Steganography

Steganography hides information inside another medium (image, audio, text, network) so that its very existence goes unnoticed —unlike encryption, which hides the content but not the fact that a message exists. It’s a CTF classic (forensics/stego category) and shows up in exfiltration and covert C2.

Steganography vs cryptography

Cryptography    the message is visible but unreadable (you can tell something is encrypted)
Steganography   the message is INVISIBLE (it looks like a normal photo/audio)
Combined        encrypt + hide = confidentiality + no suspicion (the robust approach)

Common techniques

LSB (Least Significant Bit)  change the least significant bit of each pixel/sample
                             -> imperceptible changes that encode data
Metadata/EXIF                text hidden in image fields (comments, GPS)
Append / data after EOF      attach a ZIP/file after the JPEG/PNG end (polyglot)
Audio spectrogram            draw text/image visible when viewing the WAV spectrum
Text stego                   spaces/zero-width chars, capitalization, whitespace
Network                      data in packet headers/timing (covert channel)

Analysis workflow (CTF / forensics)

# 1. basic inspection
file suspicious.png ; exiftool suspicious.png ; strings -n 8 suspicious.png
binwalk suspicious.png              # embedded files? -> binwalk -e to extract
# 2. data after EOF / polyglot
foremost / dd to split off the appended file; direct unzip sometimes works
# 3. images: bit planes and LSB
zsteg image.png                     # PNG/BMP: detects LSB and common payloads
stegsolve                           # explore color/bit planes by hand
steghide extract -sf image.jpg      # JPEG/WAV with passphrase (brute with stegseek)
# 4. audio
sonic-visualiser / Audacity -> view the SPECTROGRAM; check channels and speed

Breaking stego with a passphrase

stegseek image.jpg rockyou.txt      # very fast brute force of steghide
# also try passphrases from the challenge/engagement context

Tools

binwalk, foremost (extracting embedded files), exiftool (metadata), strings.
zsteg (PNG/BMP LSB), stegsolve, steghide + stegseek (JPEG/WAV), sonic-visualiser (audio).
CyberChef to decode what you extract; AperiSolve (online, aggregates several tools).

Defense / detection

- statistical steganalysis (detect LSB anomalies: chi-square, StegExpose)
- sanitization: re-compress/normalize images and strip metadata on input (DLP)
- on the network: inspect covert channels (anomalous sizes/timing, see mal-c2)

CVEs and real-world cases

Stegosploit and multiple malware campaigns hiding payloads/C2 in images (PNG/JPEG) to evade detection.
APTs using steganography for exfiltration and to hide configs in published images (MITRE T1027.003 Steganography).
Recurring use in forensics CTFs as the first filter on challenges.

Testing checklist

file + exiftool + strings as the first sweep
binwalk/foremost: embedded files or data after EOF?
Images: zsteg/stegsolve for LSB and bit planes
steghide/stegseek with a dictionary for JPEG/WAV
Audio: check the spectrogram (sonic-visualiser/Audacity)
Text: zero-width / whitespace stego
Decode findings in CyberChef (may be encrypted)