SANS Digital Forensics and Incident Response Blog: Tag - watermark

Simple Anti-Forensic and Signature stamping techniques using Unicode

by Craig Wright

The introduction of Unicode characters (such as Persian, Cyrillic and Arabic characters) has introduced both a simple means of fingerprinting intellectual property (signature stamping) and a very simple steganographic data hiding technique.

The following is an extract from the Cyrillic Unicode character set [1].

Unicode #Character

0410 ? CYRILLIC CAPITAL LETTER A

0430 ? CYRILLIC SMALL LETTER A

0412 ? CYRILLIC CAPITAL LETTER VE

0415 ? CYRILLIC CAPITAL LETTER IE 0435 ? CYRILLIC SMALL LETTER IE

041C ?CYRILLIC CAPITAL LETTER EM

041E ? CYRILLIC CAPITAL LETTER O

043E ? CYRILLIC SMALL LETTER O

0420 ? CYRILLIC CAPITAL LETTER ER

0440 ?

...