Researchers at the University of Nebraska at Omaha (UNO) and the University of South Alabama (USA) investigated the possibilities of executable steganography – the hiding of executable code within a target program, such that it is difficult to detect, remove, or alter through reverse engineering. Whereas cryptography makes data secret in an overt manner, steganography attempts to keep data from being discovered. Common applications of steganography involve hiding arbitrary data, a secret message for example, in an unrelated data set such as an image.  In our work our arbitrary data is executable code – merging an executable program that performs some function into some other program that acts as the carrier of this executable code. 

Executable steganography has potential uses for government agencies that deal with secret communication – for example to demonstrate that the integrity of a program has not been compromised.  It could also be used to transmit programs that are sensitive or secret in a way which avoids their detection.  In our example executable steganography, we focused on digital fingerprinting, useful for intellectual property protection.

Our initial research concentrated specifically on the x86-64 instruction set. One of our outcomes was to create a database of x86 instructions organized by length, from one to six bytes, which are therefore useful in our original steganography approach. A white paper was also prepared detailing how this study was made. Additionally, we presented a paper on our approach and our early results at an established reverse engineering workshop. 

Over time, though, the x86 approach proved to be a solution that works when constructed by hand but a method that does not scale well. The USA team completed their work on analysis algorithms for understanding the frequency distribution of opcodes which could be useful for software transformation techniques. This analysis resulted in a paper which was presented at a 2020 Cybersecurity Symposium. But it was this result which caused the UNO team to regroup and focus on techniques that would integrate executable code (the secret steganographic message) into existing code (the cover object) but at the level of intermediate representation within a compiler. The main difficulty in our initial approach was that the relative frequency of candidate instructions necessary for our steganography idea was insufficient in typical compiled programs. 

The result is that the UNO/USA team refocused our efforts on the intermediate representation used in the compilation process, fingerprinting at this level and then generating the program with the included steganography data in a manner which was machine independent. At this time the demonstrations of steganography at this higher level of abstraction are complete and a forthcoming conference paper describes our results. We have hidden embedded code which is then compiled in, and by moving the intermediate representation back and forth between two completely different architectures we have tested the machine independence.

The SaTC award has resulted in intellectual merit in terms of developing and characterizing algorithms for executable steganography in applied settings.  First, watermarking and fingerprinting applications are embedded using steganography, embedding code to identify the owner of intellectual property. Proof of an executable stego watermark can be demonstrated easily by changing the entry point of a program to specific address(es) where executable stego threads are embedded. The entry points, known only to a software owner, provide a covert means to establish ownership. Secondly, we are embedding this data in an independent manner, so that code at a high level can be subjected to steganography independently of the target machine.

Our grant has resulted in several broad impacts, including furthering cybersecurity research at UNO and USA, providing our faculty with opportunity to learn and grow in their field, and giving students the chance to experience and use the theoretical knowledge they gain as part of our CAE-CD and CAE-CO cybersecurity curricula.  PI Mahoney integrated research results into his current Reverse Engineering class and will further integrate these results into the Compiler class as well. Anti-reverse engineering, a topic related directly to this award, is a significant part of the class contents and the ability to have students directly examine our executable steganography work – albeit from the perspective of reversing – is meaningful. This work thus directly impacts over 50 students each Spring. 

PI McDonald utilized grant-related research threads at USA in existing Secure Software Engineering, Compilers and Surreptitious Software classes as part of term paper and student course project topics. These courses provide natural outlets to expose and involve over 80 students. This award has also had a direct impact on STEM and Information Assurance awareness at the USA, with several students at all college academic levels participating in the work. The grant provided opportunities for diverse disciplines to be explored as questions related to the grant were answered and implemented in various data experiments and developed software algorithms.

Last Modified: 02/01/2021
Modified by: William R Mahoney