December 2003 - cypherpunks-legacy

Stealth PGP and Stegonagraphy (LONG)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

Making Stealth PGP (random noise) Files "Undetectable" INITIAL PROBLEM: The following ideas were developed in response to the concern over the future legal implications of possessing encrypted files. If non-Clipper encryption becomes illegal, even the mere possession of possible non-Clipper-encrypted files may be grounds for a search warrant, confiscation of equipment, and miscellaneous court sanctions. PRACTICAL OBJECTIVE: The possession of encrypted files must be made virtually undetectable, even to the most determined and best informed opponent. BASIC PREMISE: On many machines the file system allows users to "delete" files without actually erasing them. This is usually accomplished by simply marking the disk blocks that make up the file as free. Thus it is possible to write an encrypted (noise) file on to disk, pad the rest of the disk with more noise and "delete" the whole thing, making the disk look blank to all casual observers. CHALLENGES: I - Miscellaneous disk writes, such as those performed routinely by DOS, can overwrite the "deleted" files. II - Certain security measures on the part of the user may make recovery of the hidden file non-trivial. Ideally, the file will not have an "End Of File" marker, a file name, nor an entry in the File Allocation Table. III - Upon examination of the deleted segment of a disk, the aware opponent will notice the discrepancy between a large, highly-random noise-segment and the "structured garbage" that will make up most of the rest of the deleted portion of the disk. PROPOSED SOLUTIONS: I - To ensure the integrity of the hidden data, all disk writes must be directly controlled by the user, not DOS. A - Use of a floppy disk is recommended; as, controlling each individual disk-write operation on a harddrive becomes infeasible due to the large amount of said operations. B - The user should specify and keep track of the exact address and length of the encrypted file when writing it to disk. The file's location/length should be guarded as dearly as one's secret key and corresponding password, for similar reasons. II - Keeping track of the exact address and length of the hidden file will allow easy file recovery, without need for an EOF marker, a file name, nor a FAT entry. III - In order to make one's file deleted file virtually indistinguishable from the rest of the deleted portion of the disk, the implementation of one of the following measures is recommended. A - Split the noise file into small individual files and scatter them throughout the "structured garbage" that is already on the disk. It should blend in with the other little pieces of highly random noise that are naturally interspersed in the deleted portion of the disk. Recovery would, of course, require one to keep track of the addresses, lengths, and order of the component files. B - Use a stegonagraphy utility to hide one's file in a segment of "structured garbage". A Mimic function with a "structured garbage" grammar would be highly usefull for this. DISCUSSION: All of the above speculation relies on the use of Stealth PGP, or a similar program that encrypts plaintext into a format indistinguishable from random noise. Unless this stegonagraphic function is implemented detection of the encrypted file, even when hidden among megabytes of other "deleted" files, will be trivial; as, PGP has a distinct header. The success of the above method also relies on the use of non-standard locations for the hidden files. For, if this method becomes popular, _and_ everyone starts hiding their files in the last few sectors of the disk, for example, a significant portion of the method's effectiveness may be compromised. It should be noted that as long as the user is writing directly to and reading directly from the disk (bypassing DOS), "deletion" of the file is no longer necessary. It is necessary to keep the blocks one writes to marked as "FREE", "BAD" or "DELETED" (take your pick!). Some modification of the FAT or equivalent may be required here. SUMMARY: In order to hide a Stealth PGP (or equivalent) encrypted "noise" file effectively one may follow the steps outlined below: 1 Embed it in "structured garbage" such as is present normally on the deleted portions of the disk. This can be accomplished by using a stegonagraphy program or by splitting the file into small segments and scattering them among "structured garbage". 2 Write the resulting "structured garbage"/noise combination directly to disk. This can be accomplished by using a normal disk-sector editor utility. 3 Keep track of the exact location and size of the file if you want to retrieve it later. Keep this information secure. 4 Modify the FAT (or equivalent) to mark the sectors you've written to as "FREE", "BAD", or "DELETED" (if necessary). In order to retrieve and reconstruct one's file simply reverse steps 2 and 1. THANKS: I wish I could thanks everyone who has commented on this thread individually. Unfortunately, I am rather new to this. Next time, I'll know to keep track of each response/address/name instead of simply replying to your mail/posts. You know who you are. Thank you! Keep you comments flowing! All feedback welcome, Sergey

1 0

Stealth PGP and Stegonagraphy (Summary)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

In order to hide a Stealth PGP (or equivalent) encrypted "noise" file effectively one may follow the steps outlined below: 1 Embed it in "structured garbage" such as is present normally on the deleted portions of the disk. This can be accomplished by using a stegonagraphy program or by splitting the file into small segments and scattering them among "structured garbage". 2 Write the resulting "structured garbage"/noise combination directly to disk. This can be accomplished by using a normal disk-sector editor utility. 3 Keep track of the exact location and size of the file if you want to retrieve it later. Keep this information secure. 4 Modify the FAT (or equivalent) to mark the sectors you've written to as "FREE", "BAD", or "DELETED" (if necessary). In order to retrieve and reconstruct one's file simply reverse steps 2 and 1. For a more detailed discussion of the above method, see the associated message, entitled "Stealth PGP and Stegonagraphy (LONG)". Sergey

1 0

Re: STEALTH OCEANS (fwd)
by Sergey Goldgaber 17 Dec '03

17 Dec '03

On Thu, 24 Feb 1994, Matt Thomlinson wrote: > > Sergey Goldgaber <sergey(a)delbruck.pharm.sunysb.edu> writes: > > >> might work, except for the fact that fragmentation _does_ go on, and when > >> you were to write files to the drive (heck, I do every time I start up > >> windows and write a huge temp swapfile) you're going to be playing > >> roulette with your data. > > >This problem is solved by simply using a utility that writes directly to the > >disk (exactly in the specified sectors, in the specified order), instead > >of letting DOS fragment your disk. > > > I've been talking to Sergey behind the scenes, and I think I understand > what our miscommunication was: he is proposing this type of technique > ONLY for removable-type media, e.g. floppies. I am proposing this as a practical solution that can be implemented effectively mainly on floppies. Hard-drives might have to be dedicated to stegonagraphy (As Matt points out below). > To store this type of data on your harddrive would be to dedicate your > harddrive to stego. This was my argument all along; what we failed to > connect on was the fact that only floppies are involved. With floppies, > every write *can* be controlled and the data would be relatively safe (and > obscure, for that matter). > So it seems. However, I am wary of the possibility that there are drawbacks to the scheme that I haven't even considered yet. I'm hoping that other astute readers such as yourself may be able to point them out; as, practical stegonagraphy may become a necessity in the near future. > > This correction is being posted to the list because his original post > said nothing about removable media. > My original post only outlined the basic premises. I had not, at that point, realized that floppy use would be a virtual necessity. > > mt > > Matt Thomlinson Say no to the Wiretap Chip! > University of Washington, Seattle, Washington. > Internet: phantom(a)u.washington.edu phone: (206) 548-9804 > PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu > > Thanks for your insights and neverfailing tenacity, Matt. Sergey

1 0

Re: CERT funding
by smb＠research.att.com 17 Dec '03

17 Dec '03

Thanks, Mark, for an interesting posting about CERT. Let me add just one or two comments about the place. That CERT should be interested in software engineering is a very good sign. What do you think causes most security holes? It *isn't* lack of cryptography, for the most part, though this last big incident is an obvious exception. The answer, of course, is bugs in the code -- and to that, software engineering is the only answer from computer science as a whole. (Bob Morris Sr's keynote address at the last UNIX Security Conference was entitled ``if your software is full of bugs, what does that say about its security?'') As for the database stuff -- from what the folks at CERT have told me (and yes, I know some of them quite well), they're having a problem managing the tremendous volume of bug reports, incident reports, etc. They need to do their own tool-building. Finally, there are some folks at CERT who are *extremely* sharp. I don't know who you talked to, but there are people there I'd hire in an instant if they were available.

1 0

Re: BIX musings on Zimmermann
by walter kehowski 17 Dec '03

17 Dec '03

################################# peace(a)BIX.com muses on Zimmerman: I think about that, it was Isaac Asimov in his story about an invention which allowed people to see back into time. Suppressed by the Government, it was independently re-invented by a professor who only got curious about the topic when he realised it was classified. The catch; when does time begin? one second ago?, one nano-second ago?. With the invention, privacy became a thing of the past; you could go anywhere, see anything. Its kind of a neat twist on this issue. The government would have us believe encryption is a *bad thing* because bad guys will use it to hide their activities. ################################# You've joggled my memory. The Isaac Asimov story referred to in "BIX musings on Zimmermann" is "The Dead Past". Another twist on this issue is that the government was cast as the good guys actually protecting the rest of the world from the wide spread use of the "neutrino-gravitic" time-viewing technology whereas the scientists were acting out of "misguided" notions of freedom of access to the information and technology. When the scientists are finally apprehended they gloat over the fact that the technology is now freely available. The gov't failed to stop them. (The time-viewing apparatus is easy to build.) When the official makes clear what the consequences are (the past is now dead - anybody with a TV set can now monitor anybody anywhere anywhen), the scientists are ashamed of themselves. However, it's important to note that the government was not above using the technology to suppress the spread of the technology. What such a monitoring agency would become in twenty years or so is clear. Just how paranoid could it get? ("Crisis and Leviathan" - When the crisis has passed, the institutions set up to deal with it remain.) It is interesting to speculate on the analogy between Zimmerman's PGP and Clipper and the "neutrino-gravitic" time-viewing technology which the government is not above using for ostensibly noble ends. Walter A. Kehowski <wak(a)next0.math.pitt.edu>

1 0

Re: Give me your privacy and I will protect you.
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Michael Johnson <mpj(a)csn.org> > > Just say "NO!" to harmful drugs, promiscuous sex, the ITAR's restrictions on ^^^^^^^^^^^^^^^ Please, tell me this is a joke. > strong cryptography, and Key Escrow! Write YOUR Congressional Representative > NOW and express support for Maria Cantwell's bill to ease restrictions on > privacy software! --Dave.

1 0

Rising dishonesty level
by Brad Dolan 17 Dec '03

17 Dec '03

jimn8(a)netcom.com remarks about the rising level of dishonesty in (presumably) media/political circles: *It's bad* I once had a faint hope that a change in administrations would reverse the tide. I'm over that now. People from eastern Europe recognize a lot of what they see developing here, as a recent poster noted. jimn8 further wonders if anybody knows a better country to live in: I know of several that are less intrusive in your private affairs. Unfortunately, it's hard for an American to find work in most of them. I've made up a list of decision rules about when it's time to flee to the first place I can find "three hots and a cot" (Places like Belize, for instance). Try compiling your own list, it's an interesting exercise. My rules: It's time to leave when... ... I can't say what I want. ... I can't own a gun. ... I can't use good crypto. ... I can't leave and enter the U.S. freely. Brad bdolan(a)well.sf.ca.us Somewhat related: Does anybody find it interesting that no one noted for over a decade that Ames had (1) a lavish lifestyle and (2) a foreign-born (Colombian!) wife. Normally, spooks aren't allowed either. A cynic might say that the lavish lifestyle was overlooked because it was attributed to the Colombian connection, and not to the other extracurricular activities. -bd

4 3

Net restructure
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

I don't know if this is correct, but from what I have read it seems that the Net needs and will be restructured somtime in the future. I think our biggest concern when it happens will be that Clipper like encryption and monitoring will be implmented as a standard. Who knows maybe the net will be run by the government. Reuben Halper -anger is a gift- rage aginst the machine/Freedom

1 0

STEALTH OCEAN
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Matt Thomlinson asks: >I can see how a stealth-PGP would allow you to hide messages on >your disk in "wiped" filespace -- it'd look like garbage (maybe -- >see Aside), if anyone took a look. What does this buy you, though, >if you've got a telltale TSR hanging around? Why not "Parasitize" your program on to Command.com like many viruses do? The "Stealth" viruses also employ code that will not reveal the change in size to either MEM or CHKDSK, such code can also restore the timestamp. Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWzS19CcBnAsu2t1AQFyQgP9GpJQcB4TNSxzcBdKh+MWOWl6uHcEEM5I QEU7NpmegvNBAoTLuH4at8CMGqqIjol0LwIFjpKO9pkWsXUldNLHx1nl2m/Ur1iA BbPYH6ajDjuV+i/OHvNVt+ZaS1R+zZKkrW+FzA1mzM1iGn2JE5HWIdGS9r2mShRC diQXI87CWmg= =+0ln -----END PGP SIGNATURE-----

2 1

New mailing list?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

I am interested in starting a mailing list (digest, moderated) on encryption uses/abuses and possibilities in the real world. It would be like RISKS, but would concentrate on cases where encryption is currently being used and cases where it should but isn't. No discussions of this-asshole-actually-asked-for-my-SSN or the like. The idea is to expose to the public where crypto is useful and hopefully get more people to understand what will be lost if the gov't succeeds in keeping crypto tech under its thumb. However, a list is only as good as the material submitted to it. So, I ask the members of this list whether you would be interested in: (a) reading such a list and (b) contributing to it. --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 an53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1