Audio and Document Steganography

WAV audio files store uncompressed 16-bit or 24-bit PCM audio samples. Like image LSB steganography, we can replace the least significant bit of each audio sample with a hidden bit. The modification changes each sample by at most 1 amplitude unit out of 32768, which is 0.003 percent of the full scale and completely inaudible to human listeners under normal conditions.

Phase coding divides an audio signal into short segments and encodes hidden bits by shifting the phase of each segment. Phase differences between adjacent segments are preserved to avoid audible artefacts. Because the human ear is relatively insensitive to absolute phase values, small phase modifications carry hidden data without detectably changing the sound. Phase coding achieves better imperceptibility than LSB at the same payload rate.

Echo hiding embeds data by adding faint echoes to the original audio signal. A binary 1 is represented by an echo at a delay of d1 milliseconds; a binary 0 is represented by an echo at delay d0. The delays are chosen to be below the threshold of echo perception for human hearing (typically under 1 millisecond). The receiver extracts bits by detecting which echo delay is present in each segment.

Spread spectrum techniques spread the hidden signal energy across a wide frequency range, similar to how spread spectrum radio works. Each hidden bit modulates a pseudorandom sequence that is added to the audio at very low amplitude across all frequencies. The result resembles background noise and is difficult to separate from the audio without knowing the pseudorandom key, providing both imperceptibility and resistance to detection.

PDF documents have multiple locations where data can be hidden without affecting the visible content. Whitespace between words can be encoded using different Unicode space characters. PDF object streams can contain arbitrary data in comment fields. Metadata fields like Author, Keywords, and Creator are rarely checked by readers. The PDF structure allows null objects and unused cross-reference table entries that can carry hidden bytes.

Microsoft Word documents in DOCX format are ZIP archives containing XML files. Hidden data can be embedded in the document properties XML, in custom XML parts, or as invisible text formatted in white font on white background. Track changes and revision history can be exploited to hide data in the revision metadata. These techniques are often used in malware that exfiltrates data disguised as office documents.

Network steganography hides data within normal network traffic. TCP sequence number fields can encode hidden bits without affecting connectivity. IP header fields like identification numbers and time-to-live values carry hidden data. Inter-packet timing can encode information through deliberate delays. These covert channels bypass firewalls and content filters that inspect only payload content, not protocol field values.

Zero-width characters are Unicode code points that have no visible glyph but occupy positions in text strings. By inserting zero-width space (U+200B), zero-width non-joiner (U+200C), and zero-width joiner (U+200D) between visible characters, binary data can be encoded in text that looks completely normal when displayed. A tweet or email with hidden zero-width characters can carry hundreds of bytes of covert data invisibly.

Font substitution steganography encodes data by slightly varying the shapes of characters using two nearly identical font variants. Characters in font A represent binary 0; characters in font B represent binary 1. To a reader the document looks entirely normal. Recovering the hidden message requires knowing which characters to compare and which font variants represent which bit value.

Many colour laser printers embed tiny yellow dots invisible to the naked eye that encode the printer serial number, date, and time of printing. These machine identification codes were developed by government request to trace the origin of printed documents. The EFF reverse-engineered these patterns in 2005. This is a form of steganographic watermarking imposed by manufacturers on all printed output.

Malware authors use steganography to hide command-and-control instructions inside innocuous-looking images posted on social media platforms. The infected device downloads what appears to be a normal picture, extracts embedded instructions from the LSBs, and executes them. This technique bypasses security tools that only inspect URLs and payload types, not the content of image files.

Which audio steganography technique encodes hidden bits by representing 0 and 1 with echoes at different time delays?

WAV files support LSB audio steganography. Phase coding, echo hiding, and spread spectrum provide better imperceptibility. PDF and Word documents have many locations for hidden data including metadata, whitespace, and revision history. Network steganography uses protocol header fields and timing. Zero-width characters hide data in plain text. Printer yellow dots are mandatory steganographic watermarks imposed by manufacturers.