VoIP Numbers Stations were Social Experiment 116
IO ERROR writes "The mysterious phone number stations appearing on Craigslist for the last three months, which resembled their shortwave radio cousins, and which Slashdot reported on in June, were an experiment devised by security researcher Strom Carlson and a group of Los Angeles hackers to determine if encrypted messages could be passed using unwitting third parties to foil traffic analysis by hostile intelligence agencies. Carlson and the hackers presented their findings at DEFCON earlier today and gave away CDs with "Make your own Mein Fraulein station" kits and posted one final number station for people to try to decrypt."
Another matter (Score:4, Interesting)
Re:Another matter (Score:5, Interesting)
http://en.wikipedia.org/wiki/Cryptanalysis_of_the
And at one time, I was trained to transcribe 5-digit numbers from another language. That was a different time and place, though.
Interesting stuff.
One Time Pads (Score:4, Interesting)
Stenography Encryption (Score:5, Interesting)
Re:Stenography Encryption (Score:5, Interesting)
Re:One Time Pads (Score:2, Interesting)
Re:One Time Pads (Score:4, Interesting)
Re:One Time Pads (Score:5, Interesting)
1. Encrypt data with OTP.
2. Hide this encrypted data in some false information (stenography)
3. Encrypt the result with something that can be broken (but not too easily)
This way, even if they managed to extract the original data from the stenography, they would just get what looks like random junk. It would actually be quite hard to even realize what you have extracted was real (rather than an error)
Re:One Time Pads (Score:5, Interesting)
The data you hide the OTPed data in, does not have to be text. You could use an audio file (notch out a frequency on the edge of the sample range, and then use very small amplitudes to put the data in) or an image, or even a video. You could even put this data out on P2P (encrypted data in porn? who would bother to look?) and simply email an ED2K link or something to the intended recipient. Hmm, porn-link swapping; fairly benign behavior.
Re:What was the point again? (Score:5, Interesting)
It's like doing the same thing on a restroom stall. "For a good time, call 202-555-3988" will probably get passed over as graffiti, but a large block of cryptic-looking numbers looks unusual enough to attract attention.
Comment removed (Score:5, Interesting)
Re:Stenography Encryption (Score:5, Interesting)
If you're the only person on your block using encrypted email, and using it for all of your email, you're an obvious red flag for some form of side-channel attack (i.e. they just sneak into your house when you're away and bug your keyboard). So if you did want to use encrypted communications, not only would you have to hide said communications in other things, but you'd also have to maintain the regular volume of unencrypted traffic from your email accounts so as not to arouse suspicion.
Email use is a trivial example, but it extends to anything else that can be tracked. The exact same thing goes for purchasing patterns: if you're spending large wads of dough (in cash) buying things that the government doesn't want you to have (*cough*recreational drugs*cough*), then you had better make sure that the rest of your purchasing habits aren't affected, so that nobody can find out how much money you're diverting into your illicit hobbies, just by looking at the difference between your income and your creditcards+savings+retirement accounts.
I, too, see this as becoming a cat and mouse game; as the authorities become better and better about mining information, people are going to start to become more clever and more aware about not only limiting the information they give out, but about putting out patently false information in order to create a semblance of "Joe America" when in reality they could be the Shah of Iran.
Puzzles = High entropy (Score:5, Interesting)
I thought that was pretty neat; "puzzles within puzzles" and all that. When you think about places where you can hide messages though, there are lots of opportunities when you have puzzles, because people expect a certain amount of randomness there. In a newspaper, there aren't a whole lot of other places where you can just have a whole block of random letters and not arouse suspicion; if you find someplace where there is already expected to be high entropy, then you can sneak in your encoded material much more easily.
Sudoku puzzles and crosswords could also be good candidates, but there are even ways you could probably work them into more subtle things if you had a predetermined scheme for encoding the message. I'm sure you could probably work the chess puzzles if you knew what you were doing.
Re:What I want to know is... (Score:2, Interesting)
Re:Traffic Analysis (Score:4, Interesting)
Exchanging data in the way mentioned above is a way that an interested third party is unable to work out who's sending, and who is receiving the message - if lots of people can receive it then it becomes harder to tell out of those who can receive it, who is able to read it, or make anything of it
But you have to make sure that your receiving mode is exactly the same as Joe Average's. A Dutch extertionist once used a classified ads site (the biggest list of second hand cars in the Netherlands) to have his funds transferred to him, by having bank account details embedded in the picture of one of the cars (with steganography). Sounds perfect.
However, the guy accessed the page through an American anonymiser (surfola.com) instead of through a normal Dutch ISP (as all the other page viewers did). Dutch police contacted the FBI, FBI contacted surfola, surfola gave FBI the guy's CC details, Dutch police arrested the guy. Ten years jail sentence for being too paranoid.