How does the DQT (Define Quantization Table) marker provide an opportunity for hiding data in JPEG images?
The DQT marker (0xFF 0xDB) contains a quantization table that is 64 bytes of 8-bit or 16-bit values. Replacing these bytes with payload data can subtly distort the image, but minor changes may be imperceptible. As noted in the article, testing shows that altering only some bytes produces minimal visual differences. This method is analogous to LSB steganography in PNG files but leverages JPEG's quantization data. Tools like JPEGsnoop can flag abnormal DQT values, such as decimal 17 (0x11) in the example.
DQTquantization tableJPEG steganographyimage distortionJPEGsnoop