nerdexam
GIAC

GSEC · Question #106

If you do NOT have an original file to compare to, what is a good way to identify steganography in potential carrier files?

The correct answer is A. Determine normal properties through methods like statistics and look for changes. Without an original reference file, steganography is most reliably detected by applying statistical analysis to identify anomalies in a file's properties.

Incident Handling, Risk, and Governance

Question

If you do NOT have an original file to compare to, what is a good way to identify steganography in potential carrier files?

Options

  • ADetermine normal properties through methods like statistics and look for changes
  • BDetermine normal network traffic patterns and look for changes
  • CFind files with the extension .stg
  • DVisually verify the files you suspect to be steganography messages

How the community answered

(24 responses)
  • A
    83% (20)
  • B
    8% (2)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Without an original reference file, steganography is most reliably detected by applying statistical analysis to identify anomalies in a file's properties.

ADetermine normal properties through methods like statistics and look for changesCorrect

Statistical steganalysis examines properties such as color histograms, frequency distributions, and bit-level patterns within a file to detect deviations from what is expected for a clean file of that type. Even without an original, statistical irregularities introduced by embedding hidden data - such as abnormal LSB (least significant bit) distributions - can reveal the presence of steganography. This is the foundational technique used by detection tools like StegDetect.

BDetermine normal network traffic patterns and look for changes

Analyzing network traffic patterns is a network-level forensic technique that does not reveal hidden data embedded within the binary content of individual files.

CFind files with the extension .stg

There is no standard .stg file extension associated with steganography; hidden data is embedded within common carrier formats like JPEG or PNG without changing the file extension.

DVisually verify the files you suspect to be steganography messages

Steganography is specifically designed to be visually imperceptible to the human eye, making visual inspection an unreliable and largely ineffective detection method.

Concept tested: Steganalysis without original reference file

Source: https://csrc.nist.gov/publications/detail/sp/800-101/rev-1/final

Topics

#steganography#statistical analysis#carrier file detection#forensics

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice