# Using steganography in various channels to identify the source of a data leak Alexey Drozd · SearchInform MOSCOW FORENSICS DAY ’25 · Day 2 — Friday, 12 September 2025: information security day · Scheduled 16:10–16:40 · In the recording 07:51:30–08:13:23 Talk summary · https://2025.moscow-forensics-day.workers.dev/en/summary/18-drozd Transcript: https://2025.moscow-forensics-day.workers.dev/en/transcript/18-drozd · Slides: https://2025.moscow-forensics-day.workers.dev/en/slides/17-drozd-steganografiya · Watch from 07:51:30: https://youtu.be/4V7Wez3L_58?t=28290 --- ## In brief A talk by a DLP vendor: steganography is needed not by the insider but by the security officer — "straw" laid down before the leak, so as to narrow the circle of suspects afterwards. Three ways to find the source: information-system-based, user-session-based, and labels in the file plus encryption. The value — an honest list of unsolved problems and the refusal to sell; but the topic as a method was not covered, and the scheme works before the leak, not for finding the source. ## Key points - Insiders get no further than `copy /b`: an engine of their own is "not for average minds". They bypass things more simply: Ctrl+F, 5 → "five", and regexes go blind; "a gazillion ways" that not a single DLP will see through without neural nets. - The security officer needs it in order to "lay down some straw": within the "24 hours to respond, 72 hours", to give the point to dig from. - Approach No. 1, information-system-based: interception with attributes (who was CC'd, attachments, IP, MAC), the object — the account; integration at the driver level (DCAP) is needed, while the DLP agent is "not very good yet on macOS, and practically useless" in the cloud. - A cloud document cannot be assembled either with a keylogger or by intercepting HTTPS (each packet carries only the delta: "PL", then "AN") — only via API: Google Workspace, VK, Yandex 360, M365/Graph API, "you can't integrate with everyone out there". - Approach No. 2, user-session-based: watermarks on all monitors at the driver level against photographing the screen with a smartphone — the username, the machine name, the date, the time show up; at EveryTag a document is marked by shifts in line spacing and indents. - Four unsolved problems: formats ("audio… what do you do there? Unclear"); a unique copy for every user; the mark dies from an overexposed photo; retyping "letter for letter" — "What do you do? Nothing". - Demand has grown over two years, but the speaker is not selling "elephants": there will be nothing universal for all channels (a printer needs its own, audio and engineering drawings their own, text a third thing); the only universal things are labels in the metadata plus encryption based on them — ABAC, "reinventing… Microsoft RMS". - The bottom line: steganography is "just a supplement"; "the best incident is the one that never happened", the insider is to be caught "on takeoff". ## Tools, artifacts, technologies - Used and shown: **DLP** (not named), **DCAP**, a **DLP agent**, a **keylogger**, **HTTPS interception**, cloud **APIs**, **VDI**, a connection graph, **watermarks on monitors** (they die from overexposure). Reference points: **EveryTag**, the watermarks of deepfake generators and their detectors, **labels in the metadata**, **Microsoft RMS**, **ABAC** — in development. - Criticized: **regular expressions**; `copy /b` and Ctrl+F — the insider's arsenal; **LLMs** — expectations for now; from the Q&A — **Canarytokens**, the "zero pixel", an **IP logger**; from the audience — audio watermarks "since the 90s". ## Legal and organizational context Barely came up at all: no articles of law, no agencies, no methodologies — corporate information security, not forensics. The only norm, and with no source: "24 hours to respond, 72 hours to report something to someone"; Federal Law 152-FZ and Roskomnadzor were not mentioned. The framing — "the incident lifeline" and the protected perimeter. The terminology — "leak", "incident", "personal data", "security officer". ## Questions from the audience - An attendee (did not introduce himself) — an addition: audio watermarks "have existed almost since the 90s"; the speaker did not answer. - His question as well: what is your view of Canarytokens — the zero pixel for tracking whether a document has been opened? The answer: negative, this is "the need for an active action, that is, a risk of exposure"; "that kind of functionality should be something you can switch off". - There were no more questions: "I see no hands". ## The speaker's position Steganography is not a panacea but a supplement to DLP/DCAP; the problem has been solved by no one, the speaker included. He argues with the belief in a universal labeling mechanism and with the idea that LLMs will sort out DLP bypasses. He admits the limitations himself: the agent is weak on macOS and in the cloud, "our watermarks" do not survive overexposure. The tone — a conversational lecture with self-irony, not a sales pitch. ## Quotes - "…not for average minds, writing your own engine for it and getting further than copy /b…" - "In the end, formally you have the entire capture, but no complete document to analyze." - "I didn't come here to sell you some of our elephants…" - "My personal view: in principle, the best incident is the one that never happened."