# Framework for Malware Triggering Using Steganography
## 2 Background and Related Work
### Related Work  
Several methods of hiding data, such as obfuscation, anonymization, encryption, and steganography, are used by sophisticated malware. Among them, steganography is widely seen as one of the most effective methods for malware to conceal data. This is because steganography, unlike other methods, masks the very fact that any contact is taking place, which helps the malware avoid detection. Initially, steganography methods used by malware were used in advanced persistent threats (APT) [22].  
Steganography malware has used the images to hide malware settings and configuration files, provide a URL from which the malware may import additional elements, or store the malicious code directly [22]. Due to the large number of image files uploaded daily to the Internet, it has become a popular file for data embedding. There are several techniques to embed the hidden data in the image files [8]. The first recorded exploit delivery technique that used information hiding techniques was identified in 2006. However, it was not detected until 2011 [12]. Many examples of malware in the wild that use images are summarized in Table 1.  
In [10], a new method for attacking smartphone mobile browsers by using QR codes to share images encoded with a JavaScript exploit code is presented. A PNG wallpaper image of a dog was modified and then shared via QR code to exploit the weakness of the Opera browser in the Android system to reveal the cookie file.  
An APT attack scheme that uses image steganography to embed malicious code in a digital image is presented in [11]. They used an extractor program to trigger the steganage. Then they looked at the stego-image and extractor to search for patterns. The malicious payload is difficult to detect because it is hidden in the pixels of the images. They proposed a steganography-based 5-phase attack scheme. During the preparation phase, they generated the stego-image using the LSB algorithm and used CVE-2017-7494 [23] on the target to remote code execution and modify its system task scheduler to set the trigger. They delivered the stego-image and extractor to the target Samba server on an ubuntu-16.04.3-server-amd64 OS during the implantation phase by uploading them to the server's shared folder. During the inactivation phase, the trigger will detect whether the stego-image is present in the device at a specific time; if not, it will wait for the next detection time; if it is present, the extraction will be performed. A malicious payload will be extracted and then executed by the task scheduler to complete a connection request during the extraction phase. Following the establishment of the connection, the malicious payload will send a message to the binary that contains information about the victim's device to gain remote control of the target device.  
On the other hand, deep neural networks (DNNs) are also vulnerable to adversarial example attacks, as we see in [24]. They proposed a blind-watermark backdoor method whose results are invisible to humans. Their way avoids the human detectability of the backdoor sample attack by making the trigger invisible. They achieved an attack success rate is 99.3% via training with the blind-watermarked samples.