As defense mechanisms evolve, hackers have found new ways to deceive their target’s defenses to gain access to systems, data and gain foothold in their target’s environment without alerting the systems or raising suspicion. What are steganography attacks? What are their origins? Why are they so effective in deceiving defenses? Let us explore!

What is steganography?

Steganography is an ancient technique that hackers use to embed malicious code in seemingly unsuspicious images. When their targets download the image, it unloads malicious code laying the stages of their attack. Attackers use free image hosting services to increase their pool of targets.

The origins

The word steganography comes from a combination of ancient Greek words steganos (meaning concealed) and grafia (meaning writing). It is an ancient technique that goes way back to the Middle Ages, where texts were embedded using invisible ink on manuscripts to relay information that could be read by applying heat on the paper.

The Spartan king was warned of the Persian invasion without raising the suspicion of Xerces (the then ruler of Persia) using wax-coated tabs. The receiver could read the information by scratching off the wax coated surface.

There is a story from ancient Greece (late 6BC) about a tyrant named Histiaeus from Miletus who was held as a political prisoner in Susa by the King of Persia. He used steganography to communicate with Ionian rebels under Persian rule when he was held captive. He shaved the head of a slave and tattoed the head with a secret message with instructions for revolt. As hair regrew on the slave’s head, he would send the slave back to the Miletus, where he would look just like an ordinary person without getting caught. His supporters would shave the slave’s head to read Histiaeus’ messages of rebellion.

Different kinds of steganography attacks

Modern-day attackers use various mediums to carry out steganography attacks. They use text (.txt,.doc, etc.), images (.jpeg, .png, etc.), audio (mp3, .wav, etc.), and videos (.avi, .mp4, etc.). The most widely used medium is images since they are the most unsuspected by targets. They have an increased tendency to click on images. The most common steganography methods include:

• Text: format-based, linguistic, random & statistical generation
• Image: least significant bit insertion, masking & filtering, and encrypt & scatter 
• Audio:   Phase encoding, parity encoding, & spread spectrum
• Video: Data embedded into a compressed data stream or raw video

How does steganography attack work?

The following is how a typical steganography looks like. Modern day hackers use AI to make their phishing campaigns more convincing.

1. Phishing email (disguised as a promotional offer, invoice, etc.)
2. User downloads attachment
3. The malicious code in the file exploits vulnerabilities in the target system
4. The malicious script in the file downloads an image from an image-hosting website (like Imgur or Archieve.org)
5. The image contains a fully functional malicious executable file
6. The executable file activates malware like VIP keylogger or 0bj3ctivity information stealer
7. The Hacker steals data and records keystrokes, credentials, screenshots, etc.
8. Orchestrates a widespread data breach by infecting other systems.  

What makes steganography attacks dangerous?

The following are the aspects that make steganography attacks dangerous:

• Steganography attacks exploit trust. Majority people would open an unsuspecting image from a source for products exchange or customer query resolution
• They evade traditional detection systems like anti-virus and other scanning systems by embedding malicious codes into harmless image files
• Most users even some security people won’t normally suspect an image to be malicious
• A hacker can silently infiltrate a system and infect others
• These attacks can be a stealthy, persistent, and precise method for an attacker to orchestrate major attacks like data breach

What is the impact of a steganography attack?

The following are some ways the attack can impact an organization:

• Massive loss of sensitive customer data
• Compromise of systems
• Disruption in operation due to compromised systems
• Severe impact on business reputation due to disrupted operations and compromised data

How to prevent steganography attacks?

Since not many people are aware of steganography attacks, it is critical to raise awareness. Avoid clicking on unknown attachments (images/text/audio/video), always check the source of the email and verify the sender’s email address.

Take the assistance of cybersecurity experts to conduct phishing simulations so more people are aware of how to recognize phishing emails and the best practices to prevent phishing attacks.  Regularly assessing cybersecurity posture can assist in the early detection and mitigation of threats.

SharkStriker helps prevent threats like steganography attacks through continuous monitoring of the infrastructure for suspicious activities with its highly robust security platform, STRIEGO. With built-in SOAR, it analyzes infrastructure for suspicious behaviors, taking swift action upon detection of suspicious activities based on playbooks created by cybersecurity experts. The custom-crafted playbooks leverage the latest multi-sourced threat intelligence containing MITRE-based Tactics, Techniques, and Procedures that help organizations stay two steps ahead of advanced cyber threats that go undetected on traditional threat scanners.