Skip to content

A Response to the Threat of Stegware

Conference/Workshop:
American Association of Forensic Sciences (AAFS)
Published: 2021
Primary Author: Abby Martin
Secondary Authors: Li Lin, Wenhao Chen, Seth Pierre, Yong Guan, Jennifer Newman
Research Area: Digital

Stegware refers to software, programs or apps that allow insertion of malware into a digital file, such as an image or video, using steganography techniques. Although it has been in action for around 15 years, “steganography” and “stegware” have recently just attracted the attention of law enforcement agencies as the use of stegware appears to be rising [1]. This technique has been used for international economic espionage [2], tracking of photos shared by users on social media platforms [3], and industrial and governmental espionage by hacker groups using PNG images to hide malicious code [4]. The war between the stegware and steganalysis tools is a typical cat-and-mouse game. Although many up-todate steganalysis tools claim their abilities to prevent steganography by utilizing the most advanced detection algorithms from the academic worlds, such as [5], these tools focus mainly on one or two embedding algorithms and lack support to detect a wide range of stego objects. The capability of these current tools to prevent a stegware attack has never been tested. In this research, we collect more than 70 stego apps and image steganography software and 10 of the most popular steganalysis tools. We propose a strategy to defend real-world attacks from stegware by combining functions from on-line steganalysis tools and algorithms from recent academic discoveries. We believe this will significantly increase the chance of identifying the threat from stegware by identifying files that have the potential to contain malicious code. Our team is working to develop a prototype of such a comprehensive steganalysis tool that provides user-friendly software for non-experts such digital evidence practitioners. We also summarized the characteristics of the code for many stego apps by reverse engineering and program analysis. The coding characteristics reflect their core embedding algorithms and encryption techniques, allowing us to classify the intent of the app as stegware even before installing it on a mobile phone. Our automatic tool to analyze app code can detect most Android stego apps that implement common spatial domain and frequency domain embedding algorithms with more than 95% accuracy. To our knowledge, this is the first study to evaluate the performance of most recent steganalysis tools in detecting a large set of stegware. The results will provide valuable guidance to the forensic communities to develop more powerful steg analyzers

Related Resources

A Forensic Analysis of Joker-Enabled Android Malware Apps

A Forensic Analysis of Joker-Enabled Android Malware Apps

This project aims at developing a set of automated Android Malware vetting tools to discover all the malicious behaviors of Android Malwares in the forms of files in the local…
LogExtractor: Extracting Digital Evidence from Android Log Messages via String and Taint Analysis

LogExtractor: Extracting Digital Evidence from Android Log Messages via String and Taint Analysis

Mobile devices are increasingly involved in crimes. Therefore, digital evidence on mobile devices plays a more and more important role in crime investigations. Existing studies have designed tools to identify and/or…
Forensic Analysis on Joker Family Android Malware

Forensic Analysis on Joker Family Android Malware

Android is the most popular operating system among mobile devices and the malware targeted explicitly for Android is rapidly growing and spreading across the mobile ecosystem. In this paper, we…
Source-Anchored, Trace-Anchored, and General Match Score-Based Likelihood Ratios for Camera Device Identification

Source-Anchored, Trace-Anchored, and General Match Score-Based Likelihood Ratios for Camera Device Identification

Forensic camera device identification addresses the scenario, where an investigator has two pieces of evidence: a digital image from an unknown camera involved in a crime, such as child pornography,…