Data Hiding/Embedding
Parchivist (Talk | contribs) (→Links) |
Parchivist (Talk | contribs) |
||
| Line 8: | Line 8: | ||
| − | == | + | == Generic appending == |
| − | + | Appending a file to the end of another often results in a file that continues to work as usual, with the file viewer/player ignoring the extra bytes at the end. | |
| − | A common tactic is to manually append a zip/rar file to the end of a | + | A common tactic to take advantage of this behavior is to manually append a zip/rar file to the end of a file. The resulting file will still open as regular, but any archiver will automatically detect and open zip/rar part. |
In DOS/Windows command line, files can be appended by using the command:<br> | In DOS/Windows command line, files can be appended by using the command:<br> | ||
| Line 19: | Line 19: | ||
In Linux/Mac the command looks like:<br> | In Linux/Mac the command looks like:<br> | ||
$ cat host.jpg hidden.zip > combined.jpg | $ cat host.jpg hidden.zip > combined.jpg | ||
| + | |||
| + | This can work with [[JPEG]], [[GIF]], [[MP3]], some executables and more | ||
| + | |||
| + | === Links === | ||
| + | * [[smuggle_bus]] - more sophisticated file appending | ||
| + | |||
| + | |||
| + | |||
| + | == [[JPEG]] == | ||
| + | |||
| + | There are two main approaches to embedding data in a JPEG file: using the EXIF headers or appending it after the end of image marker (FF D9) | ||
| Line 48: | Line 59: | ||
| − | MP3 files are fairly tolerant of random data being added to the file, so the same file appending strategies | + | MP3 files are fairly tolerant of random data being added to the file, so the same generic file appending strategies can be used. |
See also: [[MP3 wrapper]] | See also: [[MP3 wrapper]] | ||
Revision as of 18:49, 28 August 2023
Data hiding/embedding is a cruder form of Steganography that relies on not being noticed/looked for in the first place while true steganography tries to remain hidden even when actively being looked for.
Contents |
Generic appending
Appending a file to the end of another often results in a file that continues to work as usual, with the file viewer/player ignoring the extra bytes at the end.
A common tactic to take advantage of this behavior is to manually append a zip/rar file to the end of a file. The resulting file will still open as regular, but any archiver will automatically detect and open zip/rar part.
In DOS/Windows command line, files can be appended by using the command:
copy /b host.jpg + hidden.zip combined.jpg
In Linux/Mac the command looks like:
$ cat host.jpg hidden.zip > combined.jpg
This can work with JPEG, GIF, MP3, some executables and more
Links
- smuggle_bus - more sophisticated file appending
JPEG
There are two main approaches to embedding data in a JPEG file: using the EXIF headers or appending it after the end of image marker (FF D9)
Links
- Under the hood: Hiding data in JPEG images
- Malware Hidden Inside JPG EXIF Headers
- GG-AESY - implements both methods of hiding data
PDF allows embedding complete files in the actual PDF file.
PDF allows adding arbitrary objects anywhere (or almost anywhere) in the file.
PDF allows writing data between objects
PDF allows adding for example white text on a white background or text behind other objects.
Adobe's PDF spec allows at least 1K of fluff after the %%EOF marker (although ISO 32000 does not).
Links
MP3
MP3 files are fairly tolerant of random data being added to the file, so the same generic file appending strategies can be used.
See also: MP3 wrapper
NTFS Alternate Data Streams
NTFS provides Alternate Data Streams (ADS) for each file and directory.
You can create one from the command line:
echo hello > test.txt:stream
You can also copy an existing file into a stream:
type hidden.txt > test.txt:hidden.txt
To read the stream back:
more < test.txt:stream
They can also be opened directly in notepad:
notepad test.txt:stream
Links
- How to Create, Open, Detect, and Remove Alternate Data Stream
- Exploring NTFS Alternate Data Streams from a security standpoint
- Streams - finds files and directories with streams
- Nirsoft AlternateStreamView - find/view/copy/delete NTFS Alternate Data Streams
- NTFS Streams - A .NET library for working with alternate data streams on NTFS file systems.
