Alternate Data Stream (ADS) and Steganography Hiding Techniques
This paper provides a review of the relevant literature concerning alternate data stream (ADS) and steganography data-hiding techniques, including how users can utilize ADS to hide data and use them for destructive purposes and a discussion concerning rootkits and their use as alternative data-hiding techniques. Finally, a description of the processes and tools that can be used to detect steganographic applications is followed by a description of two steganography tools that can be used to hide data.
Explain how a user could utilize ADS to hide data and explain other destructive uses which exist for ADS. According to Vacca and Rudolph (2011), alternative data streams (ADSs) can be used in a number of different ways to hide data. In this regard, Vacca and Rudolph report that, "For example, kernel space filters such as kdl use ADS by attaching their log files to system files or directories" (p. 152). In addition, other methods used to hide data utilizing...
Using stream names such as encrypted, archive, or other common Windows terms;
2. Creating streams that have no extension identifier;
3. Creating streams attached to obscure system files for data dumps, log files, etc.;
4. Storing encrypted data in single streams or across multiple streams;
5. Storing binary data across multiple streams to be reassembled and executed at the time of use to avoid detection; and,
6. Storing device drivers as streams (Vacca & Rudolph, 2011, p. 152).
Besides hiding data, some ADS techniques are also destructive, including the following:
1. Flooding a guaranteed available critical space file with useless stream data to use all available disk space;
2. Attaching Trojans, worms, viruses, spyware and other malware as streams;
3. Embedding trade secrets in streamed files (Vacca & Rudolph, 2011, p. 152).
Determine how rootkits can…
