What is steganography?
Encryption hides what a message says; steganography hides the fact that a message exists at all. The secret data is embedded in a carrier, also called cover media, that looks normal: a photo, an audio clip, a video, a document, or even the timing and header fields of network traffic. Someone who opens the file sees an ordinary picture or hears an ordinary song. The word comes from Greek roots meaning covered writing.
How it works
The best-known image technique is least significant bit (LSB) embedding. Each pixel in a 24-bit image has three color bytes, and changing the lowest bit of a byte shifts that color by one step out of 256, which the eye cannot see. A red value of 180 (10110100) becomes 181 (10110101) to store a single 1 bit.
The capacity adds up quickly. A 1920 × 1080 image has 2,073,600 pixels and 6,220,800 color bytes. Taking one bit from each stores 6,220,800 bits, or 777,600 bytes, roughly 760 KB, enough for a large text file. Simple LSB embedding needs a lossless format such as PNG or BMP, because JPEG compression would scramble those bits; JPEG tools hide data in the compressed coefficients instead.
Other carriers include audio samples, slack space and metadata in files, trailing spaces and tabs in text, and fields in network protocols, where the hidden path is often called a covert channel.
A command-line example
Free tools make embedding trivial. With steghide, a user can hide a file inside a JPEG and protect it with a passphrase:
steghide embed -cf vacation.jpg -ef customers.csv
The image looks unchanged, and steghide extract -sf vacation.jpg recovers the hidden file when given the passphrase. Steghide works with JPEG, BMP, WAV and AU files and encrypts what it embeds by default. Pairing encryption with steganography is common, so that hidden data stays unreadable even if someone finds it.
How attackers use it and how defenders find it
Attackers use steganography to move stolen data past data loss prevention tools, for example by hiding a customer file in an image uploaded to a public site, and to hide malware payloads or command-and-control instructions inside images that look harmless to network monitoring. Because the carrier is a valid file, signature-based tools often miss it.
Finding hidden data is called steganalysis. Defenders look for:
- Files whose size or randomness is unusual for their content
- Hash mismatches between an image and the known original
- Statistical anomalies in pixel or audio data, flagged by steganalysis tools
- Steganography tools on endpoints, or unusual volumes of images leaving the network
Re-encoding images at a proxy or upload gateway, for example by recompressing or resizing them, also destroys simple LSB payloads.
Steganography vs. encryption vs. obfuscation
Encryption makes data unreadable but obvious, since anyone can see that ciphertext exists. Steganography makes data inconspicuous but, on its own, readable by anyone who knows where to look. It is a form of obfuscation, security through obscurity, not a cryptographic control. Digital watermarking uses similar embedding techniques for a different purpose: marking ownership or tracing leaks rather than sending a hidden message.
Steganography on the CompTIA Security+ exam
SY0-801 no longer lists steganography by name; it fits under obfuscation, one of the data protection methods in objective 3.3. Wording such as "data hidden inside an image file", "a message concealed so no one knows it exists" or "exfiltration through image uploads that DLP did not flag" points to steganography. Distractors include encryption (it hides content but not its existence), tokenization and masking (they protect stored values) and encoding such as Base64, which changes a value's form but is obvious to anyone who looks.