Steganography is one of the methods used to hide sensitive information from unauthorised parties. It protects information — images, text — by hiding it within ordinary-looking files or communications, making it hard for anyone who should not have it to find it. As a method it has been in use since 440 BC; its application in modern cyber security began in the late twentieth century.
It is common, including among people working in security, to confuse steganography with cryptography. They are different. Steganography hides the existence of the message. Cryptography scrambles the content of the message so that it is unreadable without the right key. Cryptography is the more popular approach, but there are cases where steganography makes more sense.
Types of steganography
There are five major types.
Text steganography
Hiding secret messages within ordinary text, used across channels such as email, forum posts or social media. Techniques range from the simple — subtle alterations in formatting, specific punctuation, whitespace patterns — to steganographic algorithms that encode information within the text itself.
Image steganography
Concealing information within digital images. Redundant data in image files can be manipulated without visibly altering the image. One common approach manipulates the least significant bits of pixel values, encoding binary data without perceptible distortion. Spatial domain hiding can embed one image within another by modifying specific regions or colour channels.
Video steganography
Concealing content within other multimedia. This exploits the temporal continuity between consecutive frames, letting hidden information be embedded within the video stream — for example by encoding frames of a hidden video into corresponding frames of the carrier, leveraging motion vectors, or manipulating specific components of the video data.
Audio steganography
Hiding messages within audio files while preserving the perceived quality of the sound. It leverages the limited sensitivity of human hearing to subtle changes in sound waves. Common techniques modify the least significant bits of audio samples, or embed messages in frequency ranges chosen to minimise audible artefacts.
Network steganography
Concealing information within network communications to evade detection. This one is mainly used by attackers: it capitalises on the redundancy and variability in network protocols, allowing data to be embedded within packet headers, payloads or transmission patterns. Techniques include embedding data in unused protocol fields and manipulating the timing characteristics of packets.
The role of steganography in cyber security
Steganography is used by security professionals and by criminals. It is worth understanding both.
Security professionals
Security teams use steganography defensively to protect sensitive data and enhance privacy — concealing confidential information such as keys or credentials within digital assets, so that it is safeguarded against unauthorised access.
It is also used for digital watermarking and copyright protection. Embedding unique identifiers or ownership information within images or video deters unauthorised use, and the hidden information can serve as evidence in a copyright dispute.
In counterintelligence and digital forensics, steganalysis techniques are used to uncover covert communications, malware payloads or encrypted data concealed by steganographic methods. Analysts examine suspicious files or network traffic for signs of manipulation, identifying hidden malware and data exfiltration.
Attackers
Malicious actors use steganography to conceal activity and evade detection — embedding malware within innocuous-looking files such as images or documents, bypassing tools that would not think to look inside them.
It is also used to hide stolen data during exfiltration. Embedding sensitive data within benign-looking files or traffic helps it past monitoring that is watching for the obvious.
It enables covert command and control: instructions exchanged with compromised systems, embedded in files or network traffic that arouse no suspicion. Criminal groups use the same approach to coordinate activity while evading surveillance.
How to detect and prevent steganographic attacks
- Visual inspection. Analysing suspicious files for anomalies that suggest hidden data — unusual patterns, discrepancies in pixel values. Useful for obvious manipulation, but manual, slow, and insufficient on its own against modern techniques.
- Statistical analysis. Analysing media files for deviations from expected patterns: the distribution of pixel values in an image, the frequency spectrum of an audio file. Requires specialist tooling to identify the anomalies reliably.
- Steganalysis tools. Software that automates detection using algorithms and statistical models. Valuable, but only while kept current — new techniques appear constantly.
- File integrity checks. Comparing hashes or checksums before and after transmission. Any discrepancy may indicate hidden data has been introduced.
- Network traffic analysis. Monitoring packet headers, payload sizes and transmission timing for patterns indicative of steganographic activity, using intrusion detection and deep packet inspection.
- Content filtering. Scanning files and communications for known steganographic patterns or signatures, blocking suspicious content before it enters the network. Needs regular updates to stay useful.
- User education. Training people to use secure communication channels, avoid unauthorised software and recognise potential indicators of steganographic activity.
Final thoughts
Steganography is a genuinely two-sided problem: a valuable tool for security professionals and a weapon in the hands of attackers. It enables data protection, privacy and digital watermarking on one side, and concealed malware, hidden exfiltration and covert command channels on the other.
The encouraging part is that the detection side is tractable. Statistical analysis, steganalysis tooling and network traffic analysis all work, and user education closes a meaningful share of the remaining gap.