steghide: Naughty, naughty

Things like steghide make me wonder exactly how much trouble I could stir up, given adequate time of course.

steghide is that tool you’ve known existed for a long time, but didn’t want to ask about. Put simply, steghide embeds encrypted files within others — possibly images or sound files.

I haven’t tried every variation, mostly because seeing steghide work once was enough to convince me that I can metaphorically stash it in my pocket, and save it for a time when I really need it.

Here’s what it looks like. Ladies and gentlemen, I give you … Tux.

You may recognize Tux from films and movies. And now, Tux’s doppleganger, his evil Captain Kirk:

You wouldn’t know it to look at him, but the Evil Tux is hiding a dark secret. We should suspect that just by looking at the file size.

kmandla@6m47421: ~/downloads$ ls -sh
 40K 2014-05-10-6m47421-steghide-tux-original.jpg
 48K 2014-05-10-6m47421-steghide-tux-embedded.jpg

There’s something … odd about Evil Tux. Check with steghide, and it will confirm it for us.

kmandla@6m47421: ~/downloads$ steghide info 2014-05-10-6m47421-steghide-tux-embedded.jpg 
"2014-05-10-6m47421-steghide-tux-embedded.jpg":
  format: jpeg
  capacity: 1.9 KB
Try to get information about embedded data ? (y/n)

Naughty, naughty. What’s this you’re carrying, Evil Tux? And more importantly, where have you hidden it? 😯

Try to get information about embedded data ? (y/n) y
Enter passphrase: 
  embedded file "secret.txt":
    size: 70.0 Byte
    encrypted: rijndael-128, cbc
    compressed: yes

steghide can yank that out of there in a jiffy. Just:

kmandla@6m47421: ~/downloads$ steghide extract -sf 2014-05-10-6m47421-steghide-tux-embedded.jpg 
Enter passphrase: 
wrote extracted data to "secret.txt".

kmandla@6m47421: ~/downloads$ cat secret.txt
Now is the time for all good men to come to the aid of their country.

Well that was anticlimactic. 😐 You can try it for yourself if you like. The password is 12345.

steghide has a lot options, and what you see above was just blatantly stolen from the quickstart guide. I imagine just about any file could be embedded into any other; like I said though, I didn’t try every variation.

Don’t get yourself into trouble, now. 😈