The New Threats of Information Hiding: The Road Ahead

Abstract

Compared to cryptography, steganography is a less discussed domain. However, there is a recent trend of exploiting various information hiding techniques to empower malware, for instance to bypass security frameworks of mobile devices or to exfiltrate sensitive data. This is mostly due to the need to counteract increasingly sophisticated security mechanisms, such as code analysis, runtime countermeasures, or real-time traffic inspection tools. In this perspective, this paper presents malware exploiting information hiding in a broad sense, i.e., it does not focus on classical covert channels, but also discusses other camouflage techniques. Differently from other works, this paper solely focuses on real-world threats observed in the 2011 -2017 timeframe. The observation indicates a growing number of malware equipped with some form of data hiding capabilities and a lack of effective and universal countermeasures.

ImageDetox: Method for the Neutralization of Malicious Code Hidden in Image Files

“…It can deal with the threat of information hiding that can be extracted later. Steganography technology has recently evolved into intelligent attacks that apply to various protocols such as CCTVs, smart TVs, and IoT devices [17]. These attacks are becoming a threat and can hide malicious or confidential information in files such as image, audio, and video files.…”

Countering adaptive network covert communication with dynamic wardens

“…Even if applying a rule needs only 100 instructions, a core running at 2 GHz and with an IPC 4 of 1.5 cannot apply more than 30 rules. 5 While the throughput can be increased by using multiple cores for different packets, latency still will grow beyond 1 microsecond for more than 30 rules, as fine-grained parallelism by using multiple cores for different rules on a single packet will not pay off because of parallelization overhead. Thus, negative side-effects for packets with real-time requirements, such as Voice-over-IP traffic, would be the consequence.…”

Covert Channels in the MQTT-Based Internet of Things

“…MQTT has been heavily applied since its appearance in 1999, e.g., in Facebook Messenger, 1 Amazon IoT (a part of the Amazon Web Services), 2 OpenStack, 3 home automation platform Home Assistant, 4 Microsoft Azure IoT Hub, 5 in the FloodNet project 6 for monitoring river levels and environmental information to provide early warnings of flooding, etc. MQTT libraries are available for many programming 1 Lucy Zhang: Building Facebook Messenger, 12 August 2011.…”

“…MQTT libraries are available for many programming 1 Lucy Zhang: Building Facebook Messenger, 12 August 2011. 2 https://docs.aws.amazon.com/iot/latest/developerguide/mqtt.html 3 https://docs.openstack.org/infra/system-config/firehose.html 4 https://www.home-assistant.io/components/mqtt/ 5 https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-mqtt-support 6 http://envisense.org/floodnet/overview.htm languages and platforms, such as Java, C, C++, C#, JavaScript,.NET, etc.…”

“…Now, as presented in this paper, these unprotected MQTT servers can be used as innocent accomplices to enable newly created covert channels. Moreover, such MQTT-based covert channels could be used to realize stealthy malware communications as it has been recently reported also for other types of network traffic and environments [4], [5].…”