@inproceedings{HildebrandtLamshoeftDittmannetal.2020, author = {Hildebrandt, Mario and Lamsh{\"o}ft, Kevin and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection}, series = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, booktitle = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, publisher = {The Association for Computing Machinery}, address = {New York}, doi = {10.1145/3369412}, pages = {115 -- 120}, year = {2020}, language = {en} } @inproceedings{VielhauerLoewePilgermann2025, author = {Vielhauer, Claus and Loewe, Fabian and Pilgermann, Michael}, title = {Towards Modeling Hidden \& Steganographic Malware Communication based on Images}, series = {IH\&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025}, booktitle = {IH\&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025}, doi = {10.1145/3733102.3733152}, pages = {52 -- 63}, year = {2025}, abstract = {Recently, an increasing number of IT security incidents involving malware, which makes use of hidden and steganographic channels for malicious communication (a.k.a. as "stegomalware"), can be observed in the wild. Especially the use of images to hide malicious code is rising. In consideration of this shift, a new model is proposed in this paper, which aims to help security professionals to identify and analyze incidents revolving around steganographic malware in the future. The model focuses on practical aspects of steganalysis of communication data to elaborate linking properties to previous code analysis knowledge. The model features two distinct roles that interact with a knowledge base which stores malware features and helps building a context for the incident. For evaluation, two image steganography malware types are chosen from popular databases (malpedia and MITRE ATT\&CKĀ®), which are analyzed in multiple steps including steganalysis and code analysis. It is conceptually shown, how the extracted features can be stored in a knowledge base for later use to identify stegomalware from communication data without the need of a thorough code analysis. This allows to uncover previously hidden meta-information about the examined malicious programs, enrich the incident's forensic context traces and thus allows for thorough forensic insights, including attribution and improved preventive security measures in the future.}, language = {en} }