Innovative steganography mitigation research: safeguarding against covert data concealment

Steganography poses a significant threat in the world of cybersecurity, allowing adversaries to conceal data within everyday files. At Glasswall, we have conducted extensive research to understand the nuances of steganographic techniques and develop effective mitigation strategies. Here we offer a glimpse into our innovative steganography mitigation solution, designed to fortify defenses against covert data exfiltration.

Understanding steganography

The art of hiding data within other forms of data – steganography - is a technique which has existed for thousands of years. In today’s digital age the concept remains the same, but the medium has switched from printed media to binary. Derived from Greek roots meaning "hidden" and "to write," digital steganography can conceal various content types, including text, images, videos, or audio files, within seemingly ordinary files or messages.

In the cybersecurity context, image steganography is one of the most common methods to conduct hidden communications, infiltrate and exfiltrate data, and even potentially smuggle in malicious code.

It hides data by using image structures or pixel data for covert communication. Although not commonly linked to malware dissemination due to its limited capacity, steganography requires strong mitigation measures to prevent covert data transfer.

Glasswall research overview

Our research examined common steganographic techniques like Least-significant bit (LSB), Alpha Channel Steganography, and Palette-based Steganography. Targeted mitigation approaches showed promising results but with noticeable statistical and visual impacts, while general techniques were effective against TrueColor and Palette-based steganography with minimal impact.

Glasswall's in-depth research on image steganography, from basic LSB to complex Spread Spectrum Image Steganography (SSIS), led to methods for disrupting hidden data streams reliably while minimizing visible deviations.

Using metrics like Structural Similarity Index Metric (SSIM) and Peak-Signal-To-Noise-Ratio (PSNR), Glasswall has achieved successful mitigation with negligible Visual System impact and tolerable statistical deviation, providing general mitigation solutions against common steganography techniques. Our goal is to offer a comprehensive understanding of image steganography's usage, effective disruption methods, and their implications for everyday users.

Selected Mitigation Strategies

Drawing from our research insights, we have selected a comprehensive suite of mitigation strategies to combat steganographic threats effectively. These include File Bouncing, Palette Shuffling, and Image Smoothing techniques, each tailored to mitigate specific steganographic methods while minimizing resource requirements. Our solution offers configurable options for controlling mitigation techniques, ensuring adaptability to varying security needs.

Steganography Mitigation Solution

Our steganography mitigation solution is engineered to provide robust protection against covert data concealment across a wide range of file types, including images and MS Office documents. With support for configuration via JSON files, administrators can fine-tune mitigation options to suit their security policies. The approach utilizes a command-line interface for seamless integration into existing workflows, offering flexibility and ease of use.

The solution consists of advanced features such as transparency handling for palette-based images, validation of index ranges during color table shuffling, and compatibility with various image formats. Dynamic palette size handling ensures adaptability to different scenarios, while support for multi-frame images enhances versatility. By combining cutting-edge mitigation techniques with user-friendly functionality, our steganography mitigation solution empowers organizations to defend against covert data exfiltration with confidence.

Glasswall’s steganography mitigation research represents a significant step forward in the fight against clandestine data concealment. With its comprehensive suite of mitigation strategies and user-friendly interface, organizations can bolster their cybersecurity defenses and safeguard sensitive information from malicious actors. The research is currently being evaluated by leading government security agencies and we aim to bring the capability to market later in 2024.