What is Steganography? Types, Techniques, Examples & Applications

What Is Steganography?

A steganography technique involves hiding sensitive information within an ordinary, non-secret file or message, so that it will not be detected. The sensitive information will then be extracted from the ordinary file or message at its destination, thus avoiding detection. Steganography is an additional step that can be used in conjunction with encryption in order to conceal or protect data.

Steganography is a means of concealing secret information within (or even on top of) an otherwise mundane, non-secret document or other media to avoid detection. It comes from the Greek words steganos, which means “covered” or “hidden,” and graph, which means “to write.” Hence, “hidden writing.”

You can use steganography to hide text, video, images, or even audio data. It’s a helpful bit of knowledge, limited only by the type of medium and the author’s imagination.

Although the technique is centuries old, it’s still useful enough to make us justifiably pose the question, “What is steganography in cyber security?” But before we explore its uses in today’s cyber security field, let’s get more acquainted with the overall concept by looking at some steganography examples, then wrap things up with a fun little exercise.

Also Read: Why is Cybersecurity Important in 2022?

Different Types of Steganography

1. Text Steganography − There is steganography in text files, which entails secretly storing information. In this method, the hidden data is encoded into the letter of each word. 

2. Image Steganography − The second type of steganography is image steganography, which entails concealing data by using an image of a different object as a cover. Pixel intensities are the key to data concealment in image steganography.

Since the computer description of an image contains multiple bits, images are frequently used as a cover source in digital steganography.

The various terms used to describe image steganography include:

• Cover-Image - Unique picture that can conceal data.
• Message - Real data that you can mask within pictures. The message may be in the form of standard text or an image.
• Stego-Image − A stego image is an image with a hidden message.
• Stego-Key - Messages can be embedded in cover images and stego-images with the help of a key, or the messages can be derived from the photos themselves.

3. Audio Steganography − It is the science of hiding data in sound. Used digitally, it protects against unauthorized reproduction. Watermarking is a technique that encrypts one piece of data (the message) within another (the "carrier"). Its typical uses involve media playback, primarily audio clips.

4. Video Steganography − Video steganography is a method of secretly embedding data or other files within a video file on a computer. Video (a collection of still images) can function as the "carrier" in this scheme. Discrete cosine transform (DCT) is commonly used to insert values that can be used to hide the data in each image in the video, which is undetectable to the naked eye. Video steganography typically employs the following file formats: H.264, MP4, MPEG, and AVI.

5. Network or Protocol Steganography − It involves concealing data by using a network protocol like TCP, UDP, ICMP, IP, etc., as a cover object. Steganography can be used in the case of covert channels, which occur in the OSI layer network model.

Steganography Examples Include

• Writing with invisible ink
• Embedding text in a picture (like an artist hiding their initials in a painting they’ve done)
• Backward masking a message in an audio file (remember those stories of evil messages recorded backward on rock and roll records?)
• Concealing information in either metadata or within a file header
• Hiding an image in a video, viewable only if the video is played at a particular frame rate
• Embedding a secret message in either the green, blue, or red channels of an RRB image

Steganography can be used both for constructive and destructive purposes. For example, education and business institutions, intelligence agencies, the military, and certified ethical hackers use steganography to embed confidential messages and information in plain sight.

On the other hand, criminal hackers use steganography to corrupt data files or hide malware in otherwise innocent documents. For example, attackers can use BASH and PowerShell scripts to launch automated attacks, embedding scripts in Word and Excel documents. When a poor, unsuspecting user clocks one of those documents open, they activate the secret, hidden script, and chaos ensues. This process is a favored ransomware delivery method.

Steganography has a huge advantage over standard cryptographic methods. When someone uses cryptography, they’re passively calling attention to the fact that there’s secret information present in the medium in question. Thus, the very presence of encrypted data tells intruders, “Aha! Here’s some secret information!” Steganography, however, hides the sensitive information in an otherwise innocuous document. Therefore, would-be hackers have no idea that there is anything secret and enticing in the first place.

Also Read: Understanding Cryptography

Steganography vs. Cryptography

It's fair to say that steganography and cryptography aim to shield messages and data from prying eyes at their most fundamental level. However, they employ an alternative means of security.

Information is converted into unintelligible ciphertext in cryptography. Someone intercepting this message could tell immediately that encryption was used. In contrast, steganography hides a message without altering its original format.

How Steganography Differs From Obfuscation?

Obfuscation, like steganography, is defined as hiding information, but the big difference is that the former method deliberately makes the message hard to interpret, read, or decode. That makes sense since to obfuscate means to render something unclear, unintelligible, or obscure. 

Cyber-security professionals employ obfuscation to protect sensitive information such as programming codes. The process makes it difficult for hackers to read the codes in the first place, which in turn prevents them from exploiting the data. 

To sum it up, while steganography is a form of obfuscation, the reverse doesn’t apply. 

Steganography Techniques Explained

Now that we have a better grasp on what steganography is, what forms it comes in, and who uses it, let’s take a closer look at a sample of the available techniques.

• Secure Cover Selection

Secure Cover Selection involves finding the correct block image to carry malware. Then, hackers compare their chosen image medium with the malware blocks. If an image block matches the malware, the hackers fit it into the carrier image, creating an identical image infected with the malware. This image subsequently passes quickly through threat detection methods.

• Least Significant Bit

That phrase almost sounds like a put-down, doesn’t it? However, in this case, it refers to pixels. Grayscale image pixels are broken into eight bits, and the last bit, the eighth one, is called the Least Significant Bit. Hackers use this bit to embed malicious code because the overall pixel value will be reduced by only one, and the human eye can’t detect the difference in the image. So, no one is even aware that anything is amiss, and that the image is carrying something dangerous within.

• Palette-Based Technique

Like the Least Significant Bit technique, the Palette-Based Technique also relies on images. Hackers embed their message in palette-based images such as GIF files, making it difficult for cybersecurity threat hunters or ethical hackers to detect the attack.

Steganography Tools

Various tools or software that support steganography are now readily accessible. Though most hide information, some provide additional security by encrypting it beforehand. You can find the following free steganography resources online:

• Steghide: Steghide is a free tool that uses steganography to conceal information in other files, such as media or text.
• Stegosuite: It is a Java-based, free steganography tool. Stegosuite makes it simple to obfuscate data in pictures for covert purposes.
• OpenPuff: It is a high-quality steganographic tool that allows you to conceal data in other media types like images, videos, and Flash animations.
• Xiao Steganography: To conceal information in BMP images or WAV files, use the free Xiao Steganography tool.
• SSuite Picsel: The free portable program SSuite Picsel is yet another option for hiding text within an image file; however, it uses a somewhat different method than other programs.

These are only a few of the steganography tools available. However, these instruments will help you achieve your goals.

Advantages of Steganography

Steganography is a method that makes it easy to conceal a message within another to keep it secret. The result is that the hidden message remains hidden. A steganography approach can benefit images, videos, and audio files. Further advantages include:

• Unlike other methods, steganography has the added benefit of hiding communications so well that they receive no attention. However, in countries where encryption is illegal, sending an encrypted message that you can easily decipher will raise suspicion and may be risky.
• Steganography is a form of encryption that protects the information within a message and the connections between sender and receiver.
• The three essential elements of steganography—security, capacity, and robustness—make it worthwhile to covert information transfer via text files and develop covert communication channels.
• You can store an encrypted copy of a file containing sensitive information on the server without fear of unauthorized parties gaining access to the data.
• Government and law enforcement agencies can communicate secretly with the help of steganography corporations.

Using Steganography to Deliver Attacks

These days, attacks are typically automated using PowerShell or BASH scripts. And so are hackers. Excel and Word documents with macros enabled have been a common vector for attacks. The hidden script is triggered when the target opens the malicious Word or Excel file.

The attacker can access the system without the victim being duped into installing Steghide. The intruder is using a steganographic program to take advantage of widespread Windows tools like Excel and PowerShell. Once the victim reads the document, it becomes easier for the hacker to attack the system.

Artificial Intelligence and Steganography

Hackers are also using artificial intelligence (AI). Steganography is just one of the many methods that artificial intelligence is increasingly employing to conceal its activities. AI implementations have tweaked even steganographic techniques to make attacks harder to detect.

Detecting Steganography

In their line of work, security analysts look for indicators of standard attack and penetration testing strategies (TTPs). The common signatures used by steganographic software have been uncovered over time. Because of this, antivirus software, for example, can easily spot the common behaviors of steganographic programs.

As a result, penetration testers and attackers constantly adjust their methods to stay undetected. Likewise, security researchers continuously look for new signatures and attack tactics, while cybercriminals continually adapt their tools and approaches.

Real-World Attacks That Used Steganography

In 2020, businesses in the United Kingdom, Germany, Italy, and Japan were hit by a campaign using steganographic documents.

Hackers could avoid detection by using a steganographic image uploaded on a good platform, like Imgur, to infect an Excel document. Mimikatz, a malware that steals Windows passwords, was downloaded via a secret script included in the picture.

Mitigating Steganography-Based Attacks

Steganography is simple to implement during a cyber attack. However, it's much harder to prevent since the people who pose a threat are getting more resourceful and ingenious, which makes developing countermeasures more difficult. 

Code disguised in images and other sorts of obfuscations are more likely to be discovered dynamically by a behavioral engine. Therefore businesses should use modern endpoint protection solutions that extend beyond static checks, elemental signatures, and other old-fashioned components.

Employees should be aware of the risk of opening image files, as they may contain viruses. In addition, the newest security patches should be installed whenever they become available, and firms should use web filtering to ensure their employees can safely browse the web.

Let’s Check Out Some Popular Steganography Applications

There are many kinds of dedicated software applications available to facilitate steganography. Here is a partial list of the more well-known steganography applications:

• Image Steganography: This application is a JavaScript tool used to hide images in other image files
• OpenStego: This program is an open-source steganography tool
• Xiao Steganography: Xiao hides secret files in WAV or BMP files
• Crypture: This application is a command-line tool used to conduct steganography
• NoClue: This application is an open-source tool that hides text information in both video and image carrier files
• Steganography Master: This app is an Android-based open-source tool that can hide text in an image and gives you a decoding tool to pull hidden text messages from image files. It supports multiple image formats (BMP, JPG, ICO, PNG)
• Steghide: Steghide is an application that hides data in different audio and image files, including JPEG, BMP, AU, and WAV

Are You Interested in a Cyber Security Career?

Whether you’re interested in steganography or not, cyber security is a field with a lot to offer for someone who wants an exciting challenge mixed in with a great career that offers security and excellent benefits.

Simplilearn’s Post Graduate Program in Cyber Security is designed to teach you the skills you need to become an expert in the fast-growing field of cyber security.  The course offers you a comprehensive approach to protecting your organization’s infrastructure and securing its data, including topics like cloud-based security, risk analysis and mitigation, and compliance. In addition, you will gain a range of skills from foundational to advanced via industry-leading cyber security certification courses.

This course is well-suited for professionals who want to upskill since it helps you stay abreast of all the latest cybersecurity trends. However, if upskilling is your priority, you should consider widening your cybersecurity-related skill range by taking Simplilearn’s CISSP Certification Training Course and developing your expertise in defining IT architectures and in designing, building, and maintaining secure business environments, using globally approved information security standards.

According to Indeed, Network Security Engineers in the United States earn about USD 114,060 a year. Meanwhile, in India, a Security Analyst who has cyber security skills can earn an average of ₹491,643 per year, according to Payscale.

And Now, the Hidden Message Solution…

As for the mystery message above, read it again, but take note of the first letter of each sentence. That’s an example of steganography. Can you see the top-secret message now? That paragraph is a form of an acrostic, a composition with a hidden word or phrase, and is just another form of steganography.

So, what are you waiting for? Check out Simplilearn's Advanced Executive Program In Cyber Security today and take that initial step to an exciting and rewarding career in the ever-growing and much-in-demand world of cybersecurity professionals!