Steganography, or the practice of
embedding or hiding text in an image, could pose a
new online security threat. Spam and phishing messages have incorporated complex images containing text. Some image files can contain harmful code, designed to exploit security flaws (and we all know there are plenty of them.)
Recent examples of usage include a variation on the ubiquitous Citibank phishing scam that attempts to lure recipients into disclosing online banking user names and passwords.
"Previous versions used text and images, such as authentic-looking Citibank logos and privacy seals. But versions that began surfacing recently are made up of one large image file containing all the text."
Companies such as Zero Spam are now looking at using a combination of methods to block steganographic messages, including assessing the size and format of the messages, as well as looking at the sender and recipient and the route the mail took. Lets hope they are fruitful in creating technology to combat this most recent and worrying threat.
Hidden text in images heralds new security threats
09-13-2004
