Exploiting minification for data hiding purposes

Abstract

Nowadays various types of data hiding techniques are used to conceal data in different types of digital content, e.g. image, video, audio, text, or even network traffic. Such methods can be utilized for nefarious purposes, for instance, for confidential data exfiltration, enabling secret communication between the infected host and attacker's server or to download additional modules of malware. From this perspective, analyzing different schemes of data hiding allows to assess the preparedness of the current defensive systems. Minification is the process of the source code manipulation while preserving its functionality. In result, the size of the source code is reduced making the transmission more efficient. In this paper we investigate whether minification of JavaScript files can be exploited for data hiding purposes. The obtained results prove that this is feasible and thus countermeasures must be adjusted to take into account such threats.