Steganography

Late last month, Microsoft announced that their Outlook product will no longer render SVG (Scalable Vector Graphics) images in-line with email content (graphic designers need not worry too much however, as SVG attachments will still be supported by Outlook). This is certainly a welcome development for the security community, as a recently rediscovered legacy quirk of the SVG format allows for automatic execution of JavaScript when the image is rendered. Attacks leveraging malicious JavaScript embedded in SVGs have been on the rise recently.

This announcement brings to mind a fascinating and mysterious concept in cybersecurity: steganography. Steganography is the art and science of hiding a message in plain view. It has been used for centuries across a diverse variety of societies and mediums of communication. The first (and possibly apocryphal) use of steganography is recounted by Herodotus wherein a Greek ruler sends a secret message to his vassal by shaving the head of his messenger, inscribing the message into the messenger’s scalp, and waiting for the hair to grow back before sending the messenger on his way. More recent examples include microdots, invisible ink, and—most relevant to the cybersecurity profession—nearly imperceptible modification of digital files to conceal another file or message.

A common method of digital steganography is applied to image files like JPEGs or SVGs. An image file uses binary numbers representing colors to encode each pixel of an image. A “steganographer” will often change the least significant bits of those binary numbers to encode their message or file. This will subtly change the color scheme of the image but the changes will be invisible to the naked eye. The recipient of the image can then extract the hidden message or file by using a steganography tool to reverse the encoding process.

Threat actors often use steganography as a stealthy way to bypass traditional EDR/MDR defenses. Most static analysis tools won’t be able to detect slight modifications to a JPEG, for example, and an entire malicious .exe file could slip by a company’s defense entirely undetected if properly hidden in the image. The attacker then may use a separate “trigger” to parse the steganographic payload and execute the .exe at a later time.

This highlights the continuing and growing importance of heuristics-based detection engines for endpoint, network, and cloud protection. In the age of polymorphic malware and digital steganography, relying on static hashes of known malicious files (as most commercial antivirus products do) is simply not enough to mitigate risk. As defenders, we must begin shifting our paradigm towards analysis of suspicious behavior so that we can be more assured of catching and stopping an attack before it can do significant damage.

Forrest Palamountain – Security Lead, Tech Heads Inc. – CISSP