Information Hiding in Executable Binaries

Architecture and Background

Rakan El-Khalil, Information Hiding in Executable Binaries Information Hiding techniques are much researched in the context of watermarking or fingerprinting images and sound files, mainly as a means of copyright protection and piracy prevention/detection. Those mediums offer a significant amount of redundancy, thus lending themselves to the implementation of robust IH systems. Executables however do not offer such amounts of redundancy, and have thus far proven to be a difficult and rarely used medium for steganographic and other IH purposes.

Vulnerability Analysis

The aim of this talk is to be an introduction to IH, with a thorough coverage of state of the art techniques for embedding into binaries. Hydan, a tool for performing such embeddings in machine code, will be presented. In addition to typical IH uses [steganography, watermarking], the tool and techniques shown can be used in anti-reverse engineering, trusted application execution, frustrate some buffer overflow attacks, and as an engine for metamorphic viruses.

Exploitation and Demonstrations

An interesting effect of the tool is that the executable remains the same size before and after embedding, while of course remaining functionally equivalent. Rakan El-Khalil is currently on sabbatical in France. He is a recent MS CS graduate from Columbia University.

Remediation and Defensive Strategies

While he was there he worked on a variety of projects at the CS Research Lab, such as an IDS that uses machine-learned models to detect network threats, and a syscall based permission system on OpenBSD [predating systrace]. He was also responsible for the short-lived official KaZaA Linux client `kza". Currently he is involved with The Bastard, a powerful linux disassembler, and has been researching steganography and information hiding in machine code.