What is the core idea behind "3 Steps to Hide Data in an Image Using Steganography - Christian Espinosa"?

In this post we'll explain a simple method to hide data (any type of data - text, image, malware, etc.) in a JPEG.

Who is this post for?

Honestly, security leaders, medical device teams, and technical operators who want the honest version, not the vendor version. If you want a listicle, this is not that. If you want the honest version of what I have actually lived and worked through, keep reading.

How do I actually apply this, not just nod along?

Pick the single line in the post that made you flinch or look away, and change one thing in your week because of it. One choice this week beats a whole framework you never touch.

Cybersecurity

3 Steps to Hide Data in an Image Using Steganography

September 4, 20214 min read799 words

I'm going to show you a simple way to hide any kind of data in a JPEG. It could be text, another image, or even malware. This is steganography, the art of hiding something right in front of everyone. I do this when I don't want anyone to even suspect there's a secret message or hidden data.

The takeaways

01

Steganography hides data inside an ordinary-looking image; the payload can be text, another image, or malware.

What to do nextSend yourself a test image with an embedded string using a free tool and confirm your outbound email gateway lets it through.
02

Tools like JPHS make hiding and extracting data trivial for anyone who can follow three clicks.

What to do nextAdd a five-minute steganography demo to your next security awareness session so the team stops thinking of it as theoretical.
03

Because the carrier image looks unchanged, standard email and web filters usually miss the exfiltration entirely.

What to do nextAsk your DLP owner this week whether image payload inspection is on, and if the answer is no, put it on the roadmap.
04

Defenders should assume attackers already use this channel and monitor for unusual image traffic accordingly.

What to do nextReview last month's egress logs and flag any image files over 500 KB leaving the network to non-corporate destinations.

This image looks like any other, but I've hidden a file inside.

I'm skipping the history lesson on steganography. I'll get straight to how I do it.

1. Download and extract the JPHS (JPEG Hide and JPEG Seek) tool:

gwdg.de site

2. Download a cover image (the image you will hide the data inside of) and a hide image (the image you will hide inside the cover image):

The cover image should be roughly 10 times the size of the hide image. In our example, we will use a HD Background as the cover image and a picture of a cute kitten as the hide image.

Cover Image; background.jpg (found doing a Google search for “hd backgrounds”):

Source: http://hdgreatimages.com/wp-content/uploads/2016/04/Bridge-HD-Backgrounds.jpg

Hide Image; kitten.jpg (found doing a Google search for “lilbub”):

3. Run Jphswin. Accept the terms. Do the following:

Click on “Open jpeg”, select “background.jpg” and click “open”:

Selecting the Input (Cover) file in JPHS for Windows

Click on “Hide”, enter a passphrase, click “OK”, then select the hide file (kitten.jpg), and click “Open”:

Selecting the Hide file in JPHS for Windows

Save the steg’d file (the kitten.jpg file hidden in the background.jpg file) as another file name, so we can compare the new file containing the hidden data with the original file. Click “Save jpeg as” and use the file name “bridge.jpg” (or something different than the original name):

Saving the Steg’d file in JPHS for Windows

You should now see 3 files; the “background.jpg” should look the same (to the naked eye) as the “bridge.jpg” even though the “kitten.jpg” file is hidden inside “bridge.jpg”:

Open both “background.jpg” and “bridge.jpg” side-by-side in Windows Photo Viewer to see if you can tell a difference:

Original image on the left. Steg’d image on the right. Can you see any difference?

Congratulations! You’ve just practiced steganography.

Validation

Let’s validate our steganography demonstration actually worked by extracting the “kitten.jpg” from the “bridge.jpg”:

Using JPHS for Windows, select “Open jpeg”, select “bridge.jpg”, click “Open”:

Opening the image containing the hidden file in JPHS for Windows

After you opened the “bridge.jpg” file click on “Seek”, enter the passphrase you used to hide the file, click “OK”, then save the hidden file as “secret.jpg”:

Saving the hidden file as “secret.jpg” in JPHS for Windows

Verify the “secret.jpg” file is the same as the “kitten.jpg” file by opening “secret.jpg”.

The extracted “secret.jpg” is the same as “kitten.jpg”. Our steganography example worked!

To validate which image pixels JPHS for Windows modified to hide the image in the cover image, you can use Beyond Compare to visually depict the differences. Download and install Beyond Compare. If you receive an “Error creating registry key:” you need to install as an Administrator.

Run Beyond Compare. On the left side, select “New”, the double-click “Picture Compare”:

Double-click Picture Compare

Open the original picture (background.jpg) on the left window in Beyond Compare and open the steg’d picture (bridge.jpg) on the right window. The comparison should be in the bottom window:

One example of where the pixels differ is shown above; the pixel on the left has RGB:47,109,184, on the right it is RGB:47,109,186

Resources

Files used/referenced in this blog:

JPHS for Windows (This application is included in the jphs_05.zip)
background.jpg
kitten.jpg
bridge.jpg
secret.jpg

Video on this topic:

Frequently asked

Share this essay

X LinkedIn Facebook Email

Keep reading