Low-key but effective, steganography is an old-school trick of hiding code within a normal-looking image, where many cybersecurity pros may not think to look.
One of the challenges of cybersecurity is that overfocusing on one threat trend means that another one can sneak up on you. This is especially problematic as our networks and the attack surface expands. Beyond threat vectors, though, we also need to pay attention to the entire spectrum of threat techniques and strategies. So while we are preparing our networks for the next zero-day threat, we need to make sure that we are keeping a lid on familiar exploits.
Cybercriminals are especially fond of using existing malware in new ways for a number of reasons, the most common being economic. It is much cheaper to tweak an existing exploit than invent something new, and if done right, that tweak can slip past existing defenses right under the noses of cyberprofessionals. A recent Fortinet report found that one of these threats in need of monitoring is the recent revival of the “old school” trick of steganography.
Watch Out for Steganography
For as long as communication has existed, humans have wanted to keep some communications secret. Cryptography is the most well-known of the ancient clandestine arts, but steganography has a long and storied history as well. Steganography is a cryptographic technique of hiding something – a message, code, or other content – within something else, such as a digital photograph or video, allowing it to be passed along in plain sight. Steganography was most prevalent more than a decade ago as a means for delivering malware to a victim, but recent developments are breathing new life into this old type of attack.
These days, security professionals most commonly run into steganography as part of Capture the Flag (CTF) competitions. A recent example comes from the 2018 Hacktober.org CTF event, where the flag “TerrifyingKitty” was embedded in an image. This strategy is clever, in part, because the technique is old enough that many younger security professionals don’t even consider it when looking to solve a problem.
Steganography can be used for more than fun and games, however. Cyberthreat actors have once again begun to incorporate this technique into various aspects of their schemes and wares. Recent examples include the Sundown Exploit Kit and the new Vawtrak and Gatak/Stegoloader malware families.
One of the reasons steganography fell out of favor is that it typically cannot be used in high-frequency threats (although the botnet Vawtrak made the list of botnets with the most bursts of activity during the fourth quarter of 2018). Because these threats are limited to a specific delivery mechanism, they generally do not achieve the high volumes that cybercriminals are looking for—Vawtrak never exceeds a dozen firms in one day. So when FortiGuard Labs researchers observed a surge in malware samples using steganography to conceal malicious payloads in memes passed along on social media, their curiosity was piqued, and they did some reverse-engineering on the code to see what was happening.
Like just about every other malware, the malware embedded in these memes starts by attempting to contact a command-and-control (C2) host, which then downloads additional code or commands associated with an attacks. That’s where this one gets interesting.
Rather than receiving commands directly, the malware is instructed to look for additional images in the associated Twitter feed, download those images, and then extract commands hidden within those images to propagate its malicious activity. It does this by searching for image tags with modified values containing commands such as /print (screen capture), /processes (write a list of running processes), and /docs (write a list of files from various locations).
This approach is ingenious because most security processes have been focused on identifying and thwarting communications and commands sent between an infected device and a C2 server. This unique undercover approach demonstrates that our adversaries continue to experiment with how they can advance their purposes without being detected, in this case, through images shared on social media, as well as the limitations of our generally two-dimensional approach to security.
So, even though steganography is a low-frequency attack vector, cybercriminals have figured out how to employ it in a manner that enables them to leverage the prevalence and rapid growth of social media to deliver a malicious payload. In this case, an attack vector that starts small – even outside of the corporate network – can rapidly expand in circumference.
The challenge is that there is no way to focus on the entire attack spectrum. As the old adage goes, the bad guys only need to be right once; you need to be right every single time. Although security professionals certainly need to guard against such innovative attacks with ongoing cybersecurity awareness training, they also need to ensure that they have transparent visibility across their entire attack surface. For many organizations, that requires rethinking and reengineering their security infrastructure.
Although a growing list of indicators of compromise can be used to detect malicious steganographic code, for the most part, steganographic attacks arrive as zero-day threats. This makes access to up-to-date threat intelligence and behavior-based analytics, combined with automation and AI to respond to threats at digital speeds, important components in any effective defense against steganographic threats.
