Steganography

https://georgeom.net/StegOnline/upload

• Steganography Tools
• Steganography - WAV
• Natural text steganography
• Steganography - In the wild
• Steganalysis

Types of Steganography

• Document Steganography
• Audio Steganography
• Video Steganography
• Image Steganography

Stego CTF Checklist

• file
• strings
• exiftool
• binwalk
• pngcheck
• steghide

Tools for Hiding Inforamtion

• Snow
• Openstego
• StegoStick
• OmniHide Pro

Audio

• DeepSound

Folder

• Gillsoft File Lock Pro

Writeup

• PlaidCTF 2015
• SECCON Quals 2015

Steganography is defined as the technique of hiding a secret message within an ordinary message and extracting it at the destination to maintain the confidentiality of data.

The core idea of steganography is to hide the existence of a message. This distinguishes it from cryptography, which ensures confidentiality by encrypting a message, making it unreadable without the key, but still discloses the presence of the encrypted message. Steganography provides "security through obscurity".

An attacker who has successfully compromised a system may also use steganography techniques to hide malicious code or files, or to cover their tracks.

Core Concepts and Components

Steganography hides data "behind" other data without the knowledge of the user.

• Cover: The ordinary message or medium used to conceal the secret message.
• Message: The secret information being hidden.
• Stego-Object (or Stego Medium): The resulting file or object containing the hidden message within the cover medium.
• Process: The message is embedded using an Embedding Function and retrieved using an Extracting Function.

The hidden data can be in the form of plaintext or ciphertext. Steganography uses the bits of unused data in ordinary files, such as images, text, audio, and video, with other surreptitious bits.

Classification of Steganography

Steganography is generally classified into two main areas based on the technique used: Technical Steganography and Linguistic Steganography.

1. Technical Steganography

Technical steganography uses physical or chemical methods, including invisible ink, microdots, and other means, to hide the existence of a message.

A. Non-Computer-Based Methods:

• Invisible Ink (or "security ink"): Used for invisible writing with colorless liquids that can later be made visible by certain pre-negotiated manipulations, such as lighting or heating. Applications include espionage, anti-counterfeiting, and property marking.
• Microdots: A text or image condensed in size (with the help of a reverse microscope), fitting up to one page in a single dot, used to avoid detection by unintended recipients.

B. Computer-Based Methods:

These methods change digital carriers to embed information foreign to the native carriers. Communication can occur in the form of text, binary files, disk and storage devices, and network traffic and protocols.

Computer-based techniques are further divided into six categories based on modifications applied during the embedding process:

1. Substitution Techniques: The attacker substitutes the bits used to encode the secret message by substituting insignificant bits with the secret message. The receiver must know the locations where the attacker embeds secret information.
2. Transform Domain Techniques: These techniques hide the information in the significant parts of the cover image, such as cropping, compression, and other image processing areas, making it difficult to carry out attacks. Transformations can be applied to blocks of images or over the entire image.
3. Spread Spectrum Techniques: This method is less susceptible to interception and jamming. Communication signals occupy more bandwidth than required, and the sender increases the band spread by means of code. The receiver uses a synchronized reception with the code to recover the information from the spread spectrum data.
4. Statistical Techniques: This utilizes the existence of "1-bit" steganography schemes by modifying the cover in such a way that the transmission of a "1" occurs. The statistical characteristics of the original cover remain unchanged, making it difficult to distinguish between modified and unmodified covers.
5. Distortion Techniques: The user obtains a stego-object by implementing a sequence of modifications to the cover. The receiver must measure the differences between the original cover and the received cover to reconstruct the sequence of modifications.
6. Cover Generation Techniques: Digital objects are developed specifically to cover secret communication. When this information is encoded, it ensures the creation of a cover for secret communication.

2. Linguistic Steganography

Linguistic steganography hides the message in the carrier of another file. It includes Semagrams and Open Codes.

• Semagrams: The user embeds some objects or symbols in the data to change the appearance of the data to a predetermined meaning.
  • Visual Semagrams: Hiding information in a drawing, painting, letter, music, or a symbol.
  • Text Semagrams: Hiding the message by converting or transforming the appearance of the text medium, such as changing font sizes and styles, or adding extra spaces/whitespaces in the document.
• Open Codes: The secret message is hidden in a legitimate carrier message visible to everyone. The open-code technique consists of two main groups: Jargon Codes and Covered Ciphers.
  • Jargon Codes: Use a language understood by a particular group of people, making it appear meaningless to others. A jargon message is like a substitution cipher in many respects, but instead of replacing individual letters, the words themselves are changed.
  • Covered Ciphers: Hiding a message in a carrier medium visible to everyone. This technique is often extracted by any person with knowledge of the method used to hide it. Covered ciphers include Null Ciphers and Grille Ciphers.
    • Null Ciphers: Hide the message within a large amount of useless data. The original data are mixed with unused data in any order (horizontally, diagonally, vertically, or in reverse) so that no one can understand it.
    • Grille Ciphers: Encrypt plaintext by writing it onto a sheet of paper through a pierced (or stenciled) sheet of paper or similar material.

Types of Steganography based on Cover Medium

Steganography is also classified based on the medium used to conceal the message:

• Image Steganography: Uses images as cover objects. This is the most popular method. Techniques include image domain (spatial) and transform domain (frequency) techniques. One image technique is substituting the least significant bit (LSB) of each pixel file, as these bits have very little effect on the image if altered. Tools include OpenStego, StegOnline, Coagula, SSuit Picse, and CryptaPix.
• Document Steganography: Hides secret messages transferred in the form of documents, including the addition of whitespaces and tabs at the ends of lines. Tools include StegoStick and SNOW.
• Video Steganography: Hides files within video files in various formats (AVI, MP4, WMV, etc.). Discrete cosine transform (DCT) manipulation is used to add secret data at the time of the transformation process. Tools include OmniHide Pro and StegoStick.
• Audio Steganography: Hides embedded messages in a digital sound format (WAV, FLAC, AU, etc.). Methods include Echo Data Hiding, Spread Spectrum Method (DSSS and FHSS), LSB Coding, Tone Insertion, and Phase Encoding. Tools include DeepSound and StegoStick.
• Folder Steganography: Hides secret information in folders; files are hidden and encrypted within the folder, and Windows Explorer cannot display them. Tools include Gilisoft File Lock Pro and Folder Lock.
• Web Steganography: Hides web objects behind other objects and uploads them to a web server.
• Spam/Email Steganography: Sending secret messages by embedding them and hiding the embedded data in spam emails. The Spam Mimic tool can hide a secret message in an email.
• Natural Text Steganography: Converting sensitive information into user-definable free speech.
• Whitespace Steganography: Conceals messages in ASCII text by adding whitespaces to the ends of lines. The Snow program is used for concealing messages by appending tabs and spaces to the ends of lines.
• Hidden OS Steganography: Hiding one OS in another.
• C++ Source-Code Steganography: Hiding a set of tools in the files.
• Compressed Data Steganography: Hiding information in the least significant bit or reserved bits of a compressed file or data.

Attacker Use and Evasion

Attackers use steganography for multiple malicious purposes:

1. Hiding Malware: Attackers can inject malicious content or instructions into images, audio, or multimedia files to evade detection by security controls like IDS or EDR solutions. The malware can read instructions hidden in photos and act accordingly.
2. Hiding Tools/Plans: Attackers can insert information such as source code for a hacking tool, a list of compromised servers, plans for future attacks, and communication channels as part of a steganographic attempt.
3. Covering Tracks: After a malicious operation, an attacker can use steganographic techniques to hide evidence of security compromise.

Steganalysis (Detection)

Steganalysis is the reverse process of steganography: discovering the existence of hidden information in a medium and, if possible, recovering the message.

Steganalysis attempts to detect variance between bit patterns and unusually large file sizes. If the message was encrypted before being embedded, the security professionals may find the encrypted file but find the message remains hidden because the encryption is often infeasible to break.

Steganalysis Methods/Attacks include:

• Stego-only Attack: The steganalyst only has access to the stego object (the medium containing the hidden message) for analysis.
• Known-stego Attack: The attacker has access to the stego object and the steganography algorithm used to hide the message.
• Known-message Attack: It is presumed that the message and the stego medium are known. The goal is to determine the technique used to hide the message.
• Known-cover Attack: Attackers know both the stego-object and the original cover medium, enabling a comparison between the two to detect changes and find the hidden message.
• Chosen-message Attack: The steganalyst uses a known message to generate a stego-object using various tools to determine patterns pointing to specific tools or algorithms.
• Chosen-stego Attack: The steganalyst knows both the stego-object and the steganography tool or algorithm used.
• Chi-square Attack: A probability analysis method to test whether the stego-object and original data are the same or not, indicating if data is embedded inside.
• Distinguishing Statistical Attack: Analyzes the embedded algorithm to detect distinguishing statistical changes along with the length of the embedded data.
• Blind Classifier Attack: Feeds a blind detector with original data to train a classifier to detect differences between the stego-object and the original data.

Detection tools include zsteg (for stego-hidden data in PNG and BMP images), StegoVeritas, Stegextract, StegoHunt, Steganography Studio, and Virtual Steganographic Laboratory (VSL).