Steganography — Hiding Data in Plain Sight
In 2017, security researchers at ESET published an analysis of the Turla APT group, a sophisticated threat actor linked to Russian intelligence operations. Among Turla's most novel techniques was the use of steganography to deliver command-and-control instructions to already-infected machines. Operators would post photographs and images to publicly accessible Instagram and Twitter accounts. The images appeared completely ordinary — holiday photographs, landscape shots, stock imagery. But embedded invisibly within the pixel data of each image were encoded instructions directing infected hosts on their next actions. Infected machines periodically fetched these images from the platforms, extracted the hidden commands, and executed them. Network monitoring tools saw only normal HTTPS traffic to major social media services — nothing that would trigger an alert.
This technique illustrates the core power of steganography: it does not protect the secrecy of data by scrambling it (that is encryption's job). Instead, steganography hides the very existence of the data. An observer who does not know to look for hidden content will see nothing unusual at all.
What is steganography?
The word comes from the Greek steganos (covered or concealed) and graphia (writing). Steganography is the practice of embedding secret information inside an innocent-looking carrier medium — an image, an audio file, a video, or even a document — in a way that the carrier appears completely normal to any observer who does not possess the knowledge or tools to detect the hidden content.
The most common digital technique is Least Significant Bit (LSB) encoding, in which the hidden data is written into the lowest-value bits of pixel colour channel bytes. Because the LSB contributes only 1/256 of a channel's total intensity, the visual change in the image is imperceptible to the human eye.
Why does every CTF include steganography?
Capture The Flag competitions include steganography challenges because they test a mindset that is fundamental to security work: the ability to look beyond the surface and ask what might be hidden in an apparently normal file. The techniques used in CTF challenges — strings, binwalk, zsteg, hex dump inspection — are the same techniques used in real incident response and malware analysis.
In this lab, you will apply three analysis methods to a corporate PNG image to recover three fragments of a hidden flag.