Steganography and how to decrypt a hidden message

Hiding messages in images is a popular encryption technique. Take a look at the following image:

[image omitted from archive]

Just by looking at the image, it's impossible to see that it contains a secret message. Fortunately, for every encryption technique, the budding cryptobreaker has a decryption method. Let's take a look.

Using jhead we quickly learn that something's afoot. jhead reads JPEG headers, including EXIF comments. It does not touch the pixels.

$ jhead NSM_LOGO_RGB.jpg

Comment      : R2plbmJydWsgYXYgcGFzc29y[...]lcj8=

Notice the the comment section. This is base64-encoded data (shortened for easier reading). Strictly speaking, this is not an encryption layer, but a way of representing text as data. Decoding the data gives us: Gjenbruk av passord er et alt for vanlig fenomen. Kanskje det kan brukes til din fordel her?

Which is norwegian and is a clue for the password that hides the secret message within. In short, it tells us that people like to reuse passwords. Since this image was uploaded as part of an online test on the Norcert blog and we've already cracked an earlier cipher that gave us a password we can deduce it's using that one. The password was lowercase nsm.

The actual payload is not in the comment. The comment is a hint. The payload is steganography in the image bytes, which steghide can pull out if you give it the right passphrase (-p) and the file (-sf).

Using steghide, we get:

$ steghide extract -p nsm -sf NSM_LOGO_RGB.jpg
steghide: could not extract any data with that passphrase!

Lowercase nsm matches the earlier cipher, but not this file. Steghide is case-sensitive. Oops! Let's try uppercase NSM:

$ steghide extract -p NSM -sf NSM_LOGO_RGB.jpg
wrote extracted data to "flag.txt".

That writes the hidden file next to the JPEG. And there we go. The file flag.txt now has the secret message.

$ cat flag.txt
Godt jobbet!
NSM trenger hele tiden flinke folk - se våre ledige stillinger på https://www.nsm.stat.no/Karriere-i-NSM/

Three tools, three jobs: jhead to find the hint, base64 to read it, steghide to open the real hide. The password reuse the comment warned about was the whole puzzle.