Skip to content

A Response to the Threat of Stegware

Conference/Workshop:
American Association of Forensic Sciences (AAFS)
Published: 2021
Primary Author: Abby Martin
Secondary Authors: Li Lin, Wenhao Chen, Seth Pierre, Yong Guan, Jennifer Newman
Research Area: Digital

Stegware refers to software, programs or apps that allow insertion of malware into a digital file, such as an image or video, using steganography techniques. Although it has been in action for around 15 years, “steganography” and “stegware” have recently just attracted the attention of law enforcement agencies as the use of stegware appears to be rising [1]. This technique has been used for international economic espionage [2], tracking of photos shared by users on social media platforms [3], and industrial and governmental espionage by hacker groups using PNG images to hide malicious code [4]. The war between the stegware and steganalysis tools is a typical cat-and-mouse game. Although many up-todate steganalysis tools claim their abilities to prevent steganography by utilizing the most advanced detection algorithms from the academic worlds, such as [5], these tools focus mainly on one or two embedding algorithms and lack support to detect a wide range of stego objects. The capability of these current tools to prevent a stegware attack has never been tested. In this research, we collect more than 70 stego apps and image steganography software and 10 of the most popular steganalysis tools. We propose a strategy to defend real-world attacks from stegware by combining functions from on-line steganalysis tools and algorithms from recent academic discoveries. We believe this will significantly increase the chance of identifying the threat from stegware by identifying files that have the potential to contain malicious code. Our team is working to develop a prototype of such a comprehensive steganalysis tool that provides user-friendly software for non-experts such digital evidence practitioners. We also summarized the characteristics of the code for many stego apps by reverse engineering and program analysis. The coding characteristics reflect their core embedding algorithms and encryption techniques, allowing us to classify the intent of the app as stegware even before installing it on a mobile phone. Our automatic tool to analyze app code can detect most Android stego apps that implement common spatial domain and frequency domain embedding algorithms with more than 95% accuracy. To our knowledge, this is the first study to evaluate the performance of most recent steganalysis tools in detecting a large set of stegware. The results will provide valuable guidance to the forensic communities to develop more powerful steg analyzers

Related Resources

LibDroid: Summarizing information flow of Android Native Libraries via Static Analysis

LibDroid: Summarizing information flow of Android Native Libraries via Static Analysis

With advancements in technology, people are taking advantage of mobile devices to access e-mails, search the web, and video chat. Therefore, extracting evidence from mobile phones is an important component…
Evaluating Reference Sets for Score-Based Likelihood Ratios for Camera Device Identification

Evaluating Reference Sets for Score-Based Likelihood Ratios for Camera Device Identification

An investigator wants to know if an illicit image captured by an unknown camera was taken by a person of interest’s (POI’s) phone. Score-based likelihood ratios (SLRs) have been used…
Likelihood Ratios for Categorical Evidence with Applications to Digital Forensics

Likelihood Ratios for Categorical Evidence with Applications to Digital Forensics

In forensic investigations, the goal of evidence evaluation is often to address source-/identity-based questions in which the evidence consists of two sets of observations: one from an unknown source tied…
Automatic Detection of Android Steganography Apps via Symbolic Execution and Tree Matching

Automatic Detection of Android Steganography Apps via Symbolic Execution and Tree Matching

The recent focus of cyber security on automated detection of malware for Android apps has omitted the study of some apps used for “legitimate” purposes, such as steganography apps. Mobile…