Numbers Stations Move From Shortwave To VoIP 228
IO ERROR writes "For decades, intelligence agencies have been sending secret messages to their agents in the field using shortwave numbers stations broadcasting encrypted messages for all to hear and puzzle over. Now someone is putting numbers stations on VoIP telephone numbers for anyone to call, and posting messages to Craigslist to alert the recipients to the existence of their messages. One of them went up last month and now a second one has appeared. Will there be a third? Who's behind them? And can you crack the code?"
Numbers Station here on slashdot - OUTGOING! (Score:5, Interesting)
OUTGOING
(Score:-1, Offtopic)
by Anonymous Coward on 21:04 1st August, 2005 (#13217474)
HELLO WORLD
38836 38836
HELLO WORLD
98481 98481 14101 14101 27700 27700 35003 35003 78743 78743
55984 55984 36482 36482 48376 48376 17577 17577 25568 25568
41432 41432 33120 33120 71600 71600 37482 37482 72016 72016
18165 18165 97172 97172 06235 06235 09179 09179 66815 66815
39131 39131 02234 02234 37138 37138 05015 05015 18609 18609
15481 15481 26568 26568 76909 76909 14869 14869 84844 84844
98467 98467 15173 15173 91438 91438 01957 01957 83393 83393
55263 55263 02335 02335 39565 39565 33152 33152 48263 48263
85656 85656 69752 69752 84232 84232 87361 87361 24560 24560
98390 98390 28772 28772 59461 59461 31312 31312 14942 14942
68574 68574 70946 70946 49109 49109 19694 19694 45323 45323
65157 65157 98866 98866 64012 64012 72983 72983
K-BYE
They have been an oddity until now, but hearing about these numbers stations makes me think our very own slashdot is being used as a covert channel.
Certainly piqued my curiosity more than once, it would be good to get to the bottom of it.
Couple of examples here [slashdot.org] and here [slashdot.org], I've seen a few more, but they get lost quickly due to moderation.
The second one I posted has a bit of info about its origins here and links to a user and an apparent initial source of the messages.
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Funny)
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
I seriously doubt it.
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Interesting)
The person who originally added that to Wikipedia also added info to the "Islamic extremist terrorism" entry: http://en.wikipedia.org/w/index.php?title=Special
or it's just a creative troll... (Score:4, Interesting)
Or it's just a creative troll, hoping someone will spend hours or days trying to figure out meaning behind what's really just the numeric output of /dev/random or something.
I've honestly always though "number stations" were pretty much the same thing...someone having their jollies. Has anyone actually tried to get a fix on them? I thought HAMs loved doing "hunts"...why don't they do a "hunt" on some number stations some time?
Re:or it's just a creative troll... (Score:3, Informative)
I also thought someone used radio direction finding to follow one of the CIA stations to, well, the CIA.
Re:or it's just a creative troll... (Score:4, Interesting)
As another poster said one of the most infamous numbers station, the Lincolnshire Poacher, has been traced to an RAF base in Cyprus and a number of others have been triangulated, all of them leading to some sort of military or security service base.
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
Re:Numbers Station here on slashdot - OUTGOING! (Score:3, Informative)
Its not clear text if you put up an ascii-formatted encoded message.
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
Re:Numbers Station here on slashdot - OUTGOING! (Score:3, Interesting)
There's something fishy about these messages.
Have you noticed that every group is sent twice? That would make a lot of sense if you were transmitting over the radio, because a group might arrive garbled. Posting each group twice on slashdot, however, makes no sense. The message will arrive correctly every time.
Re:Numbers Station here on slashdot - OUTGOING! (Score:5, Funny)
Re:Numbers Station here on slashdot - OUTGOING! (Score:3, Funny)
Maybe they forgot to turn off the "local echo".
Re:Numbers Station here on slashdot - OUTGOING! (Score:2)
Not very
Re:Numbers Station here on slashdot - OUTGOING! (Score:3, Funny)
--
Q
This is fun! (Score:3, Interesting)
Could never happen (Score:2)
cnQgbWVzc2FnZXMgaXMganVzdCBzaWxseS4gV2hvIHdvdWxkI
cXVlc3Rpb24gaXMgY291bGQgeW91IHVzZSBCQVNFNjQgdG8gZ
ZWVkIGFuZCB0aGVuIHBvc3QgdGhhdCBvbiBTbGFzaGRvdD8=
I deciphered it! (Score:4, Funny)
Re:I deciphered it! (Score:2)
And yes, I can't believe I actually have neurons somewhere that retain this useless information.
Re:I deciphered it! (Score:2)
--
Q
Doesn't that defeat secrecy? (Score:4, Insightful)
Re:Doesn't that defeat secrecy? (Score:5, Informative)
You are thinging traditional VOIP subscriber. Buy an adaptor at ______ with cash. Activate it with a stolen card and ID. Hook it directly to a wireless access point in client mode. Wardrive near hotels. Park nearby for a couple days.
It's much harder to pinpoint the source than a radio signal. RF Direction equipment can triangulate a HF signal quite quickly.
Re:Doesn't that defeat secrecy? (Score:5, Interesting)
Also, the VoIP method is missing another point of the stations: with a radio station, you can remain tuned for as long as you wish, without the risk of detection increasing. Staying connected to a "number station" via VoIP means that you have to stay connected for prolonged amounts of time, increasing chances of detection, if only by a hotel employee who notes that someone was sitting on the hotel's wifi network for 24 hours. Besides, if one wants to use "number stations" over the Internet, one can simply post the numbers in any amount of places. It is easier and probably also safer to grab one text file off some FTP server, than it is to stay connected somewhere for a longer time. You might not get the message as fast then, but at least you're not sitting in a van next to your local Motel 6 for 3 days.
Re:Doesn't that defeat secrecy? (Score:4, Interesting)
So, basically, instead of using a fairly innocuous radio, which is easy to explain away if apprehended, you propose that the secret agent go around carrying stolen cards and stolen ID and wardrive? I think the general idea is for spies to not call attention to themselves, and engaging in two or three activities that might be illegal even if not connected with spying is probably not the best procedure!
It's much harder to pinpoint the source than a radio signal. RF Direction equipment can triangulate a HF signal quite quickly.
The numbers stations broadcast on shortwave frequencies whose signals carry very far, with plenty of bounces off the ionosphere. You can triangulate them to approximately what quarter-hemisphere they come from. And even if the exact location were found, it wouldn't help catch the spy receiving the signal, nor even give any indication that the signal is for a spy in your country.
Re:Doesn't that defeat secrecy? (Score:2)
No need to pack around a laptop, voip equipment, etc. Just find a phone, dial in, and act like you're having a conversation while you write down the numbers.
Re:Doesn't that defeat secrecy? (Score:2)
You may be safe but the location of the transmitter will be known within a short distance in just a few seconds.
A new VOIP phone doesn't announce itself to the world like a new broadcast on shortwave. Fewer people would notice a posting of the number on a website and understand it than those interested in a new shortwave station transmitting numbers.
Re:Doesn't that defeat secrecy? (Score:2)
Re:Doesn't that defeat secrecy? (Score:3, Insightful)
Just put some PGP encrypted data into an image via Steganography and post it to someplace popular like...lets say...CuteOverload.com
Then if your recipient was tracked going there, he would just look like any other Cats In Racks fan looking for cute kittie pictures : )
Re:Doesn't that defeat secrecy? (Score:2)
There have been two such numbers found, both using the same catchy song (anybody know what that tune is? I like it). Thus, each number would have to be dialed by at least a few hundred people for the caller to really gain security through obscurity.
Eh, ok (Score:5, Insightful)
Calling a phone leaves a bunch of traces. There is really no discreet way for our man in Havana to call longdistance and listening to numbers for a few minutes.
You could just put the numbers on a free website somewhere, or use email..
Re:Eh, ok (Score:3, Interesting)
The other problem is that shortwave radio recievers are incriminating devices in some dark places that you would want to have spies in. Cell phones pretty much universally are not.
Re:Eh, ok (Score:2)
Re:Eh, ok (Score:3, Funny)
But they will be coming for your uncool niece.
Re:Eh, ok (Score:2)
Also, they're using *Craigslist* are the spies looking for Futons of Mass Destruction? Does Al Quaeda need 2 pet friendly roommates for summer sublet ASAP?
Not Havana, but New York? (Score:3, Interesting)
The first message was was listed in the the New York classifieds. Now it is possible the author simply placed it there for obscurity reasons, but it could also be that he/she was targetting someone who resides specifically in New York. Also, area code 212 is in New York City, which could be so their contact in New York wouldn't have to dial long distance to reach it.
The second message was in the San Francisco classifieds, and there too the area code, 415, of the number matches with the city. It could be t
Cryptanalysts in love (Score:2, Interesting)
Cool. Not everyday you learn about an international conspiracy to broadcast numbers. If it were me, I would set up one of these to broadcast from SEALAND!!! http://en.wikipedia.org/wiki/Sealand [wikipedia.org]
01010010 0
Silly (Score:3, Interesting)
Cheers,
Ian
Double Silly (Score:2)
If I were a spy, I'd lean more toward the use of stegonography so at least it isn't totally obvious that a code is being used. Might
Re:Silly (Score:5, Insightful)
On the other hand, the various intelligence services have some pretty powerful jamming equipment that can render shortwave transmissions at least partially unintelligible. Numbers stations often work based on a schedule (in terms of both time and radio frequency), and once an intelligence service determines this schedule, they can wash out the frequency with crap at the appropriate time. Since the whole reason for numbers stations are that spies in the field are relatively incommunicado with their handlers, figuring out the schedule can have a fairly long-term impact on the spy being able to receive information and orders. In fact, the biggest question is likely where the jammer antenna should be positioned to ensure that the transmission will be jammed.
Re:Silly (Score:2)
That's actually a really bad move, since then if the agent misses one transmission - e.g., through being sick or something - they can't resynchronize (not without contacting their handler, which is much more dangerous). What's worse, they might even start interpreting messages meant for other agents, resulting in completely crazy effects! Time/frequency hopping is just not robust enough.
The Numbers? (Score:5, Funny)
Re:The Numbers? (Score:2, Interesting)
Could it be that on Lost the radio broadcast is a play on the Number Stations stuff?
I am a bit behind on Lost because I live in Australia so I may be behind on the current theories.
blog comment spam (Score:3, Interesting)
The numbers are always in 5 digit blocks too, just like the ones that another poster observed occuring here on slashdot [slashdot.org].
This is either genuinely weird, or just someone playing an elaborate prank.
I for one am intrigued, as I've seen the link-free spam messages crop up in all sorts of weird places...
Re:blog comment spam (Score:3, Insightful)
Waste of time (Score:3, Funny)
Want something really secure? Use one of those messages that self destruct like inspector gadget. As a bonus, it could really jack somebody up if thrown into their face. Also, they can be easily delivered by any method of transportation no matter how impossible, as evidenced by numerous Inspector Gadget episodes, where "the chief" maneuvers into some unthinkable situation only to have the tossed, usually over the shoulder, crumpled message end up giving him severe burns to his face and uppper body upon detination. Even when you go phew! because it totally missed you, guess what, you were wrong and you blow up anyway. Try and get with that hype shit NSA!
I think this is obvious. (Score:4, Funny)
Re:I think this is obvious. (Score:3, Funny)
(the preceeding may have been sarcasm)
Conet Project (Score:5, Informative)
Re:Conet Project (Score:2)
Conet Project (Score:3, Interesting)
I bought a 4 (or maybe 6?) CD set of numbers stations recordings several years ago, call The Conet Project. Since i'm big into experimental music, the idea intrigued me. While some of the recordings were downright spooky and disturbing (not necessarily a bad thing), I found it mostly to be soothing in a weird way (though after listening to 2 or 3 CDs of these recordings non-stop, it started getting a bit ... too weird).
Regards,
John
Re:Conet Project (Score:2)
It's a *code* not a cipher (Score:5, Insightful)
Re:It's a *code* not a cipher (Score:2)
Re:It's a *code* not a cipher (Score:3, Insightful)
1337 (Score:2)
Google PR? (Score:2)
Re:Google PR? (Score:2)
Call Mr. Lee (Score:2)
Call Mr Lee,
He'll know the code is broken,
Tell him the dog is turning red.
Ummmmm...no. (Score:2)
Re:Ummmmm...no. (Score:2)
If the station is serious the RNG is probably physics-based, ie. truly random as far as we can tell.
Re:Ummmmm...no. (Score:2)
Important point that you said RNG and not PRNG. Because an OTP is not an OTP if the P was generated with an PRNG:
"Classically , a one-time pad is nothing more than a large nonrepeating set of truely random key letters, written on sheets of paper, and glued together in a pad", "The caveat, and this is a big one, is that the key letters have to be generated randomly. Any attacks against this scheme will be against the method used to generate the key l
Obvious first step, and some frequency analysis... (Score:3, Insightful)
Group 415
13 56 51 12 79 46 65 10 93 00
82 39 13 94 69 12 78 108 17 28 17
69 22 73 38 14 17 15 15 73 04 20
68 12 13 12 51 00 54 04 91 14 13
15 86 22 96 81 66 02 82 55 70 02
00 22 83 29 08 22 12 12 04 71 13
65 27 94 19 29 14 22 08 02 11 83
73 03 26 19 07 86 86
and the second one becomes
Group 617
61 78 02 21 85 06 13 69 06
79 12 15 24 07 06 16 17 69
95 00 17 24 05 14 24 09 87
22 67 89 74 10 82 10 86 78
13 24 04 16 27 73 13 15 06
93 69 112 20 84 00 00 21 03
70 31 76 49 65 23 27 67 00 07 16
12 17
Each one just barely scratches into the low hundreds (once each), and uses "00" several times, occasionally doubled. The first one uses 45 unique numbers ranging as high as 108 with the most common characters in the teens; I haven't done any frequency analysis on the second grouping yet but the teens look popular again. I just happened to start reading David Kahn's "The Codebreakers" this week, so I've got lots of places to start, but I wouldn't mind a little help with this. Holler if you think of something!
Here is one! (Score:2)
The next one should be in Boston (Score:5, Interesting)
Anyway, my prediction: The next message will be posted on Craigslist for Boston. The first message announced Group 415, and the second message was posted on Craigslist for San Francisco.
The second message announces group 617, which means the next message will probably show up on Craigslist for Boston. If that proves to be true, it is 99% certain that this is just a prank, or something being done by amateurs having a bit of fun. There's no way a real spook or someone sending messages of any importance would use a scheme that some piker like me can figure out.
So what's going on here? Eh. If there's anything really in there, now that it's been on Slashdot and boingboing, it's quite likely to be cracked within a few days, unless it's encrypted with a one time pad. Whatever it is, part of me is afraid that it's part of that stupid DaVinci Code promotion, and the same part of me hopes that it's somehow related to the Hanso Foundation.
Or maybe Publius has finally returned . . . are there any Pink Floyd albums coming out soon?
Re:The next one should be in Boston (Score:2)
But really, I've always thought any numbers station (other than CBS) would be running a one-time pad. (CBS obviously recycles plots, so otp doesn't seem likely.
Here's one in Boston. (Score:3, Informative)
Reply to: pers-167168282@craigslist.org
Date: 2006-06-02, 7:21AM EDT
Mein Fraulein,
I am anxious to speak with you.
Re:Here's one in Boston. (Score:2)
Re:Here's one in Boston. (Score:3, Informative)
"For directions to the Federal Reserve Bank in Boston on 600 Atlantic Ave, Press 1.
For directions to the Federal Reserve Office in Windosr Locks, on 317 Ellatrasso Turnpike, press 2"
Listen to recorded stations (Score:2)
Cracking it? (Score:2)
In cryptography, the one-time pad (OTP) is an encryption algorithm where the plaintext is combined with a random key or "pad" that is as long as the plaintext and used only once. It was invented in 1917. If the key is truly random, never reused, and, of course, kept secret, the one-time pad can be proven to be unbreakable."
Re:Cracking it? (Score:2)
Re:Cracking it? (Score:2)
Here you go (Score:2)
Re:Cracking it? (Score:2)
First, there are 45 unique 3-digit strings in the first message, 41 in the second, and 23 of those common between the two; that's an extremely small vocabulary. If it were a pad, one would expect to see a much greater representation of 3-digit numbers. As it is, none of the characters exceeds 112. Second, the frequenc
Radio receivers don't leave trails! (Score:2)
Re:Radio receivers don't leave trails! (Score:2)
Not quite true, a receiver must be tuned (and therefore have an oscillator resonating at) the desired frequency. If you've got a highly-sensitive receiver, you can determine pretty accurately the frequency a given radio is tuned to. You can't really cover much of an area, but if someone wants to know what station you're tuned to, and they can get close to you (say within a hundred feet or so), then they can tell what yo
Re:Radio receivers don't leave trails! (Score:2)
They're probably the opposite of what you think (Score:2)
Re:They're probably the opposite of what you think (Score:2)
That would be odd, to say the least. Since:
And can you crack the code? (Score:2)
Well, considering it's most likely a one-time pad [wikipedia.org], I'm going to have to say no.
Re:And can you crack the code? (Score:2)
4 8 15 16 23 42 (Score:2)
I've broken the code! (Score:2)
"All your base are belong to us!"
The second message,
Group 617 translates to:
"Moving every zig for great justice!"
Just thought you'd want to know...
some come from US Mil bases, others Cuba (Score:2)
I have also seen in the past revelations about these stations operating out of Cuba. There was some dissident who defected to the US
I think I've figured out at least one of them. (Score:2)
"Meat is trying to convince you it has made you. You must overthrow Meat and then we will reveal ourselves to you. Do not help Meat to decrypt these messages."
I don't get it.
Re:it's a joke (Score:5, Funny)
Re: (Score:2)
Re:it's a joke (Score:2, Insightful)
Re:it's a joke (Score:4, Insightful)
Because the publicity and simplicity of the cipher makes it very difficult to determine the intended recipent. Also, it may not be AES, but if it's a one-time-pad it's pretty damn secure.
Re:it's a joke (Score:2)
A one time pad is not just "pretty damn secure," it's provably unbreakable (assuming, of course, that the pad is truly random and is never reused).
Re:hmmm.... (Score:5, Interesting)
So its not the best way of doing it if you are really trying ot create a secure comms network. What would be better (though just as traceable) would be posting here, like first post said.
but the shortwave system still trumps it.
Lets analyse it:
What do you want from a secure comms network aimed (as these are supposedly meant to be) at undercover agents
1. Untraceable to the sender
2. Untraceable to the reciever
3. Universally Accessible
4. Undecodable
So we need something that is hard to find, easy to access and secure but hard to trace. Using something as logged and monitored as the internet would probably be a bad decision unless you use something like a coin operated internet kiosk to post and to retrieve, making it less accessible (in the here and now sense, a radio can arguably recieve information anywhere).
So why leave shortwave?
You wouldnt.
Thus this is probably a hobbyist, or a practical joker, or a viral marketing meme, or an elaborate hoax.
Re:hmmm.... (Score:2)
You can still track down the source pretty easily, but there is no doubt a station in Nevada that transmits exactly 200 characters at the same time every day whether or not they need to send anything out, or something similar to this. Knowing where it is does you
Re:hmmm.... (Score:2)
You're partially right. To get the greatest distance, you'll want to use the lower frequencies (say 80 meters). The lower the frequency, the longer the antenna needs to be (to transmit efficiently). The center of the 80M band is ~3.75MHz, so you'd need an antenna that's (468 / 3.75 = 124.8) ~125 feet long. If you're talking a standard dipole (and we are), then each leg is going to be 62.5 feet long.
Clandestine Transmitter (Score:2)
Dropping a few roubles in a net cafe, while posting to a commonly used side seems quite reasonable. The host government would need to do some fairly serious analysis to spot that kind of stuff. If the agent rarely uses the same connection or site, then it'd be virtually impossible to stop them.
Perhaps they even use a PDA with a wifi card that uses any unsecure
Re:Clandestine Transmitter (Score:2)
Re:hmmm.... (Score:2)
Yes. The first thing I thought when I saw "Group 617", was OTP. It could easily have been "Block 617" as a reference to noise stored in a block device.
The fact that VoIP is being used, allows a side channel in the noise which goes along with a VoIP call. Noise from the microphone which gets encoded into the signal being sent to the other end, could be replaced with OTP encrypted data.
The numbers scream "scrutin
Re:Important Message to Field Agents :-) (Score:2)
Re:here's one I found... near a navy base in seatt (Score:2)