Steganography: government documents under analysis

Analysis published in May 2022. The full document is available below.

Steganography is the practice of hiding a message inside another message, file or object, so that no one suspects it exists. In computing, text, images, audio or documents can carry hidden content. This analysis looked at three documents published on the official servers of a Romanian national agency, whose table borders turned out to be made of strings of characters rather than lines.

Key points

• Three documents, three different people, three different years, the same institution.
• The “lines” of the forms were neither solid nor dotted: they contained many characters that looked like text.
• Optical character recognition produced fragments in Arabic and Gujarati script, apparently excerpts from different conversations, full of names and places.
• The cause could not be established: a compromised computer, modified software or a compromised server are all possible.
• What is certain: the documents had been modified by someone, a threat actor or a system.

What steganography is

The word comes from the Greek steganós (“covered, concealed”) and -graphia (“writing”). Unlike encryption, which makes a message unreadable, steganography hides the fact that a message exists at all. It can use text, images, audio, network protocols or office documents.

What was found

At first glance, the scanned forms looked normal. On closer inspection, the table lines were made of characters that were hard to read and resembled the words in the form. In Word, table borders can be styled from a predefined list, but these were clearly altered.

Text extraction from small portions gave no meaning. Extracting the characters page by page, from all three documents, produced longer passages that looked like fragments of discussions on different topics, containing names of people and geographic regions. The first hypothesis, that the documents had been altered for black-hat SEO, did not fit what was found. What is published represents about 15% of an analysis that took almost 25 hours.

Possible explanations

• the computer used to edit the documents was compromised;
• the editing software had been modified to insert the characters;
• the institution’s server was compromised and someone changed the files.

Each of these has implications for personal and confidential data that could be compromised and exploited.

What still applies today

• public institutions should check the integrity of the documents they publish, not only their content;
• cybersecurity is more than updates and an SSL certificate: workstations, software and servers all need protection;
• staff training should come before digitalisation, not after it.

ProDefence offers web and network security testing and analysis of suspicious files.