Steganography

Steganography: Hiding information inside innocuous carrier data so that its very existence is concealed. Unlike encryptionEncryptionConverts plaintext into unreadable ciphertext using a key., which protects the content, steganography conceals the fact that a transfer happened at all.

How it works and where it fits

Carriers include images, audio, video, documents, and network protocols. The payload is placed where modification is imperceptible: in the least significant bits of pixel values, in unused metadata fields, behind the regular end of a file, in frequency ranges outside human hearing, or in the structure of the carrier format itself. Senders frequently combine these techniques with encryption, so that even an extracted stream initially looks like noise.

Practical security relevance

Defensively, steganography matters as a channel for data exfiltrationData ExfiltrationUnauthorized transfer or theft of data from an organization. and for delivering malicious code; forensically, it matters as a place to look. Detection targets statistical anomalies: altered bit distributions, unexpected file lengths, data past the end marker, high-entropy metadata. Because a single indicator is rarely conclusive, investigations combine carrier structure, statistics, and the context of the transfer.

Related concepts

• Digital ForensicsDigital ForensicsPreserves and analyzes digital traces to reconstruct security-relevant events.: Preserves and analyzes digital traces to reconstruct security-relevant events.
• ObfuscationObfuscationHinders the analysis of code, data, or communication through intentional obfuscation.: Hinders the analysis of code, data, or communication through intentional obfuscation.
• Data ExfiltrationData ExfiltrationUnauthorized transfer or theft of data from an organization.: Unauthorized transfer or theft of data from an organization.
• EncryptionEncryptionConverts plaintext into unreadable ciphertext using a key.: Converts plaintext into unreadable ciphertext using a key.