Use cases of Steganography

“Twenty-one of the 25 top news organizations globally are targeted by state actors, said Morgan Marquis-Boire, director for security at First Look Media. Major media outlets continue to set aside insufficient budgets, if any, to protect their information, he added, and as a result, the onus falls to the reporter to educate and protect themselves” (Ekwo 2015).

“A Pew Research Center study, surveying 2,723 practicing journalists and evaluating the 671 respondents showed half of the journalists working for a news organization (88 percent of respondents) said their organization is not doing enough to protect them and their sources. The same study found 71 percent of journalists had little or no confidence that ISPs could protect their data, and only two percent had a lot of confidence.” (Ekwo 2015)

The Guardian newspaper provides the facility of “Secure Drop”, which provides a Tor backed encryption facility to assist with anonymity. It is suggested that steganography is used as part of this process.

The open source tool Camera/Shy created by international hacker group Hacktivismo provides a method of communication for activists operating behind national firewalls or alternatively those who are under oppressive regimes in order to overcome Internet censorship. They had released this tool with the intention of assisting Chinese dissidents communicate. Hactivismo has over thirty associates from North America, Europe, Russia, Israel, Australia, Taiwan, and Korea.

Terrorist factions such as Al-Qaeda, Hamas and Hezbollah are some that have been suspected of the use of steganography. Using steganography to embed maps and communication to their followers.

Reports previously have been in the news detailing how terrorists have communicated using videos as a cover file.Computer forensic experts from the German Federal Criminal Police (BKA) discovered a pornographic video file name “kick-ass.mov”, when they arrested a suspected Al-Qaeda member in Berlin, 2011. They had found over 100 files detailing operations and plans within this video; such as “Lessons Learned”,  “Report on Operations” and “Future works”. Fortunately for them it was not encrypted. This could have been uploaded to one of the 4.2 + million  possible pornographic sites on the internet . Thus making the carrier files extremely accessible to those who know where to look, and a needle in the haystack operation for others.

With extremists now becoming more technologically proficient, covert data is no longer reserved for espionage cases. It is felt since encryption and monitoring has become a focus of attention, that steganographic practices may become more mainstream to those who wish to preserve privacy or thwart attempts of detection. (Gallagher 2012)

It is imperative that detection of such nefarious uses advances, not just for terrorist prevention but to also protect data. Data ex-filtration is another result from using steganographic processes. Tripwire had released a recent report detailing that a fortune 500 company had become victim to a campaign.

The ongoing attack; where data had bypassed firewalls and Intrusion detection systems had used video based steganography. The videos which were all the same, all carried different parts of sensitive data out of the company via a video upload site. It was this duplication which led to the alert and detection. (Westin 2014)

It is not a new occurrence of steganography being used for a data exfiltration. It is not just for the exfiltration of data it has been used either; it has been used in the past to help facilitate that act obfuscating the transmission and communication to command and control centers of attackers. There are some notable Advance Persistent Threats that have used steganography with this method to carry out malicious campaigns.

Some other malware variants that have been found are and can be read about in the Trendmicro Steganography malware series (Sancho 2015) are :ZeusVM: hiding malware configuration inside JPG images, VAWTRAK hides configuration file in a remote favicon image file, FakeReg hides malware settings in the app icon. However it isn’t just images that are being used an example is VBKlip hides data within the HTTP protocol targeting specifically Polish bank accounts.

However to give you an insight as to the impact of such malware head over to the blog post about one of the oldest popular infiltrations, the case of Operation Shady Rat which was made notable by Mcafee in 2011.