- In this lesson 4.6,
we're gonna be talking about Steganography.
Now, steganography isn't really a cryptographic solution
but because it hides data, that's its goal, right?
It makes data unreadable,
this seemed like the logical place to add it.
So it's in this lesson with us.
So steganography is the science of hiding information.
Now it consists of a message and a cover image.
The message is the secret data,
the cover image is the carrier that hides the message.
You may have seen examples of this
in maybe some murder mysteries that you've read or watched.
Steganalysis is the study of detecting
those hidden messages using steganography.
So what might be some of those digital cover images?
Well, we might embed the message in text
hiding information in a text file.
Maybe every nth letter, or on every nth page.
Could be in an image.
Hiding information in an image file
like a BMP or a JPEG or a GIF or a PNG file.
In audio, hiding information in an audio file
like a WAV or an AU or an MP3.
Or hiding information in a video file
like an AVI or an MP4 or an MPEG.
Those are all of the covers,
we put the message inside those covers
to hide the message.
The objective of steganography is concealment
and there's a variety of use cases.
For example, a digital watermark is really a hidden message
that's used to prove or claim ownership,
generally of intellectual property
or an artistic work.
So that's really an example of using it for good.
But steganography could also be used
for covert communication,
it can be also be used to conceal malicious code,
like malvertising, or phishing, or exploit kits.
So let me give you a really simple
steganography illustration.
Taking this image, image1.jpeg,
I'm going to add a text file to that image.
So the image is the cover, the text file is the message.
And then I'm gonna end up with final1.jpeg.
Now, does it look exactly the same as image one?
Well, absolutely it should
because I haven't changed anything in the cover image.
The picture's exactly the same.
But now I've embedded the text file in that picture
and I wanna show you absolutely how simple that was.
Dropping into a command prompt,
copy/bimage1jpeg=text1.text final1.jpeg,
which says combined text one text and image1.jpeg
to give the output of final1.jpeg.
And if I opened up final1.jpeg in notepad,
well, what you would see,
and the only message I've actually put in there is my name
that when they got combined,
there's my name, right?
There's the message embedded in that picture,
now, if you didn't know to open that up in notepad, right?
You'd never have any idea whatsoever
that there was a message embedded in that picture.
So the difference between steganography and cryptography,
well one is the purpose, right?
Steganography the purpose is to conceal.
We often think of it as covered writing.
Cryptography our purposes are confidentiality,
integrity and non-repudiation.
There's a difference in communication channel
in steganography, the existence of that secret
communication channel is not known,
in cryptography the existence of the communication channel
is known.
And then we have these mathematical transforms
or transformations.
Mathematical transforms or transformations
are not used steganography
but they are used in cryptography.
That was a short little lesson,
brings us to a three second challenge.
Oh, everybody's gonna get this one, right?
This is the practice of concealing data,
it's what our whole lesson was about.
1, 2, 3, steganography.
Number two, hidden data used to prove ownership.
I said sometimes there was good uses, valid uses.
1, 2, 3, this was a digital watermark.
Number three, malicious code embedded in advertising.
We didn't really talk about this,
I used this term really, really quickly.
When malicious code, malicious code is embedded
in advertising, what are we gonna call it?
1, 2, 3, and that's gonna be malvertising.
Number four, a carrier that hides a secret message,
1, 2, 3, that's gonna be the cover image.
Remember we said it could be text,
it could be audio, it could be a picture, it could be video.
And lastly, number five,
the study of detecting messages using steganography.
1, 2, 3, and that's gonna steganalysis, okay?
That brings us to our security and action
about malvertising.
Your marketing term, heard about malvertising
at a seminar, and now wants to learn more.
And they've asked you to explain
what it is and how it works.
Now, bearing in mind that they're not very technical
what would you tell them?
Now, also, bearing in mind, we didn't talk
about it very much, and what would you tell them?
So go ahead, put me on pause.
Think about this for a minute
then come on back and we'll do our explanation.
Malvertising is a practice of placing malicious
or malware lighting advertisements
onto a legitimate online advertising network or a webpage.
Now, a common technique, and why we're talking
about it here in this lesson,
is the malicious code is hidden in a cover image,
a graphic file, or in white space,
or in an audio file, right?
And that hiding technique is known as steganography.
Now, little to no user interaction is required
to become infected, right?
It can be as simple as visiting the webpage.
Now, maybe they downloaded the graphic
or you know, downloaded a file.
But a lot of times just by being
on the page where that graphic is,
or that text that file is, the system can become infected.
And that, my friends, is the relationship
between malvertizing and steganography
being able to explain that, absolutely, security and action.
It's a pretty small word cloud
but make sure that you know all of these terms.
When you're ready
we're gonna do a 10 question quiz together.
I'll see you there.