Is it possible to put malware in an audio file with steganography?

Question

I have recently read malware being hidden in a "usable" picture file with stenography such as this forum, https://www.bleepingcomputer.com/forums/t/574487/is-it-possible-for-a-virus-to-be-embedded-in-a-image/ .

Could a malicious hacker use similar methods on an audio file?

There are similar questions on various sites about malware in an audio such as this, https://forums.malwarebytes.com/topic/140812-can-an-mp3-file-contain-malware/, but my question is specifically related to the tactic of steganography.

Answer 1

Transmitting any data inside a playable audio file is already steganography by definition. Humans don't normally inspect the bytes inside an audio file, so any data placed in it that evades detection under normal use is hidden, regardless of whether you classify it as malware.

Other common malware techniques used to evade detection, such as polymorphism and encryption, may contribute to the masking of the hidden data but aren't necessarily steganography.

I don't know if you'd consider it steganography if the data were simply placed in an ID3 tag in an MP3 file, because those tags exist for a human to view and use (with suitable tools, of course.) But if the bulk of the malicious data was encoded in the music itself (like some of the audio watermarking technologies), that would certainly qualify as steganography as I understand it.

For that matter, the data could be hidden steganographically in the embedded JPG image of the album cover, and that would fit pretty much every definition out there.

Answer 2

In the context of malware, stenography means hiding most of the payload in the media portion of the file so that as little attack code as possible might be recognizably malware to an AV program.

Could a malicious hacker use similar methods on an audio file?

In principle, yes. In practice, stenography of any kind is not really used by malicious hackers. It's too much trouble for too little benefit. You still need some kind of exploit code that an AV can pick up on. Stenography doesn't solve any real-world problem from the perspective of malicious hackers.

Answer 3

There is a strong difference between encryption and steganography. The former rely on a strong algorythm and a key to make the content undecypherable, but does not try to hide the existence of a secret information. The latter uses weaker technics and relies on the fact that the presence of a secret information is hidden.

Both can be used to transport any type of information, including malware. But AFAIK there in no common implementation of steganography in browsers, mailers nor in any media reader. So the attacker will first need to deploy a code able to extract the malicious content from an innocent file. So only relying on stegano will be like a chicken and egg problem. And if the attacker is able to deploy its code, why not directly include the malicious content there?

The only use case I can imagine would be something like a hidden bomb that will seat inside an innocent looking application an patiently scan media files to see whether they contain interesting info. But IMHO this is more what governmental agencies could use than the average evil guy...