Definition: Steganography is the practice of hiding information in harmless-looking carriers such as images, audio or video files, so that even the existence of the message stays hidden. Unlike cryptography, which makes content unreadable, it hides the fact that any communication is taking place at all.
What Does Steganography Mean?
The word comes from Greek. "Steganós" means covered or hidden, "gráphein" means to write. Steganography is therefore covered writing.
The goal: a message should not only be secret, but invisible. Anyone who does not know about it should not even suspect that it exists. The message sits inside a harmless carrier, such as a photo, a piece of music or a text.
A simple picture: cryptography is a locked safe. Everyone can see it, but no one can get in. Steganography is a secret compartment in a bookcase. No one knows it is there.
Steganography and Cryptography
- Cryptography makes the content unreadable. But it is obvious that a secret message exists. See encryption.
- Steganography hides the message itself. The content is not necessarily encrypted, but it is invisible.
In practice, the two are often combined. The message is first encrypted and then hidden. If it is found, it still cannot be read.
A Short History
- Antiquity: the historian Herodotus tells of a messenger whose head was shaved and a message tattooed on his scalp. Once his hair had grown back, he was sent off.
- Wax tablets: also from Herodotus: a message was carved into the wood of a writing tablet and covered with wax. The tablet looked blank.
- Around 1500: the abbot Johannes Trithemius wrote the work "Steganographia". It gave the technique its name.
- Invisible ink: lemon juice or milk only becomes visible when heated.
- World War II: microdots shrank whole pages to the size of a punctuation mark.
How Digital Steganography Works
Images
The best-known method is the LSB method (least significant bit). Each pixel consists of color values stored as numbers. The last bit of each number has hardly any effect on the color. If you replace it with one bit of the secret message, the color changes so little that no person can see it. A large photo has room for many pages of text this way.
Audio and Video
Sound and video files also contain many values that can be changed without anyone hearing or seeing it. Videos offer a lot of room because of their size.
Text
In texts, information can be hidden in spaces, line breaks or invisible Unicode characters. The text then looks quite normal but carries a second message.
Files and Networks
Data can also be appended to the end of a file, where programs ignore it. On a network, information can sit in rarely used fields of data packets or in the timing between packets. This is called network steganography.
Legitimate Uses
- Digital watermarks: photographers, publishers and film studios hide IDs in their works. This shows where a copy came from.
- Printer IDs: many color laser printers print tiny yellow dots on every page. They reveal the serial number and the time of printing.
- Protecting sources: journalists and people in authoritarian states use steganography to communicate unnoticed.
- Security training: in hacking contests (capture the flag), finding hidden data is a popular task.
Misuse by Attackers
For companies, steganography is above all a security risk. Attackers use it to get around protective systems:
- Hiding malware: malicious code sits inside a harmless-looking image. A small program loads the image and reads out the code. One example is the Stegoloader malware family, which became known in 2015 and hid code in PNG images.
- Sending commands: attackers hide control commands for infected computers in images on public websites. The traffic looks like normal browsing.
- Smuggling data out: stolen data is hidden in images or documents and sent away. See data exfiltration.
- Insiders: anyone who wants to take trade secrets with them can hide them in private holiday photos.
The malware takes advantage of the fact that images and videos are rarely checked closely. Read more under malware.
Detecting Steganography: Steganalysis
Finding hidden data is called steganalysis. There are several approaches:
- Statistics: hidden data changes how values are spread in a file. Statistical tests can find such patterns.
- Comparison: if the original is available, a comparison shows differences at bit level.
- Oddities: unusually large files, data after the end of a file or strange metadata are clues.
- Behavior: a program that keeps loading the same image and then runs code is suspicious. Malware analysis helps here.
Well-made steganography is still hard to detect. That is why companies tend to focus on prevention.
Protective Measures for Companies
- Rebuild files: content disarm and reconstruction (CDR) rebuilds incoming files. Hidden content is lost in the process.
- Re-encode images: simply saving or resizing an image again destroys a lot of hidden data.
- Monitor data leaving the company: data loss prevention (DLP) and network traffic analysis show when an unusual number of files leave the company.
- Protect endpoints: endpoint detection and response (EDR) spots suspicious behavior, even when the malicious code was well hidden.
- Remove metadata: before publishing documents and photos, delete their metadata.
- Raise staff awareness: even harmless-looking files can be a risk.
Conclusion
Steganography hides messages so that no one notices they exist. The technique is ancient and has legitimate uses such as digital watermarks. But attackers use it to hide malicious code and smuggle data out. Companies protect themselves best by cleaning files, monitoring data leaving the company and spotting suspicious behavior on endpoints.
FAQ about Steganography
What is steganography in simple terms?
Steganography is the art of hiding a message so that no one notices it exists. The message might sit invisibly inside a holiday photo, for example. Anyone who looks at the picture only sees the photo.
What is the difference between steganography and cryptography?
Cryptography makes the content of a message unreadable. Everyone can see that there is a secret message, but no one can read it. Steganography hides the message itself. No one suspects that any communication is taking place. The two can be combined: first encrypt, then hide.
Where does the word steganography come from?
It comes from Greek: "steganós" means covered or hidden, "gráphein" means to write. Steganography therefore means covered writing. The term became known through the work "Steganographia" by the abbot Johannes Trithemius around 1500.
How does steganography work in images?
The most common method is the LSB method (least significant bit). In each pixel, the last and least important bit of the color values is replaced by one bit of the secret message. The colors change so little that the human eye sees no difference.
Is steganography legal?
Yes, the technique itself is allowed. It is used, for example, for digital watermarks and to protect copyright. It only becomes a crime when it is used for crimes, such as spreading malware or smuggling stolen data out of a company.
How can steganography be detected?
Finding hidden data is called steganalysis. Statistical methods look for patterns that do not appear in normal files. Comparing a file with the original or looking for unusual file sizes also helps. Still, well-made steganography often cannot be detected with certainty.