Oh, general cluelessness doesn't suprise me. What suprises me is that the writer of the original article seemed to believe that Stego was a new development. Those cops you taught...do you think they were stupid enough to assume that, because this was their first time hearing about Stego, that Al Qaeda was only starting to use it right then? (I assume the answer is 'no'...they'll be smart enough at least to recognize that this was something around for a while that they were unaware of). NSA folks, on the other hand, I would assume have a soft version of a Variola Stego suitcase...able to quickly detect the presence of pretty much any kind of stego and then perform some tests to determine what kind was used. I bet they've been aware of Al Qaeda stego for a long time...that's probably the kind of thing they are very very good at. In the end it probably comes down to Arabic, however, and that language has many built-in ways of deflecting the uninitiated. I'd bet even NSA has a hard time understanding an Arabic language message, even after they de-stego and translate it. -TD

From: "J.A. Terranson" To: Tyler Durden CC: rah@shipwright.com, cryptography@metzdowd.com, cypherpunks@al-qaeda.net, osint@yahoogroups.com Subject: RE: Blinky Rides Again: RCMP suspect al-Qaida messages Date: Thu, 9 Dec 2004 12:19:55 -0600 (CST)

On Thu, 9 Dec 2004, Tyler Durden wrote:

...

What a fuckin' joke. You mean they're only now realizing that Al-Qaeda could use stego? Do they think they're stupid?

Nah...certainly the NSA are fully prepared to handle this. I doubt it's much of a development at all to those in the know.

-TD

As recently as two years ago, I had a classroom full of cops (mostly fedz from various well-known alphabets) who knew *nothing* about stego. And I mean *NOTHING*. They got a pretty shallow intro: here's a picture, and here's the secret message inside it, followed by an hour of theory and how-to's using the simplest of tools - every single one of them was just blown away. Actually, that's not true - the Postal Inspectors were bored, but everyone _else_ was floored.

While the various alphabets have had a few years to get up to speed, the idea that they are still 99% ignorant does not surprise me in the least.

//Alif

-- Yours,

J.A. Terranson sysadmin@mfn.org 0xBD4A95BF

Civilization is in a tailspin - everything is backwards, everything is upside down- doctors destroy health, psychiatrists destroy minds, lawyers destroy justice, the major media destroy information, governments destroy freedom and religions destroy spirituality - yet it is claimed to be healthy, just, informed, free and spiritual. We live in a social system whose community, wealth, love and life is derived from alienation, poverty, self-hate and medical murder - yet we tell ourselves that it is biologically and ecologically sustainable.

The Bush plan to screen whole US population for mental illness clearly indicates that mental illness starts at the top.

Rev Dr Michael Ellner

J.A. Terranson wrote:

On Thu, 9 Dec 2004, Tyler Durden wrote:

...

Those cops you taught...do you think they were stupid enough to assume that, because this was their first time hearing about Stego, that Al Qaeda was only starting to use it right then?

Thats an interesting question on several different levels:

(1) There is (both within LEAs and the rest of us) a wide range of opinions as to the feasability of stego being used in the field for anything useful. Remember that USA "professional spies" (who spent over a year learning tradcraft IIRC) had continuous problems with very simple encryptions/decryptions in the real world.

(2) The folks in the "Al Qaeda is Satan" camp generally believe that not only is stego in wide use, but that AlQ has somehow managed to turn it into a high bandwidth channel which is being used every day to Subvert The American Way Of Life and infect Our Precious Bodily Fluids. No amount of education seems to dissuade these people from their misbeliefs.

(3) The other camp believes that stego is a lab-only toy, unsuitable for much of anything besides scaring the shit out of the people in the Satan camp.

(4) I have yet to meet a full dozen people who share my belief that while stego *may* be in use, if it is, that use is for one way messages of semaphore-class messages only. I really do not understand why this view is poopoo'd by all sides, so I must be pretty dense?

It only makes sense that transmitted stego payloads be simple codewords or signals. For hand carried chunks of data, simple disguise is sufficient The bulk transport of dangerous data is a threat model that doesnt fit the situation. Perhaps LEA confuse themselves thinking al-q is inciting a cultural revolution? . .

-- On 9 Dec 2004 at 16:15, J.A. Terranson wrote:

(3) The other camp believes that stego is a lab-only toy, unsuitable for much of anything besides scaring the shit out of the people in the Satan camp.

I have used stego for practical purposes. The great advantage of stego is that it conceals your threat model. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG aV25L9tGoz00uU3bzcY+rbFDV5nX9BCkK67CRwcd 4mBXnVakFBPiPRCdugeDolUdtnd8iueWgYFwR3Pch

Steve Thompson wrote:

--- "R.A. Hettinga" wrote:

...

Lions and Tigers and Steganography, Nell...

For those of you without a program, here is the new, official, Horsemen of the Infocalypse Scorecard:

At 3:14 PM -0400 10/3/04, R. A. Hettinga wrote:

...

Horseman Color Character Nickname

1 Terrorism Red Shadow "Blinky" 2 Narcotics Pink Speedy "Pinky" 3 Money Laundering Aqua Bashful "Inky" 4 Paedophilia Yellow Pokey "Clyde"

Cheers, RAH -------

http://cnews.canoe.ca/CNEWS/Canada/2004/12/08/pf-773871.html December 8, 2004

RCMP suspect al-Qaida messages By JIM BRONSKILL

<snort>

The RCMP couldn't find a hidden terrorist message even if someone shoved half of it up the ass of Commissioner Giuliano Zaccardelli, and the other half up the ass of Deputy Commissioner Paul Gauvin, and then sent them a map with clear directions written on it leading directly to the location of both assholes.

No, I don't like them at all.

Regards,

Steve

______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca

You tell them, Steve Insanity is a great cover for an insurectionist!

Steve Thompson wrote:

--- "R.W. (Bob) Erickson" wrote:

...

Steve Thompson wrote:

...

[assholes]

You tell them, Steve

I believe I just did.

...

Insanity is a great cover for an insurectionist!

I suppose it could be, although I am give to belive that residents of the White Room Hotel may only carry out insurection in the program room, and even then only while under direct adult supervision. I have been told that this makes the task somewhat more difficult, what with the sometimes necessity of colouring outside the lines on the page (so to speak).

Regards,

Steve

______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca

Yes, you have a point there.I guess a better cover would be as local coordinator of Neighborhood Watch --bob

Steve Thompson wrote:

c.f. "Take back the night", et. cetera. (And put it where?)

Anyhow, isn't insurrection illegal or something? ISTR reading about the natural right of the corrupt state to exist unconditionally, and it's obligation to crush any question of change for any reason.

The structure of the state in fact defines its identity as a 'person'; and since changeing the state structure could be viewed as the murder of the state's personality, the state has the right, nay, obligation to preserve its identity unchanged. (Isn't this pretty much polysci 101 material?)

Regards,

Steve

Yep, the state fights to preserve its "life" while the people suffer their own. The mistake of top down thinking lies in the inability to really model large populations with rules, too much of the action happens at the fine grained level of every day staying alive. When change comes, it will happen as the cummulative effects of millions of stuborn folk who subvert excessive authourity, 'cause they need to. As the state tries to squeeze more gold out of the untaxed ecconomy ordinary people will swarm to new work-arounds --bob cpunks write scripts

On 2004-12-10T15:50:22-0500, Steve Thompson wrote:

--- "R.W. (Bob) Erickson" wrote:

...

Steve Thompson wrote:

...

--- "R.W. (Bob) Erickson" wrote: [Colouring outside the lines]

Yes, you have a point there.I guess a better cover would be as local coordinator of Neighborhood Watch

c.f. "Take back the night", et. cetera. (And put it where?)

Anyhow, isn't insurrection illegal or something? ISTR reading about the natural right of the corrupt state to exist unconditionally, and it's obligation to crush any question of change for any reason.

The structure of the state in fact defines its identity as a 'person'; and since changeing the state structure could be viewed as the murder of the state's personality, the state has the right, nay, obligation to preserve its identity unchanged. (Isn't this pretty much polysci 101 material?)

Not typically. The idea that the state has its own identity is obvious, because it has a name -- the "state". It is clearly an atomic entity, in the same sense as a beehive or ant colony (to borrow unapologetically from R. Dawkins). However, discussion of the state as an singular entity that acts to preserve itself is typically delayed until study of Leviathan. Then it's expanded when studying Kant's theory of International Relations. Those are typically 2nd-year courses, at a minimum. IR is typically 3rd or 4th year, but Leviathan is discussed in any number of classes, just not polysci 101.

* Adam Shostack:

On Sat, Dec 11, 2004 at 10:24:09PM +0100, Florian Weimer wrote: | * R. A. Hettinga quotes a news article: | | > There have been numerous media reports in recent years that terrorist | > groups, including al-Qaida, were using steganographic techniques. | | As far as I know, these news stories can be tracked back to a | particular USA Today story. There's also been a bunch of stories how | a covert channel in TCP could be used by terrorists to hide their | communication.

There's very good evidence that Al Qaida does *not* use strong crypto.

However, they use some form of crypto. From a recent press release of our attorney general: | Als mitgliedschaftliche Betdtigung im Sinne der Strafvorschrift des ' | 129b StGB f|r die "Ansar al Islam" wird den Beschuldigten vor allem | zur Last gelegt, einen Mordanschlag auf den irakischen | Ministerprdsidenten wdhrend seines Staatsbesuches in Deutschland am | 2. und 3. Dezember 2004 geplant zu haben. Dies ergibt sich aus dem | Inhalt einer Vielzahl zwischen den Beschuldigten seit dem 28. November | 2004 verschl|sselt gef|hrter Telefongesprdche <http://www.generalbundesanwalt.de/news/index.php?Artikel=158&Thema=5&Start=0

(Very rough translation: "The persons are accused of being members of "Ansar al Islam" and planning the assassination of the Iraqi prime minister during his visit to Germany on the 2nd and 3rd December, 2004. This follows from the contents of a multitude of encrypted telephone calls the accussed exchanged since November 28, 2004.") Probably, they just used code words, and no "real" cryptography. I'm trying to obtain a confirmation, though.

--- "J.A. Terranson" wrote:

On Sat, 11 Dec 2004, Bill Stewart wrote:

...

The more serious problem is what this means for computer evidence search and seizure procedures - the US has some official rules about "copy the disk and return the computer" that came out of the Steve Jackson case, not that they're always followed;

Actually (at least here in the Midwest), it's copy ("image") the machine and provide a copy of that image. The computer and original drive stay locked in the evidence locker till the case is over.

From a purely technical perspective, there is no possible reason why the

I can't say what the legal practice is in Canada. I imagine it depends on whether the legal proceedings are politically charged; whether the cops are out to discover evidence, or if they are looking to destroy evidence; or any of a number of motivating factors. police would ever need to keep the computers and all copies of data related to an investigation. It is possible to image everything on a hard disk in an afternoon, including the extra bits available through, say, the, READ LONG(10) command in the SCSI protocol, which are normally used for ECC and CRC on each sector. Depending on the device, it may also be possible to access the spares tracks. In the rare event that a forensics firm is looking to scoop data that was overwritten, the police should be able to provide a copy of the original data back to the individual or business at a trivial cost in comparison to the costs of the forensic proceedures. Apart from data stored in flash memory, or similar less common places, there is no good reason why the actual computer hardware would need to be confiscated, except in the most exceptional circumstances where in-situ testing might need to be done with the original equipment. But in that case, the police should be required to acquire hardware that duplicates the original, so that they cannot be said to have tampered or damaged the originals. For correctness, the original computer equipment should be used once for the acquisition of a read-only copy of the data residing on it. However, it seems that the police will pretend that they are more incompetent than they actually are in order to use confiscation as extra-judicial punishment -- and that is just the common case where there are only legitimate legal proceedings at issue. In some cases, the police (in canada) are apparently willing to go to great lengths to destroy evidence and impose extra-judicial sanction on the subject of an `investigation', which may not exist at all in a legal sense, by way of employing clandestine tactics. In terms of my experience, the near total loss of my computers and other materials was carried out over a period of about three years, in an incrimental fashion that did not have even the pretense of legitimacy, but which nevertheless accompanied a subtle PR campaign that sought to suggest that there was some sort of hush-hush investigation that as a result of so-called exceptional circumstances, necessitated the particular methods that I observed. Total bullshit, actually, but we know that SpookWorld is exempt from the normal rules of civilised behaviour because of the special nature of its denizens. Anyhow, my assessment of the needs of computer forensic proceedures is probably quite accurate. The reality of conflicting and extra-legal agendas at work in some cases (such as the Steve Jackson incident) has apparently dictated a deliberately 'stupid' approach on the part of law enforcement personnel when it suits them. Regards, Steve ______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca