Steganography Uses Code That Downloads

Its called steganographyand it involves hiding a document, video, or photograph inside another file that seems legit.

This is steganography, and its described as the digital equivalent of invisible ink.

The technique makes it easy for criminals to surreptitiously transmit data-stealing malware.

In this vein, the most important and recent trend is to equip malware with information-hiding capabilities, or techniques that hide communications, say the authors.

Their goal is five-fold: scouting the target, scanning it, gaining access, staying undetected, and covering their tracks.

Once the platform was infected, the malware collected payment details and hid them inside images of real products available on the infected e-commerce site.

The malware impersonates a pornography player or a multimedia messaging service application but without the correct functionality, eventually tricking the user to install the application and spread the infection.

Steganography Uses Code That Downloads

To spread the infection, Cerber uses a decoy document which, when opened, loads a malicious macro-code that downloads a JPEG file to the targeted machine.

The image holds a steganographically-embedded malicious executable, the authors say.

Malicious code is embedded within banner ads by modifying the color space of the PNG image (the alpha channel).

Then, the victims browser parses an injected JavaScript code, extracting the malicious code, and redirecting users to the exploit kit landing page.

The infection is performed on the landing page, typically by using several Flash vulnerabilities.

Cybercriminals will place more emphasis on making it harder to detect and trace back malware to its origin, which will be a main driver for the increased use of information hiding, the authors say.

Cameron Senior Writer Lori Cameron is Senior Writer for the IEEE Computer Society (CS) and currently writes regular features for Computer magazine, Computing Edge, 13 CS magazine websites, and a career blog.

She serves as manager and writer for several CS social media outlets.

In addition, she has been a visiting professor of writing and literature at DeVry University, Long Beach, and a technical writer for over 20 years.

Hes a virtuous cycle of innovation, deployment, and further scientific discovery.