Embedding Advanced Persistent Threat in Steganographic Images

Abstract

The main characteristic of Advanced Persistent Threats is the stealthy and long period of attack. These threats usually aim at stealing secure information and include six phases: (i) Reconnaissance, (ii) Delivery, (iii) Initial intrusion, (iv) Command and control, (v) Lateral movement, and (vi) Data exfiltration. This paper proposes an APT attack scheme that exploits image steganography, in which a malicious code is embedded into a digital image. The stego-image can be triggered by an extractor program. The most common methods of delivering malicious code to target include phishing, watering hole attack, removable drive, compromised control system, and provided system service; these can all be detected. In contrast, schemes using our steganography-based approach are less likely to be detected since there is no detecting system/software that analyzes pixel values of an image. The behavior and signature of the extractor program are very different with the other malwares. The steganography is always used to deliver secret message by building a covert channel, but this technique can also be used to hide malware. In our experiments, both stego-image analysis and extractor program are tested. We present the more efficient detection methods to countermeasure advanced persistent threat in this paper.