Steganography is the art of hiding secret messages within other cover messages. It works by embedding the secret message in a way that is imperceptible to anyone except the sender and recipient. Historically, secret messages were hidden on messengers' heads or in invisible inks or wax tablets. Steganography differs from cryptography in that it conceals the existence of the message rather than scrambling its contents. Common steganography techniques include least significant bit insertion into images, text, audio, and other file types. Steganalysis aims to detect the presence of hidden messages through statistical analysis, file properties, or signatures of steganography tools. Manual inspection with a hex editor can also reveal clues that steganography was used

1. STEGANOGRAPHY
The Art of Hiding Secrets
Abdelhamid Limami
Security Consultant @ ITDefence

2. OVERVIEW
• Introduction
• History
• Difference Between Stego & Crypto
• How Steganography work
- Example
• What is Steganalysis
-Example
• Conclusion

3. INTRODUCTION TO STEGANOGRAPHY
• Steganography is the art and science of embedding secret messages in cover
message in such a way that no one, apart from the sender and intended recipient,
suspects the existence of the message.
• Steganography is a Greek origin where Greek words means :
• “Art of concealing a message, means concealed writing ”.
grafiasteganos
covered writing

4. HISTORY
Hiding messages on
messengers head
Using invisible inks Writing messages on wood
underlying wax tablets

5. STEGANOGRAPHY VS CRYPTOGRAPHY
Stegano
• It conceals the existence of the
message.
• It does not alter the structure of the
secret messages , but hides it inside a
cover-file so it cannot be seen.
• Steganography make the secret
message unseen.
Crypto
• Hiding the contents of a secret message
from malicious people.
• tIn cryptography , the Structure of a
message is scrambled to make it
meaningless and unintelligible unless the
decryption key is provided
• Cryptography Encrypt the message but it
can be seen.
Both Have Been used as mean to protect information.

6. HOW STEGANOGRAPHY WORK ?

7. METHODOLOGY

8. TYPES OF STEGANOGRAPHY
• Using LSB [Least Significant Bit] Method by Replacing
least significant bits with the message to be encoded.
• Most popular technique when dealing with images.Image
• Hide a secret message in the same nth letter of every word
in text message.
• Another way by using HTMLText
• The same as image steganography ,but instead of image we
use audio signals.Audio
In Fact, any other file can be used in
steganography

9. LSB INSERTION’S EXAMPLE
• An image may have the following three pixels (9 bytes) in it somewhere:
(01010010, 10010110, 10100100)
(10110100, 10010001, 01001110)
(10110110, 00101110, 11010001)
• If we wanted to hide [131 or 10000011], we would use/replace the least-significant bits of
each byte:
(01010011, 10010110, 10100100)
(10110100, 10010000, 01001110)
(10110111, 00101111, 11010001)

10. IMAGE STEGANOGRAPHY
Simple image steganography by hiding
one image into another.

11. AUDIO STEGANOGRAPHY
• Let’s assume an audio file had the following 8 bytes of data in it somewhere:
Original: 180, 229, 139, 172, 209, 151, 21, 104
In binary, this would be:
10110100-11100101-10001011-10101100-11010001-10010111-00010101-01101000
• If we wanted to hide the byte value 214 (11010110), we use the LSB from each byte to hide
our byte:
10110101-11100101-10001010-10101101-11010000-10010111-00010101- 01101000
• The changes result in the following bytes, which are so close to the originals that the
difference will be inaudible:
Modified: 181, 229, 138, 173, 208, 151, 21, 104

12. STEGANOGRAPHY TOOLS
• Here’s some of the steganography tools that help to embed files with a key(password) :
Steganos
S-Tools (GIF, JPEG)
StegHide (WAV, BMP)
Invisible Secrets (JPEG)
JPHide
Camouflage
Hiderman

13. LET’S HAVE AN EXAMPLE USING
HIDERMAN

14. STEGANALYSIS
Identification of hidden files

15. WHAT IS STEGANALYSIS ?
Definition
o Identifying the existence of a message
o Not extracting the message
o Note: Technically, Steganography deals with the concealment of a message, not
the encryption of it
Steganalysis essentially deals with the detection of hidden content
So…How is this meaningful ??

16. THE ANSWER
• By identifying the existence of a hidden
message, perhaps we can identify the tool used
to hide it.
• If we identify the tool, maybe we can use that
tool to extract the original message.

17. WHAT YOU GONNA NEED TO START
STEGANALYSIS ?
 Have some knowledge about Hexadecimal and decimal
 Know different File format signature
 Know how to work with a Hex Editor like “Winhex”

18. STEGANALYSIS: METHODS OF DETECTION
Categories
• Histogram analysis
• Change in file properties (size difference, date/time, checksum)
• Statistical Attack
• Visually
Signature :
• A pattern consistent with the program used

19. STEGANALYSIS : FILE SIGNATURES
Hex Signature File Extension ASCII Signature
FF D8 FF E0 xx xx
4A 46 49 46 00
JPEG (JPEG, JFIF, JPE, JPG) ÿØÿà..JFIF
47 49 46 38 37 61
47 49 46 38 39 61
GIF GIF87a
GIF89a
42 4D BMP BM

20. EXAMPLE : HIDERMAN - CASE STUDY
By using Stegspy a Steganalysis tool we
have been able to detect that Hiderman
has been used

21. SO HOW HIDERMAN HAS BEEN DETECTED? 
Let’s inspect it manually using Winhex

22. ANOTHER EXAMPLE OF AUDIO STEGANALYSIS

23. CONCLUSION
Steganography Has both good and bad aspects :
Merit:
• More secure.
• Difficult to Detect
• Does not attract any focus.
Demerit:
• Complex Process.
• Increase in data size can arise suspension.

24. Thank you 