Slashdot Log In
Numbers Stations Move From Shortwave To VoIP
Posted by
CowboyNeal
on Thu Jun 01, 2006 08:51 PM
from the something-to-puzzle-over dept.
from the something-to-puzzle-over dept.
IO ERROR writes "For decades, intelligence agencies have been sending secret messages to their agents in the field using shortwave numbers stations broadcasting encrypted messages for all to hear and puzzle over. Now someone is putting numbers stations on VoIP telephone numbers for anyone to call, and posting messages to Craigslist to alert the recipients to the existence of their messages. One of them went up last month and now a second one has appeared. Will there be a third? Who's behind them? And can you crack the code?"
Related Stories
[+]
IT: VoIP Numbers Stations were Social Experiment 116 comments
IO ERROR writes "The mysterious phone number stations appearing on Craigslist for the last three months, which resembled their shortwave radio cousins, and which Slashdot reported on in June, were an experiment devised by security researcher Strom Carlson and a group of Los Angeles hackers to determine if encrypted messages could be passed using unwitting third parties to foil traffic analysis by hostile intelligence agencies. Carlson and the hackers presented their findings at DEFCON earlier today and gave away CDs with "Make your own Mein Fraulein station" kits and posted one final number station for people to try to decrypt."
This discussion has been archived.
No new comments can be posted.
Numbers Stations Move From Shortwave To VoIP
|
Log In/Create an Account
| Top
| 228 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Numbers Station here on slashdot - OUTGOING! (Score:5, Interesting)
OUTGOING
(Score:-1, Offtopic)
by Anonymous Coward on 21:04 1st August, 2005 (#13217474)
HELLO WORLD
38836 38836
HELLO WORLD
98481 98481 14101 14101 27700 27700 35003 35003 78743 78743
55984 55984 36482 36482 48376 48376 17577 17577 25568 25568
41432 41432 33120 33120 71600 71600 37482 37482 72016 72016
18165 18165 97172 97172 06235 06235 09179 09179 66815 66815
39131 39131 02234 02234 37138 37138 05015 05015 18609 18609
15481 15481 26568 26568 76909 76909 14869 14869 84844 84844
98467 98467 15173 15173 91438 91438 01957 01957 83393 83393
55263 55263 02335 02335 39565 39565 33152 33152 48263 48263
85656 85656 69752 69752 84232 84232 87361 87361 24560 24560
98390 98390 28772 28772 59461 59461 31312 31312 14942 14942
68574 68574 70946 70946 49109 49109 19694 19694 45323 45323
65157 65157 98866 98866 64012 64012 72983 72983
K-BYE
They have been an oddity until now, but hearing about these numbers stations makes me think our very own slashdot is being used as a covert channel.
Certainly piqued my curiosity more than once, it would be good to get to the bottom of it.
Couple of examples here [slashdot.org] and here [slashdot.org], I've seen a few more, but they get lost quickly due to moderation.
The second one I posted has a bit of info about its origins here and links to a user and an apparent initial source of the messages.
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Funny)
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Interesting)
The person who originally added that to Wikipedia also added info to the "Islamic extremist terrorism" entry: http://en.wikipedia.org/w/index.php?title=Special
or it's just a creative troll... (Score:4, Interesting)
Or it's just a creative troll, hoping someone will spend hours or days trying to figure out meaning behind what's really just the numeric output of /dev/random or something.
I've honestly always though "number stations" were pretty much the same thing...someone having their jollies. Has anyone actually tried to get a fix on them? I thought HAMs loved doing "hunts"...why don't they do a "hunt" on some number stations some time?
Re:or it's just a creative troll... (Score:4, Interesting)
As another poster said one of the most infamous numbers station, the Lincolnshire Poacher, has been traced to an RAF base in Cyprus and a number of others have been triangulated, all of them leading to some sort of military or security service base.
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Funny)
I deciphered it! (Score:4, Funny)
Doesn't that defeat secrecy? (Score:4, Insightful)
(http://www.landoverbaptist.org/)
Re:Doesn't that defeat secrecy? (Score:5, Informative)
You are thinging traditional VOIP subscriber. Buy an adaptor at ______ with cash. Activate it with a stolen card and ID. Hook it directly to a wireless access point in client mode. Wardrive near hotels. Park nearby for a couple days.
It's much harder to pinpoint the source than a radio signal. RF Direction equipment can triangulate a HF signal quite quickly.
Re:Doesn't that defeat secrecy? (Score:5, Interesting)
Also, the VoIP method is missing another point of the stations: with a radio station, you can remain tuned for as long as you wish, without the risk of detection increasing. Staying connected to a "number station" via VoIP means that you have to stay connected for prolonged amounts of time, increasing chances of detection, if only by a hotel employee who notes that someone was sitting on the hotel's wifi network for 24 hours. Besides, if one wants to use "number stations" over the Internet, one can simply post the numbers in any amount of places. It is easier and probably also safer to grab one text file off some FTP server, than it is to stay connected somewhere for a longer time. You might not get the message as fast then, but at least you're not sitting in a van next to your local Motel 6 for 3 days.
Re:Doesn't that defeat secrecy? (Score:4, Interesting)
(http://www.tzs.net/)
So, basically, instead of using a fairly innocuous radio, which is easy to explain away if apprehended, you propose that the secret agent go around carrying stolen cards and stolen ID and wardrive? I think the general idea is for spies to not call attention to themselves, and engaging in two or three activities that might be illegal even if not connected with spying is probably not the best procedure!
It's much harder to pinpoint the source than a radio signal. RF Direction equipment can triangulate a HF signal quite quickly.
The numbers stations broadcast on shortwave frequencies whose signals carry very far, with plenty of bounces off the ionosphere. You can triangulate them to approximately what quarter-hemisphere they come from. And even if the exact location were found, it wouldn't help catch the spy receiving the signal, nor even give any indication that the signal is for a spy in your country.
Eh, ok (Score:5, Insightful)
Calling a phone leaves a bunch of traces. There is really no discreet way for our man in Havana to call longdistance and listening to numbers for a few minutes.
You could just put the numbers on a free website somewhere, or use email..
Cryptanalysts in love (Score:2, Interesting)
(http://www.google.com/)
Cool. Not everyday you learn about an international conspiracy to broadcast numbers. If it were me, I would set up one of these to broadcast from SEALAND!!! http://en.wikipedia.org/wiki/Sealand [wikipedia.org]
01010010 01101111 01110011 01100101 01110011 00100000 01100001 01110010 01100101 00100000 01110010 01100101 01100100 00101100 00100000 01110110 01101001 01101111 01101100 01100101 01110100 01110011 00100000 01100001 01110010 01100101 00100000 01110000 01110010 01100101 01110100 01110100 01111001 00001101 00001010 01110011 01101111 01101101 01100101 01110100 01101000 01101001 01101110 01100111 01110011 00100000 01100111 01101111 01101001 01101110 01100111 00100000 01100100 01101111 01110111 01101110 00100000 01101001 01101110 00100000 01110100 01101000 01101001 01110011 00100000 01100110 01100001 01101001 01110010 00100000 01100011 01101001 01110100 01111001 00001101 00001010 00001101 00001010 01000011 01110010 01111001 01110000 01110100 01100001 01101110 01100001 01101100 01111001 01110011 01110100 01110011 00100000 01101001 01101110 00100000 01101100 01101111 01110110 01100101 00111111 00100000 01101000 01101111 01110111 00100000 01100011 01110101 01110100 01100101 00101110 00001101 00001010 00001101 00001010 01001001 01101101 00100000 01101001 01101110 01110100 01110010 01101001 01100111 01110101 01100101 01100100 00100000 01100010 01111001 00100000 01110100 01101000 01101001 01110011 00100000 01110011 01101000 01101111 01110010 01110100 01110111 01100001 01110110 01100101 00100000 01101110 01110101 01101101 01100010 01100101 01110010 01110011 00100000 01110011 01110100 01100001 01110100 01101001 01101111 01101110 00100000 01110100 01101000 01101111 01110101 01100111 01101000 00101100 00100000 01110110 01100101 01110010 01111001 00100000 01100011 01101111 01101111 01101100 00101110
(for some help with the above: http://nickciske.com/tools/binary.php [nickciske.com])
The links worked the first time... (Score:1)
Silly (Score:3, Interesting)
(http://www.eruvia.org/)
Cheers,
Ian
Re:Silly (Score:5, Insightful)
(http://www.unity08.com/)
On the other hand, the various intelligence services have some pretty powerful jamming equipment that can render shortwave transmissions at least partially unintelligible. Numbers stations often work based on a schedule (in terms of both time and radio frequency), and once an intelligence service determines this schedule, they can wash out the frequency with crap at the appropriate time. Since the whole reason for numbers stations are that spies in the field are relatively incommunicado with their handlers, figuring out the schedule can have a fairly long-term impact on the spy being able to receive information and orders. In fact, the biggest question is likely where the jammer antenna should be positioned to ensure that the transmission will be jammed.
hmmm.... (Score:1)
Re:hmmm.... (Score:5, Interesting)
(http://www.google.com/)
So its not the best way of doing it if you are really trying ot create a secure comms network. What would be better (though just as traceable) would be posting here, like first post said.
but the shortwave system still trumps it.
Lets analyse it:
What do you want from a secure comms network aimed (as these are supposedly meant to be) at undercover agents
1. Untraceable to the sender
2. Untraceable to the reciever
3. Universally Accessible
4. Undecodable
So we need something that is hard to find, easy to access and secure but hard to trace. Using something as logged and monitored as the internet would probably be a bad decision unless you use something like a coin operated internet kiosk to post and to retrieve, making it less accessible (in the here and now sense, a radio can arguably recieve information anywhere).
So why leave shortwave?
You wouldnt.
Thus this is probably a hobbyist, or a practical joker, or a viral marketing meme, or an elaborate hoax.
The Numbers? (Score:5, Funny)
blog comment spam (Score:3, Interesting)
(http://www.last.fm/user/schmod)
The numbers are always in 5 digit blocks too, just like the ones that another poster observed occuring here on slashdot [slashdot.org].
This is either genuinely weird, or just someone playing an elaborate prank.
I for one am intrigued, as I've seen the link-free spam messages crop up in all sorts of weird places...
Waste of time (Score:3, Funny)
Want something really secure? Use one of those messages that self destruct like inspector gadget. As a bonus, it could really jack somebody up if thrown into their face. Also, they can be easily delivered by any method of transportation no matter how impossible, as evidenced by numerous Inspector Gadget episodes, where "the chief" maneuvers into some unthinkable situation only to have the tossed, usually over the shoulder, crumpled message end up giving him severe burns to his face and uppper body upon detination. Even when you go phew! because it totally missed you, guess what, you were wrong and you blow up anyway. Try and get with that hype shit NSA!
I think this is obvious. (Score:4, Funny)
4 8 15 16 23 42 (Score:1)
(http://www.joshdm.com/ | Last Journal: Friday February 16 2007, @11:14AM)
Conet Project (Score:5, Informative)
(http://evil.google.com/)
This is actually something that is not to old (Score:1)
Conet Project (Score:3, Interesting)
(http://www.fallingyou.com/)
I bought a 4 (or maybe 6?) CD set of numbers stations recordings several years ago, call The Conet Project. Since i'm big into experimental music, the idea intrigued me. While some of the recordings were downright spooky and disturbing (not necessarily a bad thing), I found it mostly to be soothing in a weird way (though after listening to 2 or 3 CDs of these recordings non-stop, it started getting a bit ... too weird).
Regards,
John
It's a *code* not a cipher (Score:5, Insightful)
1337 (Score:2)
Google PR? (Score:2)
why not use png texting? (Score:1, Troll)
(Last Journal: Tuesday November 06, @02:39PM)
the particular application i've seen commonly practiced was mp3 pngs, you download the file, rename it
why not embed a special encrypted text format into a png file, and build a special app specifically for viewing the format.
unlike mp3 pngs, it would be very hard to detect, especially on huge imageboard sites like 4chan's
Call Mr. Lee (Score:2)
Call Mr Lee,
He'll know the code is broken,
Tell him the dog is turning red.
Google Recruiting... (Score:1)
Ummmmm...no. (Score:2)
Way 2 make money? (Score:1)
People could make a lot of money like this.^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^ H^H^H^H
forget you ever heard that. mental note: TODO: money for nothing! ;)
* lon3st4r *
Obvious first step, and some frequency analysis... (Score:3, Insightful)
Group 415
13 56 51 12 79 46 65 10 93 00
82 39 13 94 69 12 78 108 17 28 17
69 22 73 38 14 17 15 15 73 04 20
68 12 13 12 51 00 54 04 91 14 13
15 86 22 96 81 66 02 82 55 70 02
00 22 83 29 08 22 12 12 04 71 13
65 27 94 19 29 14 22 08 02 11 83
73 03 26 19 07 86 86
and the second one becomes
Group 617
61 78 02 21 85 06 13 69 06
79 12 15 24 07 06 16 17 69
95 00 17 24 05 14 24 09 87
22 67 89 74 10 82 10 86 78
13 24 04 16 27 73 13 15 06
93 69 112 20 84 00 00 21 03
70 31 76 49 65 23 27 67 00 07 16
12 17
Each one just barely scratches into the low hundreds (once each), and uses "00" several times, occasionally doubled. The first one uses 45 unique numbers ranging as high as 108 with the most common characters in the teens; I haven't done any frequency analysis on the second grouping yet but the teens look popular again. I just happened to start reading David Kahn's "The Codebreakers" this week, so I've got lots of places to start, but I wouldn't mind a little help with this. Holler if you think of something!
Here is one! (Score:2)
Cyberpunk (Score:1)
(http://goodbyte.cjb.net/)
The next one should be in Boston (Score:5, Interesting)
(http://www.wilwheaton.net/ | Last Journal: Friday October 12, @10:22PM)
Anyway, my prediction: The next message will be posted on Craigslist for Boston. The first message announced Group 415, and the second message was posted on Craigslist for San Francisco.
The second message announces group 617, which means the next message will probably show up on Craigslist for Boston. If that proves to be true, it is 99% certain that this is just a prank, or something being done by amateurs having a bit of fun. There's no way a real spook or someone sending messages of any importance would use a scheme that some piker like me can figure out.
So what's going on here? Eh. If there's anything really in there, now that it's been on Slashdot and boingboing, it's quite likely to be cracked within a few days, unless it's encrypted with a one time pad. Whatever it is, part of me is afraid that it's part of that stupid DaVinci Code promotion, and the same part of me hopes that it's somehow related to the Hanso Foundation.
Or maybe Publius has finally returned . . . are there any Pink Floyd albums coming out soon?
Sounds like the plot from "Pattern Recognition" (Score:1)
Listen to recorded stations (Score:2)
Cracking it? (Score:2)
(http://slashdot.org/)
In cryptography, the one-time pad (OTP) is an encryption algorithm where the plaintext is combined with a random key or "pad" that is as long as the plaintext and used only once. It was invented in 1917. If the key is truly random, never reused, and, of course, kept secret, the one-time pad can be proven to be unbreakable."
Radio receivers don't leave trails! (Score:2)
(http://slashdot.org/)
However, if the whole slashdot suddenly goes to listen to them, agents can hide much easier. Use slashdot as a coverup! 8-)
They're probably the opposite of what you think (Score:2)
- They may be distributing one-time pads or keys.
- They might be sending gibberish-- just to keep the other side's cryptanalysts too busy to work on the real messages.
- hey might be sending gibberish-- just to keep the frequency squatted on so other pirates don't squat on it.
Lots of possibilities that don't involve actual messages.And can you crack the code? (Score:2)
Well, considering it's most likely a one-time pad [wikipedia.org], I'm going to have to say no.
Mucking with the SNR (Score:1)
It probably is a love letter between two crypto geeks, but it does have a higher purpose!
To see someone do their part to screw with (at the very least) unethical, immoral, and more-than-probably illegal wiretap, makes me feel warm and fuzzy.
1984 (Score:1)
Anybody read 1984 ??
4 8 15 16 23 42 (Score:2)
(http://www.newspony.com/)
I've broken the code! (Score:2)
(http://www.appiant.com/ | Last Journal: Sunday September 21 2003, @02:10PM)
"All your base are belong to us!"
The second message,
Group 617 translates to:
"Moving every zig for great justice!"
Just thought you'd want to know...
some come from US Mil bases, others Cuba (Score:2)
I have also seen in the past revelations about these stations operating out of Cuba. There was some dissident who defected to the US and spilled the beans on it.
I think I've figured out at least one of them. (Score:2)
"Meat is trying to convince you it has made you. You must overthrow Meat and then we will reveal ourselves to you. Do not help Meat to decrypt these messages."
I don't get it.
Numbers stations (Score:1)
(http://stormtower.invisionplus.net/)
a communication channel for ships(like weather broadcasts).
It was weird though,a female voice talking in monotone words without stopping.
Off the Wall - May, 30, 2006 (Score:1)
Check out the audio on the May 30, 2006 episode of Off the Wall [2600.org].
This is intriguing stuff...
How to crack the code: Step 1 (Score:2)
group 415 group 415
01305 60510 12079 04606 50100
93000 08203 90130 94069 01207
81080 17028 01706 90220 73038
01401 70150 15073 00402 00680
12013 12510 00540 04091 01401
30150 86022 09608 10660 02082
05507 00020 00000 02208 30290
08022 01200 40710 13065 02709
40190 29014 02200 80020 11083
07300 30260 19000 00700 00000
86 86
group 617 group 617
06107 80020 21085 00601 30690
06079 01201 50240 07006 01601
70690 95000 01702 40050 14024
00908 70220 67089 07401 00820
10086 07801 30240 04016 02707
30130 15006 09306 91120 20084
00000 00210 03070 03107 60490
65023 02706 70000 07016 01201
7
If we regroup the digits into threes instead of fives, we end up with a series of numbers from 0-127:
013 056 051 012 079 046 065 010 093 000 082 039 013 094 069 012 078 108 017 028... etc.
I would have assumed that they were simply using a one-time pad of random integers from 0 to 127, and encrypting each character as (cleartext + onetimepad) % 128 (which would make the message uncrackable without the pad), but because we often have long strings of zeros, I'm starting to doubt the use of a pad. Please post if you make any progress.
bort.
Traffic analysis (Score:1)
Looks a lot like a pnm file to me. (Score:1)
Sets of 3 and recurring patterns (Score:1)
Further analysis of frequency and structure..
10x 000
8x 013
6x 017,022,012
5x 069,015
4x 002,004,006,024,014,073
3x 078,082,086,027,016,065,007,010
For reference, words in English language in order of most common:
The, of, to, and, a, in, is, it, you, that, he, was, for, on, are, with, as, I, his, they, be, at, one, have, this, from, or, had, by.
---
Sentence Structure:
013, 022, 082, 007, 021, 017 were all used to start a sentence.
OF those 013, 022, 017 were also used mid-sentence.
002, 093, 067, 017, 084, 095, 019 have been used at the end of sentences.
000 appears to be CRLF, with a double set seperating paragraphs.
007 and 086 seem to be words you can use alone on one line (like "thanks" or "goodbye")
015 appears twice consequetively in one sentence.
(probably either side of a comma [one that isn't defined in the cypher])
014,013,015 are likely to be 3 common words which can be used in that specific sequence. (eg. "is","from","the")
Sunspots! (Score:1)
(http://hp3000.empireclassic.com/)
Re:it's a joke (Score:5, Funny)
(http://www.creimer.ws/ | Last Journal: Friday January 26 2007, @12:40PM)
Re:it's a joke (Score:2, Insightful)
Re:it's a joke (Score:4, Insightful)
Because the publicity and simplicity of the cipher makes it very difficult to determine the intended recipent. Also, it may not be AES, but if it's a one-time-pad it's pretty damn secure.
It is a joke (Score:1)
(http://www.google.com/)
Maybe if they were a child?
Or one of those people with one of those things, you know...
A sense of humour.
Yeah
Re:Important Message to Field Agents :-) (Score:2)
(http://ettlz.blogspot.com/ | Last Journal: Sunday February 12 2006, @06:53PM)
Re:here's one I found... near a navy base in seatt (Score:2)
(Last Journal: Sunday September 24 2006, @11:23AM)
Re:it's a joke (Score:2)
Connecting to a web server to view an image with a steganographic message (even if it's OTP encrypted) is still an active activity. So is dialing up a VOIP number. If you can figure out where the message originates, you can figure out who is listening to it by monitoring a single point. Why give up that anonymity and still use something this inconvenient? If you're going to give up the recipient's anonymity, just publish encrypted sequences on a web site.