#steganography

Last week I wrote about how steganalysis catches naive embedding — comb patterns in pixel histograms, RS analysis asymmetry, the works. This week: what Vaultify does differently, and why "hide it well" is harder than it sounds. Naive tools embed the same amount of data into every pixel, uniformly — which is exactly the uniformity last week's detection methods key on. Vaultify runs an AI system that models how a person actually perceives an image — which parts a human eye would register a change in, and which it wouldn't — to decide how much each region can absorb. Then, separately: the payload gets encrypted first, and only the ciphertext gets embedded — a break of one layer doesn't hand over the other. No permanent claims about tomorrow's forensic research, just an honest one about resisting today's — the field doesn't stand still on either side. Full article details: https://kennethbspringer.au/2026/07/22/how-photo-steganography-works-and-how-we-push-vaultifys-limits/ #infosec #steganography #OSINT #digitalforensics

Stegano 2.5.0 is out! 🎉 This release adds a reversible data hiding technique based on histogram shifting (Ni et al., IEEE TCSVT 2006): unlike LSB, the original cover image can be recovered pixel-for-pixel after the hidden message is extracted. Includes a new stegano-rdh command line tool. Thanks to Eesh Saxena for the contribution! https://github.com/cedricbonhomme/Stegano/releases/tag/v2.5.0 #steganography #Python #FOSS

Your steganography tool says the image is clean. Here's what the chi-square test says. LSB replacement — the simplest and most common form of image steganography — leaves three separate statistical fingerprints: a comb pattern in pixel value pair histograms, a measurable shift toward true randomness in the LSB plane, and a broken correlation between the LSB and the rest of the image that real camera noise doesn't break. RS analysis turns the first two into a quantitative test — partition the image into pixel groups, measure local smoothness, flip the LSBs and measure again. Unmodified images hold a specific symmetry between the resulting group counts. Embedding breaks that symmetry in proportion to how much payload was hidden, which means RS analysis doesn't just detect presence — it estimates embedding rate. DCT-domain hiding (embedding inside JPEG's compressed frequency coefficients rather than raw pixels) is a harder target for spatial tests like RS analysis, but coefficient-histogram and calibration-based methods exist specifically for that domain. Harder to detect has never meant undetectable — every generation of "harder to catch" embedding gets a purpose-built detection method eventually. No single test proves presence or absence with certainty in either direction — noisy or heavily compressed images can trip a naive test into a false positive, and adaptive embedding can sit under one test's threshold. That's why real steganalysis combines multiple independent signals and reports confidence, not a binary verdict. snapWONDERS runs this as part of its forensic pipeline. Full breakdown: https://kennethbspringer.au/building-steganography-detection-statistical-analysis/?utm_source=mastodon&utm_medium=social&utm_campaign=article-12 #OSINT #digitalforensics #infosec #steganography

I built this for learning purposes (I know JPEG steganography is not new, but I couldn't find much combining it with a multimodal LLM attack vector, so I thought why not?). Small C tool, LSB + spread spectrum where payload survives recompression. https://github.com/FrancescoPaoloL/imgpoison #infosec #llmsecurity #steganography