11:08.520 --> 0:11:11.280 it UM, which if if it is like a handwritten 0:11:11.280 --> 0:11:14.079 message or something like that, and it's very fairly obvious, 0:11:14.440 --> 0:11:19.559 you can do it without any special software. UM. But 0:11:19.600 --> 0:11:22.640 where it does happen so so much in the digital age, UM, 0:11:22.640 --> 0:11:24.679 there are disk analysis programs that will just look at 0:11:24.720 --> 0:11:29.520 it for you. Yeah, you actually run your suspected uh 0:11:29.679 --> 0:11:33.360 secret message, So it could be very simple like a 0:11:33.360 --> 0:11:35.360 lot of and a lot of examples I see are 0:11:35.400 --> 0:11:38.960 photographs that have been uploaded to public forums and the 0:11:39.000 --> 0:11:41.360 idea being that well, when it's in the public eye, 0:11:41.960 --> 0:11:44.760 no one's paying attention to it because it's just something 0:11:44.800 --> 0:11:46.160 that we see all the time. Like if you were 0:11:46.200 --> 0:11:50.040 to post a picture to Facebook, Yeah, a lot of 0:11:50.080 --> 0:11:53.280 a lot of people do. Then because that's so common, 0:11:53.440 --> 0:11:58.079 it doesn't tend to raise suspicion. So first of all, 0:11:58.120 --> 0:12:01.440 someone has to know that there's something to look for, right, 0:12:01.760 --> 0:12:04.240 they have to first be suspicious that there's some form 0:12:04.240 --> 0:12:07.360 of communication going on. Then they have to start figuring out, 0:12:07.360 --> 0:12:09.960 all right, how is this communication happening, And then they 0:12:10.000 --> 0:12:13.079 would have to start targeting the various means of that, 0:12:13.120 --> 0:12:15.000 and one of those might be photographs, and they'd say, 0:12:15.040 --> 0:12:17.920 all right, let's take this image that was uploaded to 0:12:18.240 --> 0:12:21.800 whatever site, and let's run it through one of these 0:12:21.840 --> 0:12:25.120 disc analysis programs and see if that comes up with 0:12:25.200 --> 0:12:30.560 anything that perhaps there's some indication that something's out of place, 0:12:30.720 --> 0:12:35.240 and it might be something that you looking at would 0:12:35.320 --> 0:12:38.480 notice if you knew what to look for. Yeah, that's 0:12:38.520 --> 0:12:44.160 called perceptible noise. So sometimes if audio visual files are 0:12:44.200 --> 0:12:46.920 slightly off, there might be perceptible noise in there. Yeah, 0:12:47.400 --> 0:12:50.240 so that would just be an indicator, right, something saying 0:12:50.600 --> 0:12:53.920 something's not right now. That can happen naturally, like that 0:12:53.920 --> 0:12:58.160 can just be a problem with the file and not 0:12:58.160 --> 0:13:01.760 not be an indication that there's anything super secret going on. 0:13:02.800 --> 0:13:04.960 Or it could be an indication that, in fact, some 0:13:05.160 --> 0:13:08.440 of the bits in that file have been altered in 0:13:08.559 --> 0:13:11.320 order to send a secret message. And in in the 0:13:11.360 --> 0:13:15.679 best case of steganography, you wouldn't have weird noises or 0:13:15.800 --> 0:13:19.560 distorted pixels for people to see. Yeah, it would just 0:13:19.600 --> 0:13:21.839 be so subtle that you would never pick up on it. 0:13:22.400 --> 0:13:24.960 And uh and that's the reason why you need these 0:13:24.960 --> 0:13:28.680 disc analysis programs, so they can look for things that 0:13:28.840 --> 0:13:33.520 are below the perceptive level of human beings. Uh. So 0:13:33.920 --> 0:13:37.360 again we often see the two working together. Makes a 0:13:37.440 --> 0:13:40.200 lot of sense. So let's talk a little bit about 0:13:40.240 --> 0:13:45.400 the history of steganography, because there are some gloriously awful 0:13:45.559 --> 0:13:49.040 and bloody stories. Oh it gave me the heebs just 0:13:49.040 --> 0:13:51.440 just reading about them. Yeah. So first we got to 0:13:51.440 --> 0:13:53.880 go to ancient Greece, which makes sense. We're talking, you know, 0:13:53.880 --> 0:13:56.400 we're using Greek words, so it makes sense that that 0:13:56.520 --> 0:14:00.120 a lot of the early cases involved Greek stories. And 0:14:00.120 --> 0:14:05.600 we're gonna be talking a lot about Herodotus time. I 0:14:05.640 --> 0:14:08.079 can only do it because I listened to the pronunciation 0:14:08.080 --> 0:14:11.559 and I wrote down a phonetic translation in our notes. 0:14:11.640 --> 0:14:15.320 That is not a joke. Herodotus was a Greek historian 0:14:16.080 --> 0:14:19.880 in the fifth century b c. And wrote a lot 0:14:20.040 --> 0:14:23.880 about Greek history and the history of the surrounding areas 0:14:23.880 --> 0:14:28.360 of Greece, and in fact, his writings were called the Histories. Yeah, 0:14:28.680 --> 0:14:32.160 and or at least we have to we have to 0:14:32.200 --> 0:14:34.000 take some of this with a grain of salt, because 0:14:34.080 --> 0:14:36.280 legend got mixed up with history quite a bit. So. 0:14:37.240 --> 0:14:40.480 In fact, there are some modern accountings that suggest that 0:14:41.160 --> 0:14:45.640 some of the familial connections he makes in his stories 0:14:45.720 --> 0:14:50.280 were not necessarily accurate. So Um one of the big ones, 0:14:50.320 --> 0:14:52.000 in fact, the first one I have to talk about, 0:14:52.520 --> 0:14:55.640 is one of those where the story talks about a 0:14:55.680 --> 0:15:02.280 general named Harpagus who sent a staganagram to Cyrus was 0:15:02.320 --> 0:15:05.160 a king who was going to become the King of 0:15:05.320 --> 0:15:09.000 Kings of Persia. So the Prince of Persia, not the 0:15:09.000 --> 0:15:12.480 Prince of Persian. No, that's a video game, which is fun, 0:15:12.840 --> 0:15:17.720 but not not something we actually need to reference here. Story. Yeah, 0:15:17.720 --> 0:15:20.200 the story is far bloodier in fact, which is odd 0:15:20.200 --> 0:15:21.920 to think of, depending on which version of Prince of 0:15:21.920 --> 0:15:24.760 Persia you played and how badly you played it. But 0:15:25.360 --> 0:15:27.960 Cyrus was going to be the King of Kings of Persia, 0:15:28.080 --> 0:15:31.440 so Persia was divided up into several kingdoms, and then 0:15:31.480 --> 0:15:34.120 you had a sort of an over king who saw 0:15:34.280 --> 0:15:38.840 over everybody, kind of like King Arthur in in English lore. Um. 0:15:39.480 --> 0:15:46.120 So cyrus Um was the grandson, according to Herodotus, to 0:15:46.400 --> 0:15:52.560 another king of kings, Ostiagas, And so Harpagus actually worked 0:15:52.560 --> 0:15:55.840 for Ostiagas. So Ostiogus is this king of kings, and 0:15:55.880 --> 0:15:59.480 he has a dream, and in his dream, his daughter 0:15:59.760 --> 0:16:03.360 give birth to a son, and that son grows up 0:16:03.400 --> 0:16:08.080 to depose osti Agus. So first he ends up marrying 0:16:08.240 --> 0:16:11.160 his daughter off to a kind of milk toast kind 0:16:11.160 --> 0:16:13.120 of guy, someone that he thinks is, oh, well, this 0:16:13.160 --> 0:16:16.000 guy is harmless, so any child they have is not 0:16:16.040 --> 0:16:19.080 going to be a threat to me. Uh. And they 0:16:19.120 --> 0:16:22.480 have a son named Cyrus, according to Herodotus. Again, other 0:16:22.680 --> 0:16:27.360 modern accounts suggest that Cyrus and Ostiagas were not grandfather 0:16:27.440 --> 0:16:29.520 and grandson. Yeah, they might have been related, but not 0:16:29.600 --> 0:16:35.360 like grandfather and grandson, particularly since Cyrus ended up marrying um, 0:16:35.400 --> 0:16:38.120 a daughter of Herodotus, which would have meant he would 0:16:38.120 --> 0:16:41.040 have married his own aunt, which was not common in 0:16:41.080 --> 0:16:46.000 those times. So I mean possible, but not common. So anyway, 0:16:46.000 --> 0:16:51.000 in the story, Cyrus is the grandson, and Ostiagas decides 0:16:51.040 --> 0:16:56.920 Harpagus needs to go out and kill Cyrus. Okay. Harpagas, though, 0:16:57.040 --> 0:17:00.280 does not really relish the thought of spilling royal blood, 0:17:00.400 --> 0:17:03.080 so he takes Cyrus and he gives Cyrus to a 0:17:03.160 --> 0:17:07.080 shepherd and says, look after this kid, uh and raise 0:17:07.160 --> 0:17:09.520 him as your own, and I will report back that 0:17:09.680 --> 0:17:12.639 Cyrus is dead. Pegus seems like a really decent guy, 0:17:12.880 --> 0:17:16.119 at least at that point, so he goes back. He 0:17:16.160 --> 0:17:20.440 reports that Cyrus has died, and Ostiagus says YEA. Ten 0:17:20.560 --> 0:17:23.960 years later, osti Agus finds out Cyrus is actually alive, 0:17:24.640 --> 0:17:29.359 so he punishes Harpegus in kind of a Shakespearean awful way, 0:17:29.600 --> 0:17:34.040 and that in the story, osti Agus gets Harpagus, his son, 0:17:34.920 --> 0:17:39.359 kills him, chops him up, cooks him, serves them to 0:17:39.400 --> 0:17:43.840 Harpagas as a banquet. Harpegas and then tells Harpegus, hey, 0:17:43.880 --> 0:17:45.919 by the way, I hope you like your son, because 0:17:46.000 --> 0:17:50.600 that's what you're eating. Harpegus supposedly then gathered up the 0:17:50.720 --> 0:17:54.680 remains and gave his son a burial. He was being 0:17:54.720 --> 0:17:59.040 obedient to the king outwardly, but inwardly had decided that 0:17:59.080 --> 0:18:01.720 he had had enough and he wanted revenge, so he 0:18:01.800 --> 0:18:05.560 wanted to report to Cyrus. He ended up working very 0:18:05.600 --> 0:18:09.399 hard to get other leaders of Persia to turn against 0:18:09.440 --> 0:18:12.119 ossi Augus and wait for just the right time to 0:18:12.160 --> 0:18:14.960 give Cyrus the signal that now is the time to attack. 0:18:15.400 --> 0:18:17.639 So he needed to send a message to Cyrus saying, 0:18:18.119 --> 0:18:22.640 we're ready to go when you are. But Asti August 0:18:22.680 --> 0:18:25.320 had guards all along the way. So how does he 0:18:25.359 --> 0:18:33.199 send a message. He gets a bunny bunny hair. Actually, no, 0:18:33.280 --> 0:18:35.560 they're not nearly as cute as bunny rabbits, and this 0:18:35.680 --> 0:18:39.320 hair was not nearly as cute because it was did. Yeah, 0:18:39.320 --> 0:18:44.200 they they have a guy kill a hair, They cut 0:18:44.240 --> 0:18:48.159 the hair open, they insert the secret message into the 0:18:48.240 --> 0:18:52.520 hair's stomach, so the hair back up, and a messenger 0:18:52.600 --> 0:18:56.560 disguised as a huntsman brings the hair to Cyrus and says, 0:18:57.440 --> 0:19:00.800 you should cut open this bunny rabbit and get what 0:19:00.880 --> 0:19:04.640 the delicious things inside are. And so Cyrus cuts open 0:19:04.640 --> 0:19:08.200 the stitches, gets the message, sees that it's time to attack, 0:19:08.680 --> 0:19:13.199 and that is how, according to Herodotus, Cyrus goes and 0:19:13.320 --> 0:19:17.200 joins a revolution and overthrows osta AGAs, and then Cyrus 0:19:17.240 --> 0:19:20.879 becomes the king. So there's a long way to go 0:19:21.000 --> 0:19:23.040 for that story, but it's important to know all the 0:19:23.119 --> 0:19:26.879 elements to explain why Harpagus was trying to send a 0:19:26.880 --> 0:19:29.400 coded message in the first place, or hidden message. I'm 0:19:29.440 --> 0:19:31.680 so glad we have better ways to send hidden messages 0:19:31.720 --> 0:19:35.000 than in the stomachs of rabbits. Now yeah, so, um, 0:19:35.040 --> 0:19:38.920 here's another one. This is another popular story from Herodotus. 0:19:39.960 --> 0:19:46.280 This one involves a tyrant named Histius, which sounds like 0:19:46.320 --> 0:19:50.800 you're strangling a snake. Yeah. Histius who is the ruler 0:19:50.960 --> 0:19:56.080 of mild Us, and this guy was really useful to 0:19:56.080 --> 0:19:59.120 the King of Persia. The King of Persia loved Histius 0:19:59.800 --> 0:20:02.840 and and decided to invite him back to become a 0:20:02.920 --> 0:20:05.479 royal advisor. Well that sounds pretty good to me. Well, 0:20:05.760 --> 0:20:08.760 at first, History has thought so too. But then eventually 0:20:08.800 --> 0:20:09.960 he thought, you know, I want to go back to 0:20:10.000 --> 0:20:12.880 being a tyrant of Maltest. Tyrant, by the way, does 0:20:12.920 --> 0:20:16.199 not necessarily mean evil ruler, but it did mean like 0:20:16.480 --> 0:20:21.760 having total authority over a region. Um, so he said, 0:20:21.840 --> 0:20:23.679 he thought, I want to go back to doing what 0:20:23.720 --> 0:20:26.880 I was doing before. But it would be treason for 0:20:26.920 --> 0:20:29.600 me to deny the king. So how do I get 0:20:29.600 --> 0:20:32.560 around this? And he comes up with an even more 0:20:32.640 --> 0:20:35.480 treason this way to get around it. He decides that 0:20:35.520 --> 0:20:38.399 the best way to get back to doing what he 0:20:38.440 --> 0:20:44.800 was doing before would be to stage a revolution back home. Uh, 0:20:44.840 --> 0:20:47.119 and then tell the king, Hey, I need to go 0:20:47.160 --> 0:20:50.280 back there and squash this revolution before it gets out 0:20:50.280 --> 0:20:52.920 of hand because telling the king no is so much 0:20:53.560 --> 0:20:57.439 less worse than lying to the king and tell him. 0:20:57.840 --> 0:21:00.440 So he decides he needs to send this in instruction 0:21:00.560 --> 0:21:04.880 to his nephew, who was in charge of mildest Aristagoras. 0:21:05.720 --> 0:21:07.520 And so how does he send the message. Well, he 0:21:07.560 --> 0:21:12.320 gets a slave which the Greeks had back then, and tattoos. 0:21:12.680 --> 0:21:15.760 He shaves the slave's head, tattoos the message on the 0:21:15.800 --> 0:21:19.440 slave's scalp, then allows the slaves hair to grow back, 0:21:20.119 --> 0:21:23.439 then sends the slave to Aristagoras with the instruction to 0:21:23.440 --> 0:21:25.600 tell Aristagoras, Hey, you need to shave me and read 0:21:25.680 --> 0:21:29.960 my head. So that's exactly what happens. Aristagoras reads the message, 0:21:30.000 --> 0:21:36.520 starts a revolution against the Persians. Then Histius tells the king, Hey, 0:21:37.359 --> 0:21:39.320 this is gonna be a problem, so just send me 0:21:39.400 --> 0:21:42.320 back and I will go and squish this right away, 0:21:42.760 --> 0:21:45.679 and we'll solve this before it turns into a big problem. 0:21:45.680 --> 0:21:49.119 And of course they can a loyal advisor. Sure, yeah, 0:21:49.359 --> 0:21:52.760 So Histius heads on his way back. However, there were 0:21:52.800 --> 0:21:57.679 some folks who were a little suspicious of Histius and 0:21:57.840 --> 0:22:02.439 his convenient revolution, and so eventually his tas goes on 0:22:02.480 --> 0:22:05.159 the run because people are actually after him thinking that 0:22:05.200 --> 0:22:09.520 you know, he's he's committed treason. Uh, yeah, he has 0:22:09.600 --> 0:22:13.760 done that thing, and so he ends up getting exiled 0:22:13.800 --> 0:22:17.240 and eventually uh to an island. He becomes a pirate 0:22:17.320 --> 0:22:21.320 for a while, and then he's eventually captured by one 0:22:21.400 --> 0:22:24.400 of the King of Persia's subjects, who knows that if 0:22:24.400 --> 0:22:26.720 he sends Historius back to the king, the king will 0:22:26.760 --> 0:22:29.520 pardon him, so he just goes ahead and execute histi 0:22:29.720 --> 0:22:32.840 is right then and there, since the head of hist 0:22:33.119 --> 0:22:35.480 Is to the king saying, hey, I caught him. I 0:22:35.640 --> 0:22:38.680 killed him for you. And the king actually supposedly gave 0:22:38.920 --> 0:22:42.639 the head of his tis an honorable burial because he 0:22:42.760 --> 0:22:45.639 never suspected anything was up. He didn't believe his t 0:22:46.000 --> 0:22:52.919 is could have committed any kind of treason against him. So, uh, 0:22:53.000 --> 0:22:58.439 dumb or nice? Not a lot of nice stories in 0:22:58.480 --> 0:23:02.440 ancient Greece. And then you've got another one, another Herodotus, 0:23:02.760 --> 0:23:05.080 Another Herodotus story. I was about to mention it, and 0:23:05.080 --> 0:23:07.240 then I realized that I couldn't actually say his name. 0:23:07.760 --> 0:23:12.920 There was an exiled Greek named named Demeritus, and uh, 0:23:13.000 --> 0:23:16.360 he needed to warn the King of Sparta, Leonidas that 0:23:16.520 --> 0:23:19.119 kings are ses. The first was going to attack them, 0:23:19.160 --> 0:23:23.160 so he took writing tablets, which were wood tablets covered 0:23:23.200 --> 0:23:25.600 in wax. Yeah, and you would scratch a message into 0:23:25.680 --> 0:23:28.280 the wax, and instead he took off all the wax 0:23:28.359 --> 0:23:31.280 and scratched message into the wood and then recovered the 0:23:31.280 --> 0:23:33.760 tablets and wax so that they looked like they were 0:23:33.760 --> 0:23:36.040 blanked tablets. And he sent those to the king to 0:23:36.119 --> 0:23:41.800 warn him. Uh. But proposedly no one knew why they 0:23:41.800 --> 0:23:45.600 were getting these blank tablets. They didn't necessarily know there 0:23:45.680 --> 0:23:48.760 was a message. Why are we getting just we got 0:23:48.840 --> 0:23:51.280 plenty of tablets and no one writes anything of use 0:23:51.320 --> 0:23:55.600