maxkabakov - Fotolia
Researchers at RSA Conference 2018 discussed the rise of stegware hacking tools that use steganography techniques to evade detection. How does stegware work and what are some recent examples?
The use of obfuscation has become common with malware and many other attacks as it can make analyzing malicious code and command-and-control connections and exfiltration more difficult.
Similar to obfuscation, steganography -- the act of hiding secret messages within ordinary messages -- was discussed at the 2018 RSA Conference. Simon Wiseman, CTO of Deep-Secure, explained at the conference that the use of steganography by attackers has increased for the same reasons obfuscation is on the rise, but steganography is more effective at hiding data. For example, an attacker could hide command-and-control infrastructure information in an image posted on social media.
Wiseman also talked about how attackers can use steganography to hide data in different types of files without changing what the image looks like to a viewer, as different file formats offer different places to hide data. The attacker can then download the file with the hidden data and extract it from the file for use in the next step of an attack.
The amount of data that can be stored in a file using steganography techniques depends on the file type, so it may not always be an efficient method to quickly share a large amount of data without being detected. However, if a covert channel isn't detected, then it can be very difficult to identify the use of steganography and to understand what data is being changed.
Ask the expert:
Have a question about enterprise threats? Send it via email today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Cisco Talos' Thanatos ransomware decryptor can recover files affected by new ransomware that won't decrypt ransomed files even when a ransom has been... Continue Reading
A phishing campaign targeting Trezor wallets may have poisoned DNS or hijacked BGP to gain access. Learn how the attack worked and how to mitigate it... Continue Reading
Okta researchers found a bypass that allows macOS malware to pose as signed Apple files. Discover how this is possible and how to mitigate this ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.