Poor coverage and no plausible deniability (Score 1)

This is OK as an academic exercise or to demonstrate the basics of steganography, but as has already been partly covered by others, this fails to be a practical or useful example of steganography for several reasons:

Firstly, as has already been addressed, the changes are detectable. This is very important for plausible deniability which legally speaking means the ability to deny there is anything stored within the "media" (in this case the executable). In the UK you are required to provide encryption keys or anything else required to "decode" data for a court of law. So if it's absolute security you want, you won't get it in the UK!

Secondly, the coverage at 1/110 is extremely poor. A much more traditional form of steganography is to hide information in graphical images by playing around with the least significant bit and changing the palette. This can typically achieve a coverage of as much as 1 in 8 which whilst better is still painfully low for serious use. This is often mentioned in the urban myths about 9/11 and AQ supposedly hiding messages in images. Another common usage is in .wav files as the human ear is unable to detect changes to the lower frequencies.

Coverage and plausible deniability are both very important for field operatives (or secret agents if you prefer). Firstly, 1/110 means they would need to start shipping megs if not gigs of executables across networks to pass on the simplest of messages, and trying to hide or transport secret documents becomes impossible. Secondly, the plausible deniability extends far beyond the realms of the UK justice system to the realities of field work - when they're strung up by bits they shouldn't be strung up by, they can hardly plead ignorance to avoid revealing their hidden secrets if their captors already know the data is there. The whole point of steganography is that it's indetectable! Agent X would not be a happy bunny!

Now I'm not saying this example or image/.wav files aren't fun or interesting because they are. But there are far more serious uses for, and much better applications of this technology. One example would be:

http://www.stegostik.com/

...which provides 99.9% coverage and absolute plausible deniability. Now that's how you keep your data safe and secure!

-Mark.