SANS InfoSec Reading Room - Steganography

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

Featuring 10 papers as of May 24, 2013

Detecting Hydan: Statistical Methods For Classifying The Use Of Hydan Based Stegonagraphy In Executable Files

By: Craig Wright (posted on July 3, 2008)

This paper presents a method that can be used to detect HYDAN based steganography. This is simply an initial means and should be improved if it is to be used in any serious endeavor. To do this, the code could be compiled into a single program that incorporates the disassembly and comparison in a single binary. This would then return a value for those segments that have embedded data.

Steganography: The Right Way

By: Lachlan McGill (posted on May 5, 2005)

Steganography in the last few years has gained a wider audience due in part to the suspicion that the technology may have been used by terrorists to communicate plans for upcoming attacks.

MP3Stego: Hiding Text in MP3 Files

By: Mark Noto (posted on October 31, 2003)

This paper discusses MP3Stego, a steganographic tool that operates within the MP3 encoding process.

Hiding in Plain View: Could Steganography be a Terrorist Tool?

By: Tom Kellen (posted on October 31, 2003)

This paper addresses the possibilities of utilizing steganography techniques as a terrorist tool.

Steganography: Past, Present, Future

By: James C. Judge (posted on October 31, 2003)

This paper will explore steganography from its earliest instances through potential future application.

Steganography and Steganalysis: An Overview

By: Joshua Silman (posted on October 31, 2003)

Steganography is a dynamic tool with a long history and the capability to adapt to new levels of technology.

An Analysis of Terrorist Groups Potential Use of Electronic Steganography

By: Stephen Lau (posted on October 31, 2003)

This paper provides an overview of steganography, its historical use during times of war, and how modern day electronic steganography can be accomplished.

Steganography: What's the Real Risk?

By: John Hally (posted on October 31, 2003)

This paper provides an overview of steganography, tools of the trade and detection methods.

Reversing the Steganography Myth in Terrorist Operations: The Asymmetrical Threat of Simple Intellig

By: Robert J. Bagnall (posted on October 31, 2003)

This paper discusses various ways and methods for simple, clandestine communications that are virtually undetectable and untraceable using common technology.

Steganalysis: Detecting hidden information with computer forensic analysis

By: Pierre Richer (posted on October 31, 2003)

In this paper I shall give a brief definition of steganography and steganalysis in general to provide a good understanding of these two terms, but more importantly, I shall talk about how to detect the existence of hidden information such as innocent looking carriers of digital media like text, JPEG images, and MP3 audio files with the help of various tools.