Steganography: Harmless Software or Tools for Criminal Behavior?

Even though the word steganography sounds like it may be associated with cavemen and even dinosaurs, it is far from that. So what is steganography? According to Webopedia, steganography is the art and science of hiding information by embedding messages within other, seemingly harmless messages. This "science" is widely known to be used by terrorists and pedophiles.

So how does steganography work? The user would take the information they want to hide, find or create a website that contains images (normally BMPs), and then embed the image into the existing picture by replacing bits of the data that is unused. The type of information that can be embedded can be anything from plain text to images and it will go unnoticed to the average viewer. The 9/11 terrorists were known for using steganography tools to hide the information on the attacks.

So how do you find steganography software and why would you need it unless you were up to malicious activities? There are not a lot of steganography software openly listed when you Google it. This is because it is mostly seen as a tool only "bad" people may use in order to encrypt or hide information. However, if you use the correct search information you may be able to find several, one of which is called Contraband 9i. This software was not labeled as steganography software, but instead stated that you could embed and extract any file into a true-color BMP by using it. The author did not refer to it as steganography software, but as a steganographic tool.

At any rate, I noticed that many "underground" (so to speak) sites that listed these type of tools also stated how the NSA feels that these tools and software are their worst nightmare. With Contraband 9i, it allowed you to basically make any file invisible to anyone that wouldn't know it was done, by hiding it in a picture; via a BMP. Apparently this version is the newer version, where as the older version also used scrambling. This group also has a Beta version called Contraband Hell Edition, that supposedly has unbreakable code built in and works with Windows 95/98/NT.

Upon thorough searching, you may come across a website or two that also lists several steganography software sites. You may be surprised that many of the links have been taken down for one reason or another. Some of the various software titles that may be listed on these sites may be: Courier v1.0 (embeds images in a 24-bit BMP), Data Stash (embeds images, audio, text, file/disk, and other), DCT-Steg (embeds with JPEGs), and EzStego (an implementation of Stego in Java).

At Linux.com, you can find very useful information on both sides of steganography software. You can use the software for good purposes if you are a system administrator, such as embedding password lists for various web sites in pictures. Steganography can also be used for copyright protection by embedding a hidden mark in the file, which is normally called digital watermarking. So as you can see, the software isn't always intended for malicious use such as terrorism, pedophilia, and smuggling.

So what is the bottom line; do you need the software or do you not? If you are a system administrator or a network administrator, then yes you may have certain uses for theses tools. Also, if you are studying to be a computer forensics investigator, then you may also want to either purchase a tool or download a free tool to experiment with. There are a large variety of tools available if you know where to find them and they range in price from free to over $2000.00. However, if you only have malevolent thoughts of using the software, then you may want to think twice before doing so. No matter how easy and fool proof it may seem, please keep in mind there is an outcome to your actions and the federal government and the NSA may frown upon this.