Steganography

Every steganographic technique has three parts: a carrier, a payload and, almost always, a key. The carrier is the file or channel that will hold the hidden message, and it works because it contains redundancy nobody looks at. A photograph has millions of pixels whose last bit changes nothing the eye can see, and that is where the payload goes: the classic least significant bit technique. In text the game is played with spacing and zero-width characters, and in audio with amplitude changes below the threshold of hearing.

The same principle works on network traffic rather than on a file: header fields the protocol does not use, or simply the timing between packets. DNS tunnelling belongs to that family, where what is carried is not hidden in an image but in queries that look ordinary.

One trade-off decides which technique is good for what: the more payload you push in, the more it shows, and the more robust you want the payload to be, the less of it fits. An image that gets recompressed or resized on the way destroys a naive payload, so anyone using this seriously picks the carrier around what will happen to it in transit.

Steganography stops being an academic exercise when malware uses it, and it uses it for two different jobs. The first is fetching instructions: a sample downloads an ordinary image hosted on a legitimate service and reads its configuration or its next stage out of it. To anyone watching the network that is not a connection to a suspicious server, it is somebody downloading a picture, and that is where a command and control channel stops looking like the thing being hunted.

The second is moving data out. A data loss prevention control that decides on file type, extension and what it finds inside sees a photograph, because a photograph is exactly what it is. The rule looking for a card number or a document pattern finds nothing, and it has not failed: it was handed something else to look at.

Detecting it by examining the file is expensive and unreliable. Steganalysis leans on statistics, on carriers whose low bits are too uniform or too random, and it produces false positives easily. In a real investigation the signal that pays off is almost never the image: it is the tool that wrote it, its traces on the machine and the configuration it left behind.

On a red team engagement steganography is not used for show, it is used to answer a specific question the client asked: if somebody moves information out, does anyone notice? We build an exit that does not look like one and measure what stops it. If the only thing between the data and the street is a rule matching extensions, the finding is not written against the technique, it is written against egress filtering: which destinations an internal machine can reach, and who reviews what leaves.

In digital forensics the question runs the other way. You do not start by asking whether this image hides something, because that cannot be answered across a whole disk in any reasonable time. You start with the machine: which tools were installed, what ran and when, and which files were touched around that hour.