3

Steganography, the art of hiding information in "plain sight", is often taught in universities, because it seems immediately graspable to students. An image format where only 7 bits per byte are used can be (ab)used to hide 3 bits of information per pixel.

Unlike cryptography, steganography aims to protect the confidentiality of its information by hiding the fact that this communication channel exists.

How common is this approach in "real-world" applications? Are there documented cases of where steganography was used for something other than demonstration purposes?

I'm primarily interested in relatively "modern" applications, at least in applications since modern cryptography has become feasible enough for mass use.

Improve this question
4
  • Are you interested of the modern times aka computer era or from a historical perspective ?
    – Overmind
    Commented May 16, 2019 at 11:34
  • I'd say relatively modern, anything since encryption has become feasable for mass use. The fact that people in ancient times got information tatooed on their heads and then let hair grow over it is nice, but a bit besides the point for me.
    – user163495
    Commented May 16, 2019 at 11:35
  • Some might argue that encryption is yet to become feasable for mass use;)
    – Tobi Nary
    Commented May 16, 2019 at 11:48
  • @TobiNary I'd give TLS the official seal of "Eh, good enough. I guess"
    – user163495
    Commented May 16, 2019 at 12:02

1 Answer 1

Reset to default
7

Given your comment I will skip the historical info but if you want you can read it in this paper.

The answer to your end question is yes, it's being practically used. The following malware programs and cyberespionage tools are known to have used it:

  • KinS
  • Microcin
  • NetTraveler
  • Enfal (Zero.T loader);
  • Shamoon
  • Triton (Fibbit)
  • Zberp
  • ZeusVM

There are some advantages for its use in the cases of malware:

  • data (and the actual data transfer) can be better concealed

  • makes Anti-malware tools useless against such technique

  • bypasses Deep packet inspection (DPI)

  • can bypass Anti-Advanced Persistent Threat (AAPT) measures

  • steganography detection programs are today at a state of proof-of-concept having no practical reliability whatsoever

So basically, for deploying data to be used later, steganography is an excellent way to do it and in the specific case of malware and data retrieving advanced systems like KATA (Kaspersky Lab’s Anti-Targeted Attack) will only be able to help when something already bad starts to happen.

From a more peaceful perspective, I could just use images for password storage and no-one would never know and I did implement such a solution in practice. Imagine a standard password. Each character of it has a hex value. A bitmap's pixel values also have a hex value. With a very easy to construct program, you can store your password inside a bitmap by altering specific pixels with close values to your password's hex with the actual password character value. If the picture is unique (aka not from the internet so there's a comparison possibility) there is no way whatsoever to determine if a pixed has the original color code or it's something altered.

Improve this answer
6
  • I also recall some espionage-related stories, such as "Driving a red car means the operation will proceed" and "Driving a black car means operation will not proceed". I tried to find information regarding this, but legitimate information regarding espionage is hard to come by and often accompanied by lots and lots of fantasy.
    – user163495
    Commented May 16, 2019 at 12:01
  • Things may be as simple as if you get an e-mail or simple pic with a black cat, do the mission, if it's a picture of a white cat, cancel the mission. Btw, I did encounter a cat enthusiasts forum once and it ended up to be a hacking group communicating through cat pics steganography. It was hard to spot since many of them were actually passionate about cats and the topics were quite interesting and cat-relevant.
    – Overmind
    Commented May 16, 2019 at 12:48
  • This is brilliant! I wonder if this also happens on StackExchange?
    – user163495
    Commented May 16, 2019 at 12:54
  • 1
    @Overmind "I did encounter a cat enthusiasts forum once and it ended up to be a hacking group communicating through cat pics steganography" - That's intriguing. How did you determine that was the case?
    – dwizum
    Commented May 16, 2019 at 13:51
  • 1
    One of the cat pics I posted was quoted but the img link to it was another. I thought why would someone bother to re-up it since the original link worked. When I compared my original one with the other, I found a few dozen modified ASCII values in it and I was able to decrypt the message.
    – Overmind
    Commented May 17, 2019 at 5:10

You must log in to answer this question.