Encryption hides what a message says. Steganography hides that a message exists at all. The two are often confused, but they solve opposite halves of the same problem — and understanding the second is how defenders catch data walking out the door disguised as a cat photo.
Encryption vs steganography
Picture two ways to protect a note. Encryption puts it in a locked box: anyone can see there is a box, they just can't read what's inside. Steganography slips the note inside the spine of an ordinary book on a shelf of a thousand books: nobody even knows there is a note to look for.
That difference is the whole point. Encrypted traffic is conspicuous — a firewall sees a blob of ciphertext and knows secret data is moving, even if it can't read it. Steganography aims for plausible deniability: the carrier looks completely normal, so no alarm ever fires. Sophisticated actors combine them — encrypt first, then hide the ciphertext — so that even if the hidden channel is discovered, the payload is still unreadable.
LSB: hiding data in the pixels
The textbook technique is least-significant-bit (LSB) encoding in images. Every pixel in a photo is a set of colour values, each a number from 0 to 255. Flip the very last bit of that number and the colour shifts by one shade — a change no human eye can perceive. A red value of 10110010 becomes 10110011; the pixel looks identical.
But that one imperceptible bit per colour channel is a place to store a bit of secret data. A single multi-megapixel photo has millions of pixels, so it can carry a substantial hidden message across all those spare bits, and the image still looks exactly like the original vacation snapshot. Read the last bit of each value in order and you reconstruct the payload.
This is why lossless formats matter to the technique: PNG and BMP preserve every bit, so LSB survives. JPEG's lossy compression rewrites those exact values and destroys naive LSB data — so steganography in JPEGs works differently, hiding data in the frequency-domain coefficients that compression keeps rather than in raw pixels.
Beyond images
Pixels are just the famous example. The same idea — exploit redundancy in a carrier nobody inspects closely — appears everywhere:
- Audio and video have far more capacity than still images, hiding data in inaudible frequency ranges or the low bits of each sample.
- File structure tricks: appending data after a file's official end marker, or tucking payloads into metadata fields and unused headers. A JPEG viewer stops reading at the end-of-image marker; whatever you append after it rides along invisibly.
- Text and documents: zero-width Unicode characters, subtle whitespace patterns, or word choices that encode bits while reading as normal prose.
- Network covert channels: this is the one defenders lose sleep over. Data smuggled in the timing of packets, in unused TCP/IP header fields, or — most commonly — in DNS queries. A machine that can't reach the internet directly can often still make DNS lookups, so malware encodes stolen data into the subdomain of a lookup (
c3VwZXJzZWNyZXQ.attacker.com) and the attacker's authoritative server reads it off. It looks like ordinary name resolution.
Why this matters to defenders
This is not academic. DNS tunnelling and image-based steganography are real exfiltration paths used to sneak stolen data past firewalls and data-loss-prevention tools, precisely because the traffic looks legitimate. A DLP system tuned to spot credit-card numbers in outbound email sees only a normal PNG upload or a burst of DNS lookups. Malware also uses steganography for command-and-control, pulling instructions hidden inside images posted to public sites that no blocklist would ever flag.
Understanding the technique is the entire basis for detecting it. You cannot defend against a channel you don't know exists.
How defenders catch it
Hidden data is not invisible to statistics, even when it's invisible to the eye:
- Steganalysis looks for the statistical fingerprints that hiding leaves behind. Natural images have predictable patterns in their least-significant bits; stuffing them with encrypted data makes those bits look too random, and detectors flag the anomaly. The carrier looks normal to you and suspicious to the math.
- Traffic analysis watches for behaviour, not content. An endpoint making thousands of DNS queries for long, high-entropy, never-before-seen subdomains is tunnelling, whatever the payload says. You don't need to decode it to block it.
- Sanitisation sidesteps detection entirely: re-encoding every uploaded image or stripping metadata at the gateway destroys most hidden payloads without ever having to find them. If you rewrite the pixels, the smuggled bits die with the originals.
- Egress monitoring and allowlists cut the exfiltration path: if internal hosts can only resolve DNS through a controlled, logged resolver and can't reach arbitrary outbound destinations, the covert channel has nowhere to send.
The takeaway
- Encryption hides content; steganography hides existence — real adversaries layer both for deniable, unreadable channels.
- LSB encoding buries data in imperceptible bits of lossless images; the same redundancy trick extends to audio, files, text, and network traffic.
- DNS tunnelling and stego uploads are live exfiltration paths — they beat content filters by looking completely ordinary.
- Detection is statistical and behavioural — steganalysis, traffic analysis, sanitisation, and egress control catch what the eye can't.