A New Steganography Method: Hiding Information in Order

An article titled “Embedding information in disorder,” published on Lobsters, presents a novel approach to information hiding. The article details a technique that utilizes the “order” of data structures such as Exif metadata or CSS rules—elements traditionally overlooked—to embed information. What began as a playful experiment is now grounded in the theoretical foundation of permutation encoding using Lehmer code, suggesting potential applications in watermarking technology and malware concealment.

Hiding Information in “Invisible Places”

Steganography, the practice of embedding information within plain text, has been studied for centuries. The author of the article has repeatedly tackled this subject, experimenting with various methods such as repurposing the nanosecond field in ext4 timestamps, modifying Bluetooth mouse firmware, altering household appliances, and tweaking Exif metadata.

These conventional methods often involve directly writing data into existing metadata fields or embedding it as noise into an image. However, the article focuses on a unique approach—manipulating only the “sequence of appearance” of metadata without altering the metadata itself.

The 289-bit Potential of Exif Tag Permutations

Exif is a metadata standard accompanying image files, storing information like camera model, shooting date, aperture value, and ISO sensitivity as tags. According to the specification, these tags should be encoded in ascending order of their values, although most image readers do not strictly enforce this order.

For instance, a photo taken with a Sony A7R camera contains 63 Exif tags. The total number of possible permutations for 63 elements is 63! (factorial), equivalent to log2(63!) bits, which amounts to approximately 289 bits of information—greater than the AES-256 key length.

In practice, however, issues such as warnings from Exif readers about order discrepancies and constraints on tag groups can arise. Despite these practical challenges, the insight that significant information can be embedded by simply rearranging existing data introduces a new dimension to steganography.

Permutation Encoding Using Lehmer Code

The article adopts Lehmer code as a method to convert permutations into information. Here’s how it works: for a unique sequence of elements, count the number of elements smaller than the current element that appear after it in the sequence.

For example, the Lehmer digits of (A, B, C, D) are (0, 0, 0, 0), whereas for (D, C, A, B), they are (3, 2, 0, 0). Since the maximum value for each position decreases by one as the sequence progresses, the number of bits required for encoding is naturally limited.

For a sequence of 13 elements, the resulting Lehmer digits are sufficient to encode a 32-bit number. The advantage of this method lies in its versatility; as long as the unique sequence can be reconstructed, it is possible to extract the encoded bitstream.

Embedding Data in CSS Stylesheets

An intriguing application highlighted in the article involves embedding information in CSS. While browsers typically ignore the order of non-conflicting CSS rules during rendering, clear order exists within the file itself, which can be retrieved via the DOM.

Taking Wikipedia’s stylesheet as an example, it contains 1,003 rules, 1,950 selectors, and 2,731 properties. Rearranging the order of these rules alone allows for embedding over 1 kilobyte of data. Including selector and property order expands the storage capacity further.

With 1 kilobyte of embedded data, it is theoretically possible to conceal malware by combining it with a minimal decoder. The article even demonstrates this concept with a sample CSS block containing embedded information that reads “Click Me.”

Applications in File Archives and Watermarking

Lehmer code-based information hiding can be naturally applied to file watermarking technology. Even identical tarball or ZIP files can be embedded with subtle watermarks by deliberately altering the order of directories, making it difficult to detect upon extraction.

What’s particularly fascinating is the potential for these watermarks to persist in file systems. For example, by controlling the order of ext4 birth timestamps (creation times), the watermark could endure even on the file system where the data is deployed.

The article also discusses how this technique could apply to browser behavior when printing SVG or HTML files. Invisible traces of data left in unintended places could have significant implications, particularly in the field of forensic analysis.

Editorial Opinion

In the short term, this technique is likely to draw attention from security researchers and forensic experts. The manipulation of CSS rule order for information hiding may raise alarms among browser vendors and CDN providers as a novel vector for embedding malware in website stylesheets. However, practical deployment of such attacks faces challenges, such as the need for separate distribution of decoders.

From a long-term perspective, widespread awareness of this method could influence the future specification of file formats. The current “implementation tolerance” of order flexibility might shift toward stricter limitations for security reasons. Conversely, this technique could foster the development of legitimate ecosystems for data tampering detection and watermarking technologies.

The editorial team believes that the concept of “secondary channels of order” presented in this method could catalyze research into data-hiding channels within IoT and distributed systems.

References

• Lobsters — Published on 2026-07-05