Re: yes, they look for stego, as a Hacker Tool

2004-08-15 Thread Major Variola (ret)
At 02:43 AM 8/15/04 +0200, Thomas Shaddack wrote: On Sat, 14 Aug 2004, Major Variola (ret) wrote: It was disturbing that, as the bottom fell out of telecom, and handsets became commoditized, faceplates and ringtones were highly profitable. Faceplates are at least made of atoms. There are

Re: yes, they look for stego, as a Hacker Tool

2004-08-15 Thread Major Variola (ret)
At 02:43 AM 8/15/04 +0200, Thomas Shaddack wrote: On Sat, 14 Aug 2004, Major Variola (ret) wrote: It was disturbing that, as the bottom fell out of telecom, and handsets became commoditized, faceplates and ringtones were highly profitable. Faceplates are at least made of atoms. There are

Re: yes, they look for stego, as a Hacker Tool

2004-08-15 Thread Major Variola (ret)
At 05:30 AM 8/14/04 +0200, Thomas Shaddack wrote: On Fri, 13 Aug 2004, Major Variola (ret) wrote: Even if you map a particular hash into one of a million known-benign values, which takes work, there are multiple orthagonal hash algorithms included on the NIST CD. (Eg good luck finding values

Re: yes, they look for stego, as a Hacker Tool

2004-08-15 Thread Thomas Shaddack
On Sat, 14 Aug 2004, Major Variola (ret) wrote: Argh. You misunderstood me. I don't want to find hash collisions, to create a false known hash - that is just too difficult. I want to make every file in the machine recognized as unidentifiable. No, I understood this. In a later post it was

Re: yes, they look for stego, as a Hacker Tool

2004-08-14 Thread Major Variola (ret)
At 01:48 AM 8/14/04 +0200, Thomas Shaddack wrote: Then you have the forest where every tree is marked and the leprechaun is laughing. Love that story. But the self-watermarking you later mention is a problem. Even if you map a particular hash into one of a million known-benign values, which

Re: yes, they look for stego, as a Hacker Tool

2004-08-14 Thread Tyler Durden
Sorta like the National Forests... resource of many uses... may as well include a mixmaster payload in that worm :-) which also provides some other overt free benefit like antivirus or anti-helmetic or defrag or game or bayesian spamfilter or chat or screensaver or anon remailing client or free

Re: yes, they look for stego, as a Hacker Tool

2004-08-14 Thread Thomas Shaddack
On Fri, 13 Aug 2004, Major Variola (ret) wrote: Even if you map a particular hash into one of a million known-benign values, which takes work, there are multiple orthagonal hash algorithms included on the NIST CD. (Eg good luck finding values that collide in MD5 SHA-1 SHA-256

Re: yes, they look for stego, as a Hacker Tool

2004-08-14 Thread Thomas Shaddack
On Sat, 14 Aug 2004, Thomas Shaddack wrote: polymorphic or encrypted, but then they would be in the unknown category, along with user-created files. And programs :-) To be manually inspected by a forensic dude. Run a tool for signature changing preemptively, on *all* the files in

yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Major Variola (ret)
A cool thing for this purpose could be a patch for gcc to produce unique code every time, perhaps using some of the polymorphic methods used by viruses. The purpose would be that they do not figure out that you are using some security program, so they don't suspect that noise in the file or

Re: yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Thomas Shaddack
On Sat, 14 Aug 2004, Thomas Shaddack wrote: polymorphic or encrypted, but then they would be in the unknown category, along with user-created files. And programs :-) To be manually inspected by a forensic dude. Run a tool for signature changing preemptively, on *all* the files in

Re: yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Major Variola (ret)
At 01:48 AM 8/14/04 +0200, Thomas Shaddack wrote: Then you have the forest where every tree is marked and the leprechaun is laughing. Love that story. But the self-watermarking you later mention is a problem. Even if you map a particular hash into one of a million known-benign values, which

Re: yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Thomas Shaddack
On Fri, 13 Aug 2004, Major Variola (ret) wrote: Even if you map a particular hash into one of a million known-benign values, which takes work, there are multiple orthagonal hash algorithms included on the NIST CD. (Eg good luck finding values that collide in MD5 SHA-1 SHA-256

Re: yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Thomas Shaddack
On Fri, 13 Aug 2004, Major Variola (ret) wrote: Any jpg which looks like noise will be of interest. And any stego program will make them look at your images (etc) more closely :-) Most of the programs they've hashed is so the forensic pigs can discount them. But they would find

yes, they look for stego, as a Hacker Tool

2004-08-13 Thread Major Variola (ret)
A cool thing for this purpose could be a patch for gcc to produce unique code every time, perhaps using some of the polymorphic methods used by viruses. The purpose would be that they do not figure out that you are using some security program, so they don't suspect that noise in the file or