Hiding Data in Plain Sight: Steganography from Mr. Robot to Real Malware
Encryption tells everyone you have a secret. Steganography tries to make sure nobody knows there's anything to look for.
Encryption and cryptography in general are used in ways where it's obvious the data is being protected. You see the scrambled blob and you know somebody's hiding something. Steganography goes the other way and aims to conceal the data from knowledge or view. In the world of bits and bytes, it hides data (encrypted or not) in places that are hard to discover. You can't decipher a secret message if you don't even know it exists!
This started as a discussion question about comparing steganography methods and their real-world uses. I've added a few of the real cases I found while researching it.
The three main flavors
| Method | Where the data hides | Strength | Weakness |
|---|---|---|---|
| Image | Pixel values (LSB), data tacked onto the file, metadata | Plenty of room, and the image looks normal | File size changes and forensic tools can detect it |
| Audio | Samples in the audio stream | Lots of data in a big stream | Compression, codec changes, or format conversion can destroy it |
| Network | Unused header fields, packet timing | Hides inside live traffic | Low throughput, and monitoring can catch it |
Image-based: Image steganography can hide information using Least Significant Bit (LSB) modification, which embeds data in the pixel values. Here's what that looks like. A red value of 182 is 10110110 in binary. To hide a 1, change the last bit and you get 10110111, which is 183. Nobody can see the difference between 182 and 183 in red. A 1,000 × 1,000 image has 3 million color values, so even at one bit each, that's about 375 KB of hidden data.
It doesn't have to be that complicated, though. At a less technical level, you can compress a text file and hide it within an image, for example by tacking it onto the end of the file. Exif data can also be altered. You could change an image's Exif data to hold an encryption key or hash, for example. (Strictly speaking, metadata is more hiding in plain sight than true steganography, but it's the same spirit.) The drawback is that changing the file size a lot gives it away, and analysis software and forensic tools can detect hidden information in images.
Audio-based: Audio steganography works in a similar way, by hiding data within the huge amount of information in an audio stream, and LSB modification works here too. The catch is that compression, codec changes, and format conversion can destroy or distort any hidden message.
Network-based: Network steganography embeds data in packets or manipulates packet timing to create a covert communication channel. You can also hide information in unused TCP/IP header fields, for example. The challenges are low throughput, and the fact that good network monitoring and anomaly analysis tools can detect it.
The Mr. Robot version
If you've never seen the series Mr. Robot, I highly recommend it. There's a great example of steganography in the show. The main character, Elliot, compulsively gathers information about everyone he knows by hacking their socials, bank accounts, and any other information he can find online. Obviously he doesn't want to keep it on his computer, because (if I remember right) he regularly destroys his hard drives and splits the pieces up. Elliot uses a steganography program to encrypt and hide his ill-gotta data within .mp3 music files, and burn them onto CD's. Anyone who were to find his vintage collection of bootleg music in a CD folio, would never suspect such data would be hidden on them, but they could at least enjoy the music