Steganography: What's Hiding in Those Downloaded Files?

By Susan Hoffman
Contributor

The internet abounds with content that you can easily download to your own computer. For instance, there are images, audio tracks, video clips, and text files (such as how-to guides or white papers) that only require a click or two to download.

However, not all of that material is benign. Hackers use steganography techniques – which involve hiding malicious code in those files – to evade the usual safeguards such as antivirus software and firewalls. A 2017 McAfee Labs report noted that “it is extremely difficult to detect the presence of hidden information such as a configuration file, binary update or bot command inside steganographic files. Unfortunately, the use of steganography in cyberattacks is easy to implement and hard to detect.”

It isn’t only downloadable files that are affected. HTML files and networks are also vulnerable.

McAfee points out that “Network steganography is the latest type of digital steganography used by malware. This form is on the rise because attackers can send an unlimited amount of information through the network. Some malware authors use unused fields within the [Transmission Control Protocol/Internet Protocol] TCP/IP protocol header to hide data.”

The Positive Side of Steganography

Using steganographic software can have its positive aspects, however. For instance, it can be used to create hidden watermarks. This technique prevents people from illegally copying music or images that are copyrighted.

How Steganography Works

There are various applications available on the web for steganography, and some of this software is open source or free. These applications include Steghide, Crypture, rSteg, SteganographX Plus, SSuite Picsel, Camouflage and Our Secret.

So What Can Be Done to Protect Your Computer and Network?

Before you download files from the web, it is wise to do your due diligence. Check around and see if anyone else has reported problems with those files or websites.

McAfee also recommends several ways to protect your computer:

• Use image editing software to check for steganography indicators such as slight color differences in images or a large number of duplicate colors in the same image.
• Only install applications that come from trustworthy vendors and that have trustworthy signatures.
• Make sure your organization maintains tight control over what software users download onto their company computers.
• Monitor outbound traffic to more quickly detect the presence of a steganographic attack.

A healthy sense of caution is also useful. If you unexpectedly receive an image or other file from a friend or colleague, double-check with that person before you download the file to your computer. Although this method requires some extra effort on your part, it is better than risking an infection on your computer.