On 9/22/98 1:43 PM, Jim Choate (ravage@einstein.ssz.com) passed this wisdom:

Forwarded message:

...

Date: Tue, 22 Sep 1998 11:07:34 -0500 From: Petro <petro@playboy.com> Subject: Re: Stego-empty hard drives... (fwd)

...

I don't know how hard this would be, but how about running a seperate memory check, and while those numbers are flashing on the screen, do the wait for imput?

So hide the keyscan in the memory counter code. Would work externaly, would probably not show up on TEMPEST. Since both the keyscan and the memory scan are repetitive TEMPEST might have a problem telling them apart. Provided you could get the keyscan in the same footprint as the mem check the BIOS would not show up as anomolous in size. As long as they're not running around doing checksums you'd be ok (I suspect).

Don't most memory scans do a keyscan anyway? looking for an ESC to bypass the scan? So have it also check for something else to bring up your special routine. It should pass all but the most detailed signature analysis. Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "Give a man a fish and you have fed him for a day, but give him a case of dynamite and soon the village will be showered with mud and seaweed and unidentifiable chunks of fish." -Joe Chew