Is steganography software, specifically OpenStego, can be run portably from USB stick without any risks?

Question

Is steganography software, specifically OpenStego, can be run portably from USB stick with no problem?

I have managed to run OpenStego from a USB stick, but I'm not sure what is the risk?

Are there data saved in the host pc or left behind on the host pc when I'm done?

Answer 1

The risk with this is that the program may modify the registry on the system it is being run on, or that it may leave a file somewhere on the system. An example of this behavior can be seen with Putty, which generally leaves around a config file of some kind with settings related to connections made with it.

From what I've been able to tell in my (BRIEF) look through some of the source code, I couldn't see anything that this would be doing to the outside system. Caveats with that:

1. I am not a java coder
2. A brief look is not at all the same thing as a thorough audit

In lieu of a thorough audit, it's quite hard to say whether or not this particular code leaves anything around. On top of that, any logging that occurs on the system you're using it on (keyloggers wouldn't be so nice, now would they?) is another chaotic factor to add into the mix.

While the particular case of an effective keylogger is hard to beat, most other leaks can be contained through using a method of containment, such as docker. The biggest issue with docker, however, is that docker itself would need to be installed on the host system as well. Unfortunately, in the Windows world, there just isn't a universal tool such as chroot to force an application only to use a specific area on a filesystem (and indeed, even the port for chroot to Windows comes with a lot of caveats due to the way various aspects of Windows work).

You would at least be wise to check out Packaging Portable Apps to look at how other applications are commonly made portable on Windows. While not foolproof, it will give you a better idea of how to go about running OpenStego in a portable manner, so that the registry is untouched and configuration files are kept on the USB stick rather than the host system. Generally, just pulling an application (especially a whole folder required to make an application run) is not the same as it being made portable, and there are quite a number of places it may be leaving files (to store things such as settings, or possibly logs), and it may also modify the registry. Given that OpenStego is Java, the registry seems less likely to be an issue, but outside of a full audit of the source code, there's not really a good way to be 100% positive. You could, of course, try contacting the original developer, but given that it's free software, he's of course under no obligation to respond.

If you're really paranoid about whether or not something is being left around, you're best advised to put together a Linux LiveUSB stick (or perhaps a Windows install with BartPE) with OpenStego installed on it, so that the host operating system doesn't even enter the equation, leaving your only potential security threats being restricted to malicious hardware (such as hardware keyloggers).