Slashdot Log In
Mafia Boss Using Crook Crypto Captured
Posted by
Zonk
on Tue Apr 18, 2006 10:13 AM
from the never-heard-of-pgp-and-email dept.
from the never-heard-of-pgp-and-email dept.
boggis writes "Discovery is running a story on Bernardo Provenzano, the recently arrested 'boss of bosses' of the Sicilian Mafia. He apparently wrote notes to his henchmen using a modified form of the Caesar Cipher, which was easily cracked by the police and resulted in further arrests of collaborators. Discovery's cryptography expert describes it as a code that 'will keep your kid sister out'."
Related Stories
[+]
Ask Slashdot: Cryptology Research for High School Student? 43 comments
John3 asks: "My daughter is enrolled in an Advanced Science Research (ASR) course, at the local high school. The students join the program in 10th grade, choose a research topic, and then locate a mentor to work with them on their topic until high school graduation. My daughter took a cryptology course this past summer, and now she has chosen cryptology for her ASR topic. Most HS students pick mainstream research fields (medicine, genetics), so her science teacher is a bit unsure of where my daughter might locate a cryptology research project appropriate for advanced high school students (especially one that doesn't require security clearance). I'm hoping my fellow Slashdot readers might know of current cryptology/cryptography research projects that offered opportunities for a high school student to participate."
[+]
News: The Science of Secrecy 68 comments
Matthew Sparkes writes "Ever since the first codes and ciphers were developed, there has been a battle between those who want to keep their information secret, and those who want to read that information. It has been a purely intellectual war, but one that is often driven by motives from above that are far more violent. This book chronicles that battle, from it's inception, to the modern day, and outlines the techniques used to obfuscate information, and the fascinating history of the application of those techniques." Read the rest of Matthew's review.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Substituion Cipher? (Score:4, Informative)
People have been using frequency analysis [wikipedia.org] for over a thousand years to crack substitution ciphers!
Re:Substituion Cipher? (Score:4, Funny)
Parent
Re:Substituion Cipher? (Score:5, Insightful)
Parent
Re:Thought they always were spoke in vague terms (Score:3, Interesting)
If you're interested in this kind of thing- or just looking for a good read- try picking up Excellent Cadavers. It's the story of two Italian judges who finally tire of the fear, the silence, and the corruption, and take on the Mafia; the article makes reference to this guy being involved in the murders of
Re:Substituion Cipher? (Score:3, Insightful)
If only.. (Score:5, Interesting)
You see, now if you want to do secure pencil and paper ciphers here's how you do it.
Self-shrinking generators are broken but the best attack requires an insane amount of plain-text. Far, far, more than you could ever generate by hand. If Mr Mafia had used this instead of a crappy cipher from two thousand years ago then he might not have been caught.
Throughout history lives have literally depended on the strength of the cryptography people have deployed. I find it exciting that these times are still with us and are not mearly confined to the history books.
Simon
Re:If only.. (Score:3, Funny)
-nB
Re:If only.. (Score:5, Informative)
Parent
Re:If only.. (Score:5, Insightful)
Parent
Re:If only.. (Score:3, Interesting)
As for the decoy messages, they might be a good way to present disinformation, but you still need to face the fact that the real message has been read by the enemy. If he has to carefully watch two gates on 4 nights, you've still lost the advantage of surprise.
Wouldn't have helped in this case anyways... (Score:3, Interesting)
Had he used a more secure algorithm, such as the one described, he would have needed to have kept the key (the appropriately shuffled deck of cards) somewhere, which police would just as easily have found at his home. Or we would have needed to remember the 108 bit number in his head, but somehow I doubt he would have
Re:Wouldn't have helped in this case anyways... (Score:5, Interesting)
If the police aren't looking for something like a deck-of-cards-as-key, then they won't find the key, all they'll find is a deck of cards.
I only say this because I recall reading an article some years back about drug dealers storing their business information on USB thumbdrives & wearing them as necklaces or on keychains. The police would arrest the dealer, but since the police didn't know what they had, the thumbdrive was treated as any other possesion & sealed up till the dealer was released.
You're still hiding your 'key', you're just hiding it in plain site & hoping no one sees it for what it is.
Parent
Re:If only.. (Score:5, Funny)
Parent
Re:If only.. (Score:3, Informative)
Or you could try the one in Cryptonomicon. The details elude me, but I recall it being something like RC4 with a deck of cards.
This was a cipher called Solitaire, which was created by Bruce Schneier. It has been horribly broken.
Simon
Re:If only.. (Score:3, Interesting)
What they need to do is fire up a dubbie and get one of these [lavarnd.org].
Solitaire (Score:5, Informative)
(The article does exist in the Internet Archive at
http://web.archive.org/web/20050206214237/http://
It does describe what sound like they might be some problems with the randomness of the keystream, but it doesn't seem like a complete break. Sorry for pasting the address, but Slashdot doesn't seem to like IA links much.)
Anyway, I'd be curious in knowing what the problems with it are.
Parent
You didn't expect (Score:4, Funny)
Re:You didn't expect (Score:5, Insightful)
Parent
Re:You didn't expect (Score:3, Funny)
He was really just ahead of his time. You just wait, I'll be he'll write a tell-all book from prison: "10 Habits of Highly Effective Mobsters."
I can just imagine....
Manager: "Hi Joe, what's happening."
Cubie: "Oh, hi Stan.
Manager: "It's a new team-building technique I'm trying out."
Manager beats Cubie savagely
Re:You didn't expect (Score:4, Insightful)
Parent
Re:You didn't expect (Score:3, Insightful)
Re:You didn't expect (Score:3, Insightful)
This is undoubtably the case for many in the profession, especially considering the hurdles necessary to get there, but if I were to go under the knife, I'd prefer someone with rediculously fine motor control and the experience of thousands of hours of drills.
The actual act--open head, cut something out--while certainly complicated, hopefully shouldn't require much thought..unless som
Not very smart (Score:5, Informative)
To put that into computer terms, he ROT13ed the text. This sort of cipher was used by Caesar not because it was secure, but because most people couldn't read. Even those that could read undoubtedly lacked sufficient education to consider a cryptoanalysis of the text. But if someone does consider a cryptoanalysis, it is incredibly easy to break this cipher.
Simply substituting the first letter with each letter of the alphabet allows for a brute force attempt at decoding by then replacing the rest of the letters with the exact same offset used on the first character. This method ensures that the message will be decrypted even if the alphabet has additional characters. (Either for purposes of obfuscation or additional information.) The only method that can be used to prevent an attacker from using this simple decoding method (you don't even need a computer!) is to mangle the alphabet somehow. For example, if the alphabet is backwards an attacker would have more trouble decrypting the cipher. Even then, however, a simple statistical analysis on the occurance of the letters would quickly decrypt the message and reveal the secret alphabet used.
That being said, this particular mobster was smart enough to realize that a simple cipher like this would be insufficient to deter a decoder. So he attempted to confuse would-be attackers by using a number code to obscure names. I imagine that he thought that attackers would assume that he was using a codebook to keep track of the assigned names. Unfortunately (for him), his 8th grade education was obviously insufficient for him to know that his number sequences are very similar to compression techniques. Anyone with experience would note that the codes were far too long, and that the number 1 appeared quite often. Its appearance suggests that its a "trigger" for interpreting the next number differently.
So there you have it, security through obscurity does not work.
Re:Not very smart (Score:4, Interesting)
Or the godfather just wanted to play it old school all the way thinking it was the way to go. But then again, he lived in a stable.
Parent
Re:Not very smart (Score:3, Funny)
eh... They had to get the specialists of integer additions to crack the case?
Re:Not very smart (Score:3, Insightful)
I have a feeling that this has more to do with careful control of the information pipelines, large payoffs to corrupted officials, lots of money poured into lawyers, and the ability to disappear when things get hot. The purpose of using a cipher is to create a last line of defense in the case that your information pipeline is compromised.
Given that murder has no statute of limitations, he would have been equally stupid to use a more secure cryto but with unsecur
High security. (Score:5, Funny)
Re:High security. (Score:3, Funny)
Not to mention the little paper fortune tellers that ran the operation.
Ok, ok, will Vito grow up to marry Rick Springfield?
*fwip*fwip*fwip*fwip*fwip
Yes! Oooooh!
I AM.... (Score:5, Funny)
He should've at least read (Score:4, Interesting)
OK , he doesn't know cryptography... (Score:5, Insightful)
so he must've been doing something right. I imagine the ceaser
code was simply to prevent other knuckle dragging criminals from
understanding the message, not a load of top crypto crackers
at police HQ.
Re:OK , he doesn't know cryptography... (Score:3, Insightful)
That my friend is probably due to the social engineering skills of his organisation. Probably a combination of convincing, bribing, forcing, scaring etc...
Showing your hand: word to the wise-guys (Score:3, Interesting)
There was an American mobster a few years ago who did something using PGP, and the only way the FBI were able to crack it was to bug his keyboard http://www.theregister.co.uk/2000/12/06/mafia_tria l_to_test_fbi/ [theregister.co.uk]
Re:Showing your hand: word to the wise-guys (Score:3, Informative)
Well we don't know if that's the only way they had of breaking it. It was probably one of the easiest though. Often the weakest part of any cryto algorithm isn't the algorithm. It's cheaper and faster to go for the soft targets first.
Keep my kid sister out!? Impressive! (Score:5, Funny)
Considering my kid sister is a mathematician at NSA... Hmm, maybe he meant a hypothetical kid sister?
Didn't need crazy encryption (Score:4, Insightful)
And the secret message is... (Score:4, Funny)
Best cipher is no match for bad practices. (Score:3, Insightful)
DMCA to the rescue!!! (Score:3, Funny)
like corporations... (Score:3, Funny)
Cryptography is not the important point (Score:5, Informative)
The important point is that he managed to stay at large, not as a fugitive, in the neighbourhood of Corleoni (Sicily, Italy) for almost 43 years without being noticed or identified and while still heading at full steam the Cosa Nostra [wikipedia.org]!
So, as far as security and privacy is concerned, a good design can make poor technology rock!
False security (Score:3, Insightful)
I dont know how many managers, executives, or non IT type people I have talked to that think once the firewall is in place we never have to think about it again. Or now that we have an antivirus we can go and do whatever we want and not worry about downloads and such again.
Then they turn the deaf ear until... unfortunately for this guy its going to cost him more than just a few dollars and some downtime.
Crude, maybe, but dumb, no way (Score:5, Interesting)
The coded notes are more likely have been intended to prevent his fellow mafiosi from getting too close and knowing too much. There was nothing dumb about this man's rule as a godfather. He evaded capture for forty years, rebuilt the organization after the disasters of the Riina years, retained power by remaining as invisible to his fellow mobsters as he was to the authorities, and simply survived into his 70s in a "profession" in which many are lucky to reach their thirties.
Yes, it's good news that another gruesome killer is behind bars. But the more worrying question is why the godfather found it unnecessary to take more stringent precautions, suggesting that clearing out the Mafia-infested lands of Western Sicily and the corruption-prone "public works" economy still has a very long way to go. It's going to take more than a few smart remarks about cryptography to do that.
IT Consultant (Score:3, Interesting)
Frankly, I'm surprised that someone who's responsible for moving around millions, or even perhaps billions, of dollars of ill-gotten gain won't spend $250K a year on a team of competent IT consultants. I wouldn't think it'd be too hard to find a bent IT guy to give advice on security, encryption, what can be recovered from a hard drive etc. Either they think they're too smart to be caught this way, or they think the cops are too dumb to break their encryption, or they just haven't modernized their business practices because they think the old ways still work.
Interestingly, by all accounts Al Queda is much more technically savvy.
Re:IT Consultant (Score:5, Funny)
Hello, mafia! For $250K/year, I am an IT guy who can give advice on security, encryption, what can be recovered from a hard drive etc. In addition to IT, I enjoy pasta, Chianti, parmigiano, and pitted olives (preferably all in one night). Salary is negotiable if you can provide an "Italian woman," something I keep hearing about but, being a geek, haven't figured out the details of just yet.
References available upon request.
Parent
Behold the power of ROT13 times 2! (Score:5, Funny)
Behold twice the power of a ROT13 used twice!
Parent
Re:Behold the power of ROT13 times 2! (Score:5, Funny)
Parent
Re:How many letters are in the alphabet? (Score:3, Informative)
Re:Please help me pick up my jaw from the desk (Score:3, Insightful)
The cyph
Re:Most interesting part... (Score:5, Interesting)
For this, I turn to the advise of Mark Twain:
He is completely correct - there's no need for letters if they sound like others. Bekause of this, I suggest that we should follow in his footsteps.
Parent