Steganography is the art and science of embedding secret messages in a cover message so that no one, apart from the sender and intended recipient, suspects the existence of the message.
The most common example is to hide a message in an image file without compromising how the image looks. The majority of the people are using the photos to share a fantastic moment or two and don’t know that they can contain a secret message.
What could be the use-case?
Someone can hack your phone and embed your text messages in the pictures you take and share in, say, Instagram.
A not so happy employee can post a picture on your blog with a secret message embedded in it to share some trade secrets with your competitors.
Another person can embed an exploit in a PNG ads image; JavaScript code would parse the PNG image, extract the malicious code, and redirect the user to the exploit kit landing page.
Steganography also is a well know method for exchanging information between spies.
Even if it sounds like science fiction, this is a very viable threat against your systems and you.
Steganography Protector API
I have created a small API (as a Proof of concept) that could discover a secret message hidden in any image file.
The end-point is here:
https://sapigate.herokuapp.com/steg
It accepts POST requests only.
The input should be JSON encoded, and it should consist of a binary stream of your image.
Here is a Python example.
import requests
url = 'https://sapigate.herokuapp.com/steg'
my_img = {'image': open('secret.png', 'rb')}
r = requests.post(url, files=my_img)
print(r.json()) The result of the command can be:
{'message': 'Secret Message', 'status': 'sucess'}I am planning to extend the API by adding more use-cases and documentation, but if you are free to start using it right away.
If you have any questions about it or it seems down, contact me via Twitter – @bogomep
A practical use
You could read all of your images from your blog and via the API to check whether they contain a secret message or not or to check for hidden traces of your last Instagram image.
If you are looking for a picture with a secret message inside – why don’t you test this one:
