Re: NYT article on steganography

[vertigo]

Seems on topic...It's an interesting read anyway.

http://theory.lcs.mit.edu/~rivest/chaffing.txt

vert


On 30 Oct 2001, Ricardo Anguiano wrote:

>
> Stego seems to be the flavor of the day.  Today's All Things Considered
> on NPR:
>
> Steganography: Linda talks to Dr. Neil F. Johnson, Associate
> Director of the Center for Secure Information Systems at George
> Mason University. Dr. Johnson devised a program which hides
> messages in computer images and music. (4:30)
>
> http://search.npr.org/cf/cmn/cmnpd01fm.cfm?PrgDate=10/30/2001&PrgID=2
>
> Audio available after 10pm EST.
>
> -Ricardo Anguiano
>
> "Arnold G. Reinhold" <[EMAIL PROTECTED]> writes:
> > [More alarmist than I would expect from Ms. Kolata. Many sources
> > quoted who claim to have seen lots of stego, but won't give
> > details. -- agr] Veiled Messages of Terrorists May Lurk in Cyberspace
> > October 30, 2001 By GINA KOLATA Investigators say terrorists may be
> > using a stealthy method of sending messages through the Internet
> > called steganography.
>
>
>
>
> -
> The Cryptography Mailing List
> Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
>




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: NYT article on steganography

[Ricardo Anguiano]

Stego seems to be the flavor of the day.  Today's All Things Considered
on NPR:

Steganography: Linda talks to Dr. Neil F. Johnson, Associate
Director of the Center for Secure Information Systems at George
Mason University. Dr. Johnson devised a program which hides
messages in computer images and music. (4:30)

http://search.npr.org/cf/cmn/cmnpd01fm.cfm?PrgDate=10/30/2001&PrgID=2 

Audio available after 10pm EST.

-Ricardo Anguiano

"Arnold G. Reinhold" <[EMAIL PROTECTED]> writes:
> [More alarmist than I would expect from Ms. Kolata. Many sources
> quoted who claim to have seen lots of stego, but won't give
> details. -- agr] Veiled Messages of Terrorists May Lurk in Cyberspace
> October 30, 2001 By GINA KOLATA Investigators say terrorists may be
> using a stealthy method of sending messages through the Internet
> called steganography.




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Yet more stego scare in the New York Times

[Enzo Michelangeli]

- Original Message -
From: "Bram Cohen" <[EMAIL PROTECTED]>
To: "Nelson Minar" <[EMAIL PROTECTED]>
Cc: "Crypto List" <[EMAIL PROTECTED]>
Sent: Wednesday, October 31, 2001 1:36 AM
Subject: Re: Yet more stego scare in the New York Times


[...]
> hotmail/yahoo/hushmail/etc. accounts - these are used for a very limited
> degree of anonymity, but are quite happy to obey search warrants. Nothing
> threatening here.

For Hushmail, this would require boobytrapping the applet that does the
encryption in the client, or the JVM in the client itself: it's not only
matter of search warrant.

Enzo





-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

RE: Yet more stego scare in the New York Times

[Trei, Peter]

> --
> From: Bram Cohen[SMTP:[EMAIL PROTECTED]]
> Sent: Tuesday, October 30, 2001 12:36 PM
> To:   Nelson Minar
> Cc:   Crypto List
> Subject:  Re: Yet more stego scare in the New York Times
> 
> On Tue, 30 Oct 2001, Nelson Minar wrote:
> 
> > What's so frustrating about this is that it is quite possible that
> > high quality stego is being used out there; how would we know?
> 
> That's highly doubtful. We cypherpunks are on the forefront of practical
> crypto applications, and what we've got is still quite limited. The
> following are pretty much all I've seen used by non-specialists -
> 
> link encryption - [...]
> anonymous remailers - [...]
> encrypted partitions - [...]
> ZKS - [...]
> hotmail/yahoo/hushmail/etc. accounts - [...]
> So there you have it. The state of deployed crypto is quite limited, and
> in practice hardly used for anything sinister at all.
> -Bram Cohen
> 
I'd add two:

Usenet as a dead drop - It's relatively easy to post things to
usenet
with very limited traceback ability, and figuring out who has read a given 
message is also very difficult. Check out alt.anonymous.messages.
Interestingly,
this group's posters are also heavy users of anonymous remailers and PGP. If
OBL & co were actually using the Internet, this is a heck of a lot simpler
than
stego'd images.
 
Anonymizing WWW proxies - eg www.anonymizer.com; www.cotse.com,
www.safeweb.com. The better of these use SSL and encrypted URLs, also manage
cookies intelligently. They sheild the user from both identification by the
target site,
and block an observer (for example, at a firewall) between the user and the
proxy from 
identifying the target site. Of course, none of this is shielded from the
proxy owner.

Peter Trei




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

IP: Airports Push for 'Smart Cards'

[R. A. Hettinga]

--- begin forwarded text


Status:  U
From: "ARNELL" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Subject: IP: Airports Push for 'Smart Cards'
Date: Tue, 30 Oct 2001 08:42:58 -0500
Sender: [EMAIL PROTECTED]
Reply-To: "ARNELL" <[EMAIL PROTECTED]>

http://wire.ap.org/APnews/center_story.html?FRONTID=NATIONAL&STORYID=APIS7FF
66MO0

OCTOBER 30, 03:22 EST
Airports Push for 'Smart Cards'

By JONATHAN D. SALANT
Associated Press Writer
White House Chief of Staff Andrew Card
AP/NBC, Alex Wong [22K]

WASHINGTON (AP) - Airline passengers who volunteer for background checks
could bypass long lines at security checkpoints under a plan being
considered by the Transportation Department.

The plan hinges on technology to verify a passenger's identity, such as a
retinal scan or fingerprint. Airlines and airports are pushing for
tamperproof ``smart cards'' that passengers would show at the screening
area.

A Transportation Department task force proposed the smart cards as a way to
reduce long waits at checkpoints. At some airports, passengers are being
asked to arrive two hours before their scheduled departure. Passengers who
agree to background checks would get minimal screening at airports while
security officers concentrate on everyone else.

``Our system won't operate if we don't get convenience, as well as security,
back into the system,'' said Charles Barclay, president of the American
Association of Airport Executives and a member of the task force. ``The only
way we're going to get there is technology.''

The Air Transport Association, the trade group for the major airlines, has
endorsed the smart cards.

Federal Aviation Administrator Jane Garvey said the agency was looking at
whether to prescreen passengers.

Other security measures have taken effect as the House prepares this week to
debate airline security legislation.

More passengers are being singled out for extensive screening based on a
computerized profile. Planes are regularly searched for hidden weapons.

Airlines are checking the names of passengers against FBI lists of potential
terrorists, sometimes with software offering alternative spellings of Arabic
names to prevent people from evading detection by using different
translations.

The FBI list also is being used to check the roughly 750,000 airport and
airline employees who can routinely bypass security checkpoints to enter
secured areas of airports.

But problems remain. Airport security screeners in New Orleans failed to
catch a gun in a passenger's carry-on baggage last week, although they
determined that the incident was accidental and no arrest was made.

At Washington Dulles Airport recently, seven of 20 screeners failed their
written exams and were given other assignments, said a Transportation
Department inspector general's report.

``It is a higher level of intensity and scrutiny, but the basic flaws are
still in the system,'' said former FAA security chief Billie Vincent.



NOTE: In accordance with Title 17 U.S.C. section 107, this material is
distributed without profit or payment to those who have expressed a prior
interest in receiving this information for non-profit research and
educational purposes only. For more information go to:
http://www.law.cornell.edu/uscode/17/107.shtml







To UNSUBSCRIBE from the ignition-point list, send email to:
[EMAIL PROTECTED]
In the body of the message, include only the line:
unsubscribe ignition-point 

--- end forwarded text


-- 
-
R. A. Hettinga 
The Internet Bearer Underwriting Corporation 
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Yet more stego scare in the New York Times

[Bram Cohen]

On Tue, 30 Oct 2001, Nelson Minar wrote:

> What's so frustrating about this is that it is quite possible that
> high quality stego is being used out there; how would we know?

That's highly doubtful. We cypherpunks are on the forefront of practical
crypto applications, and what we've got is still quite limited. The
following are pretty much all I've seen used by non-specialists -

link encryption - this isn't very spectacular, and generally isn't even
mentioned in articles on crypto, I think because the writers don't
understand it

anonymous remailers - these get used, but mostly by pranksters and
whistleblowers. I've never heard of them getting used for anything
particularly sinister, which is a little odd considering how much nicer
they are than paper communications, but the taunting serial killer crowd
seem to prefer the traditional sending of a dead tree letter either in
advance or containing information only they'd know, containing a nonce to
be included in all future correspondence to prevent connection hijacking.

encrypted partitions - this is the one journalists understand and
occasionally someone gets busted using. As often as not, the busters are
some petty third-world dictatiorship and the bustee is someone keeping
records, so this category is not without it's warm fuzzies. It seems this
is the place one should start if you're looking to use crypto anywhere.

breaking into machines to get anonymity from them - this was standard
practice back in the BBS days, but now there's so much traffic to analyze
and so many hack attempts most script kiddies don't even bother.

ZKS - it's not clear that this was used for much of anything in it's short
lifespan, and it's gone now

hotmail/yahoo/hushmail/etc. accounts - these are used for a very limited
degree of anonymity, but are quite happy to obey search warrants. Nothing
threatening here.

So there you have it. The state of deployed crypto is quite limited, and
in practice hardly used for anything sinister at all.

-Bram Cohen

"Markets can remain irrational longer than you can remain solvent"
-- John Maynard Keynes




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Thawte Protects The World From Crypto (was Re: [ SlashdotMessage ] Daily Stories)

[Bram Cohen]

On Wed, 31 Oct 2001, Peter Gutmann wrote:

> As was mentioned on the Slashdot debate, this has nothing to do with crypto but
> is for AuthentiCode signing certs.  Blaming this move in terrorists therefore
> makes it even more bizarre.  According to Thawte (via Slashdot), they were just
> following orders from Verisign.  The only explanation I can think of is that
> it's some attempt by MS to further lock small developers out of XP/.NET
> (alongside charging $1K/year for developers and similar things), but that's
> pretty far-fetched. 

Not all that far-fetched, mostly I'm not sure microsoft has that much
influence on verisign.

I'd say the most likely explanations are (a) that verisign intends to
change a lot more for a related service which that one would undercut or
(b) the division was losing money so they just canned it. I'm cynical
enough to guess (b)

In any case, it's a safe bet that blaming it on the WTC attacks is
bullshit.

-Bram Cohen

"Markets can remain irrational longer than you can remain solvent"
-- John Maynard Keynes




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: NYT article on steganography

[t byfield]

[EMAIL PROTECTED] (Tue 10/30/01 at 09:04 AM -0500):

> [More alarmist than I would expect from Ms. Kolata. Many sources 
> quoted who claim to have seen lots of stego, but won't give details. 
> -- agr]

> Veiled Messages of Terrorists May Lurk in Cyberspace
 <...> 
> By GINA KOLATA

ms. kolata developed quite a reputation for herself when she was cover-
ing the AIDS beat in, iirc, the late 80s and early 90s--as an utter in-
competent who'd gladly flog FUD if it would advance her career. ACT-UP
put a surprising amount of energy into putting a spot light on her.

i dunno whether that was a factor in the NYT's decision to not to give
on an anthrax beat, but it looks like she's found another angle.

cheers,
t



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Yet more stego scare in the New York Times

[Nelson Minar]

Another sensationalist article in the NYT about the pervasiveness of
steganography, with yet another lack of any evaluatable information.
  http://www.nytimes.com/2001/10/30/science/physical/30STEG.html?pagewanted=print

In summary, evidence for stego in this article is:

Some unnamed French defense ministry official says the folks they
arrested for the plot to blow up the US embassy in Paris were using
stego.

Chet Hosmer, president & CEO of WetStone Technologies, claims that
0.6% of images he found on porno sites and eBay have stego. He won't
tell anyone which images or how he found them, and he can't read the
secret messages. Oh, but he's paid by the Air Force.

There are a bunch of stego tools available on the Internet, "with over
a million downloads!" (Nevermind that most of those tools are the
equivalent of ROT-13).


The article does get better, quoting a few researchers back and forth,
and finally getting to Provos' work analyzing images and finding
nothing.

What's so frustrating about this is that it is quite possible that
high quality stego is being used out there; how would we know? But in
the absence of facts, the media picks up the most scary sounding info
and leads with it. I normally write letters to newspapers when I read
dumb stories like this (and sometimes they publish them!), but I don't
even know what to say this time.


 [EMAIL PROTECTED]
.   .  . ..   .  . . http://www.media.mit.edu/~nelson/



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: Thawte Protects The World From Crypto (was Re: [ Slashdot Message ] Daily Stories)

[Peter Gutmann]

"R. A. Hettinga" <[EMAIL PROTECTED]> forwarded:
>++
>| Thawte Protects The World From Crypto  |
>|   from the strange-goings-on dept. |
>|   posted by timothy on Monday October 29, @06:28 (privacy) |
>|   http://slashdot.org/article.pl?sid=01/10/29/0028250  |
>++
>
>nutsaq writes: "Thawte.com, a South African Certificate Authority, in a
>move of astonishing wrong-headedness, has inexplicably changed it's
>developer certificate policy. To quote [0]from the site: 'Due to current
>world circumstances developer certificates can no longer be issued to
>individuals.'Sucks to be working with crypto these days. Apparently I'll
>get no help from Thawte to encrypt stuff, oh wait, I didn't need it, the
>browsers did."

As was mentioned on the Slashdot debate, this has nothing to do with crypto but
is for AuthentiCode signing certs.  Blaming this move in terrorists therefore
makes it even more bizarre.  According to Thawte (via Slashdot), they were just
following orders from Verisign.  The only explanation I can think of is that
it's some attempt by MS to further lock small developers out of XP/.NET
(alongside charging $1K/year for developers and similar things), but that's
pretty far-fetched.  On the whole this move makes no sense, is anyone from
Verisign able to exlain it?  (Is anyone from *anywhere* able to explain it?).

Peter.



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

NYT article on steganography

[Arnold G. Reinhold]

[More alarmist than I would expect from Ms. Kolata. Many sources 
quoted who claim to have seen lots of stego, but won't give details. 
-- agr]

Veiled Messages of Terrorists May Lurk in Cyberspace

October 30, 2001

By GINA KOLATA


Investigators say terrorists may be using a stealthy method
of sending messages through the Internet called
steganography.

http://www.nytimes.com/2001/10/30/science/physical/30STEG.html?ex=1005 
448503&ei=1&en=2ad4dc47bd939f79




-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Veiled Messages of Terrorists May Lurk in Cyberspace

[R. A. Hettinga]

http://www.nytimes.com/2001/10/30/science/physical/30STEG.html?todaysheadlines=&pagewanted=print




October 30, 2001

Veiled Messages of Terrorists May Lurk in Cyberspace

By GINA KOLATA

he investigation of the terrorist attacks on the United States is drawing
new attention to a stealthy method of sending messages through the
Internet. The method, called steganography, can hide messages in digital
photographs or in music files but leave no outward trace that the files
were altered.

Intelligence officials have not revealed many details about whether, or how
often, terrorists are using steganography. But a former French defense
ministry official said that it was used by recently apprehended terrorists
who were planning to blow up the United States embassy in Paris.

The terrorists were instructed that all their communications were to be
made through pictures posted on the Internet, the defense official said.

The leader of that terrorist plot, Jamal Beghal, told French intelligence
officals that he trained in Afganistan and that before leaving that country
for France, he met with an associate of Osama bin Laden. The plan was for a
suicide bomber to drive a minivan full of explosives through the embassy
gates.

The idea of steganography is to take advantage of the fact that digital
files, like photographs or music files, can be slightly altered and still
look the same to the human eye or sound the same to the human ear.

The only way to spot such an alteration is with computer programs that can
notice statistical deviations from the expected patterns of data in the
image or music. Those who are starting to look for such deviations say that
their programs are as yet imperfect but that, nonetheless, some are finding
widespread use of steganography on the Internet. For national security
reasons some of these experts do not want to reveal exactly what they find,
and where.

"Quite an alarming number of images appear to have steganography in them,"
said one expert who has looked for them, Chet Hosmer, the president and
chief executive of WetStone Technologies in Cortland, N.Y.

Mr. Hosmer says his company has not decided whether to reveal all the sites
where he is finding steganography. He has found it on the auction site
eBay, where people can post pictures anonymously, inserting hidden messages
if they choose to, and just as anonymously download them, retrieving the
messages. WetStone works under a contract to the Air Force.

At George Mason University, Dr. Neil F. Johnson, a steganography expert,
said he became so worried by steganography's potential to be used by
terrorists and criminals that he stopped publishing his research on how to
detect it, reasoning that if people knew how he detected it, and where,
they could devise methods to thwart him and move their messages to sites he
has not checked.

"I have no reason to think that Al Qaeda is not using steganography," Dr.
Johnson said, but he, like others, pointed to no proof. His research, he
said, is financed by "law enforcement."

"I think it's foolish to disclose what I'm scanning for, whether I'm
scanning and whether I'm detecting anything," Dr. Johnson said. "To give
that away tips one's hands."

Steganography, Greek for "hidden writing," is one of the most ancient ways
of passing secret messages, but until very recently few computer scientists
paid it much attention - it seemed more a relic of ancient times, sort of a
Paul Revere-type "one if by land two if by sea" way of sending information.

The ancient Greeks used it, writing a message on a wooden tablet and
covering the wood with wax. Sentries would think the tablets were blank,
but when they were delivered, their recipients would simply scrape off the
wax and read the message.

In World War II, Dr. Johnson said, the Allies became so suspicious about
hidden messages that the United States Office of Censorship "took extreme
actions, such as banning flower deliveries which contained delivery dates,
crossword puzzles and even report cards."

But in recent years, steganog raphy has arrived on the Internet in a big
way, experts said, with free and easy-to-use programs to insert messages
into music or picture files. Many programs also allow users to choose an
encryption scheme to further hide the message, so even if the recipients
know it is there, they have to decode it to read it.

"In the past two years, the number of steganography tools available over
the Internet has doubled - it's 140 and growing," Dr. Johnson said. Some of
the newer ones, he said, prompt users at each step on how to proceed.

Bruce Schneier, a founder of Counterpane, an Internet security company,
likened steganography to what is known as a dead drop - a message, money or
papers left in a hiding place to be picked up by someone.

"The effect is that the sender can transmit a message without ever
communicating directly with the receiver," Mr. Schneier wrote in a recent
newsletter. "There is no e-mail between them, no remote log-i

Thawte Protects The World From Crypto (was Re: [ Slashdot Message] Daily Stories)

[R. A. Hettinga]

At 2:22 AM + on 10/30/01, [EMAIL PROTECTED] wrote:


> ++
> | Thawte Protects The World From Crypto  |
> |   from the strange-goings-on dept. |
> |   posted by timothy on Monday October 29, @06:28 (privacy) |
> |   http://slashdot.org/article.pl?sid=01/10/29/0028250  |
> ++
>
> nutsaq writes: "Thawte.com, a South African Certificate Authority, in a
> move of astonishing wrong-headedness, has inexplicably changed it's
> developer certificate policy. To quote [0]from the site: 'Due to current
> world circumstances developer certificates can no longer be issued to
> individuals.'Sucks to be working with crypto these days. Apparently I'll
> get no help from Thawte to encrypt stuff, oh wait, I didn't need it, the
> browsers did."
>
> Discuss this story at:
> http://slashdot.org/comments.pl?sid=01/10/29/0028250
>
> Links:
> 0. http://www.thawte.com/getinfo/products/devel/contents.html

-- 
-
R. A. Hettinga 
The Internet Bearer Underwriting Corporation 
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

Re: IP: Fw: [FiB FORUM] Anti-Terror Tools Include High-Tech

[Enzo Michelangeli]

On Mon, 29 October 2001, "R. A. Hettinga" wrote:

[...]
> The key-logger, hidden inside a computer, secretly records everything a
> suspect
> types on it.  The device lets authorities capture passwords to unscramble data
> files in otherwise-unbreakable codes.

So what happens if the application gets the passphrase from mouse clicks over a 
virtual keyboard displayed on the screen (maybe with layout randomly scrambled, 
non-standard fonts etc)? This isn't even an original idea: Nat Borenstein used it, a 
few years ago, in the UI for the now defunct First Virtual payment system.

Enzo



-
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]

cfp on telecommunication network security

[Panayiotis Kotzanikolaou]

I would like to inform you about a special issue of IEEE Comunications
on Telecommunication Network Security. Attached you will find the cfp.

Best Regards,
Panayiotis

 call_security.pdf