Steganography is the practice of hiding a secret message or data inside an ordinary-looking carrier, such as an image, audio file or network traffic, so that nobody suspects the hidden content exists.
How steganography works
Unlike encryption, which makes a message unreadable but visible, steganography conceals the fact that a message exists at all. The idea is ancient – Herodotus described messages hidden under wax on writing tablets – but digital techniques include:
- Least significant bit (LSB) embedding – changing the lowest bits of pixel or audio sample values, which is invisible to the human eye or ear;
- appending data after the end of an image file or hiding it in metadata;
- encoding data in unused protocol header fields, DNS queries or timing of network packets;
- using whitespace or invisible characters in text.
Steganography is often combined with encryption so that even extracted data is unreadable. Its detection is called steganalysis.
How attackers use steganography
MITRE ATT&CK lists steganography both as a form of obfuscation (T1027.003) and as a way to hide command traffic (T1001.002). Examples:
- the Stegano exploit kit, described by ESET in 2016, hid malicious script in the pixels of banner ads distributed through malvertising;
- malware loaders download harmless-looking PNG or JPEG images that contain the encrypted next-stage payload;
- some implants receive commands from a C2 server hidden in images posted on public websites or social networks;
- insiders can smuggle confidential data out inside images.
How to defend against it
- Rely on behavioural detection on endpoints – the hidden payload eventually has to run.
- Use content disarm and reconstruction (CDR) to re-encode images and documents at the gateway.
- Watch for unusual image downloads by scripts and anomalous outbound traffic.
Synonyms:
digital steganography, steganographic
