Which Of The Following Is A Place Where Steganography Can Hide Data?

Steganography is the practise of hiding a surreptitious bulletin in something that is not secret. Just cyber attackers utilize steganography to practise more than share messages.

IT pro typing on laptop cybersecurity

One of the first things I recollect doing as a kid was writing underground messages to friends using invisible ink. I was only near viii or 9 at the time, so I used the tools my mom unwittingly made available: Lemon juice and an iron. I wrote my cloak-and-dagger bulletin on a piece of newspaper and then told my friend to use an atomic number 26 or even a match – some sort of oestrus source – to fire the lemon juice a flake, turning it brown. This revealed the clandestine message I wanted to share. Ever do that yourself? Well, if you have, you and I have engaged in the fourth dimension-honored exercise of steganography.

What Is Steganography?

Steganography is the practice of hiding a secret message inside of (or even on pinnacle of) something that is non surreptitious. That something can be just about anything you want. These days, many examples of steganography involve embedding a hugger-mugger slice of text within of a picture. Or hiding a secret bulletin or script inside of a Give-and-take or Excel document.

The purpose of steganography is to muffle and deceive. Information technology is a grade of covert communication and can involve the apply of any medium to hibernate messages. It's not a form of cryptography, because it doesn't involve scrambling data or using a key. Instead, it is a course of data hiding and can be executed in clever ways. Where cryptography is a science that largely enables privacy, steganography is a practise that enables secrecy – and deceit.

How Steganography Is Used Today

Steganography has been used for centuries, merely these days, hackers and It pros have digitized information technology to practise some pretty creative things. In that location are a number of apps that can exist used for steganography, including Steghide, Xiao, Stegais and Darkening.

The discussion steganography seems fancy, simply it actually comes from a fairly normal place. The root "steganos" is Greek for "subconscious" or "covered," and the root "graph" is Greek for "to write." Put these words together, and y'all've got something close to "hidden writing" or "secret writing."

Here'due south an instance of how digital steganography works. A friend of mine sent me a steganographic bulletin – a secret bulletin embedded within an image. The prototype was a photo that I had previously sent him of a geyser I had paddled to while on Yellowstone Lake concluding summer.

figure_1

To embed his cloak-and-dagger bulletin to me, my friend then issued the commands shown in Figure 2.

figure_3

With my own copy of Steghide (bachelor in Windows, Linux and Mac), I used the command sequence shown in Figure 3 to extract that hush-hush message. I and then read it using the cat command.

figure_2

Apparently, my friend is a fan of the classic movie Christmas Story and somehow felt the demand to repeat Little Orphan Annie's reminder for us all to keep up with our nutrition: "Be sure to potable your Ovaltine."

This is a little example of how steganography has been used over the decades. But over time, penetration testers and attackers alike accept been using steganography to do more than share messages.

Using Steganography to Deliver Attacks

Today, attackers use PowerShell and BASH scripts to automate attacks. And then are pen testers. For example, attackers have been embedding actual scripts within macro-enabled Excel and Word documents. Once a victim opens the Excel or Word doc, they activate the embedded, surreptitious script.

The attacker doesn't demand to trick the user into using applications such equally Steghide. In this case, the hacker – or pen tester – is "living off the land." The assailant is using a steganographic application to accept advantage of common Windows applications and features such as Excel and PowerShell. All the victim needs to do is read the md, and an unfortunate serial of events begins to occur.

First, the victim clicks on an Excel document that an attacker has modified using steganography.
That click unleashes a hidden PowerShell script.
This script then installs an installer app into the Windows computer. This installer app moves chop-chop and is so subtle that typical antivirus applications don't notice information technology.
This downloader then goes out to the internet and grabs updated versions of malware such as URLZone (or more recent tools) that then compromise the victim'southward calculator.

Over the years, attackers take used the procedure above to deliver ransomware such as Snatch. Hackers take installed sophisticated malware that is cablevision of keylogging, enlisting computers into DDoS botnets or installing trojans, such equally the latest variants of Rovnix and Pillowmint. The list goes on.

Artificial Intelligence and Steganography

We're also seeing attackers add together artificial intelligence (AI) into the mix. Increasingly, we're seeing AI uses of various tactics, including steganography, to hibernate information. AI implementations have even been able to alter steganographic techniques then that attacks can't be easily discovered.

Detecting Steganography

Security analysts work to place the tactics, techniques and procedures (TTPs) of attackers and pen testers. Over the years, they take identified typical signatures that steganographic applications use. This is why antivirus applications, for example, can identify typical moves made by steganographic applications.

Therefore, pen testers and attackers morph and modify their procedures to thwart detection. And so the true cat and mouse game continues: Attackers constantly change tools and techniques, and security analysts constantly await for new signatures and methods.

CompTIA Cybersecurity Analyst (CySA+) validates the skills needed by cybersecurity analysts, including steganography. Download the exam objectives for gratis to see what skills yous need to exist a cybersecurity analyst.