VoIP Numbers Stations were Social Experiment

IO ERROR writes "The mysterious phone number stations appearing on Craigslist for the last three months, which resembled their shortwave radio cousins, and which Slashdot reported on in June, were an experiment devised by security researcher Strom Carlson and a group of Los Angeles hackers to determine if encrypted messages could be passed using unwitting third parties to foil traffic analysis by hostile intelligence agencies. Carlson and the hackers presented their findings at DEFCON earlier today and gave away CDs with "Make your own Mein Fraulein station" kits and posted one final number station for people to try to decrypt."

Another matter

[by Anonymous Coward]

Okay, and who's behind HELLO WORLD [wikipedia.org]? It's been running in stops and starts since April 2005.

Re:Another matter

[razvedchik (107358)]

It reminds me of Enigma ciphers where they repeat the initial settins twice at the beginning of the message. They are encrypted, but because they are given twice, it becomes easier to attack the crypto system.

http://en.wikipedia.org/wiki/Cryptanalysis_of_the_ Enigma [wikipedia.org]

And at one time, I was trained to transcribe 5-digit numbers from another language. That was a different time and place, though.

Interesting stuff.

Not much of an experiment

[ericpi (780324)]

experiment ... to determine if encrypted messages could be passed using unwitting third parties They managed to share anonymous information with others using only a site whose purpose is to share anonymous information with others. The fact that the encrypted the info still doesn't make it much of an 'experiment'.

Traffic Analysis

[PhunkySchtuff (208108)]

They've done it in this fashion to defeat Traffic Analysis [wikipedia.org].
This is a method of sending a message out, and having someone you want to receive the message, without other third parties being able to tell that a message has been exchanged. I can send you encrypted emails using any one of a number of secure protocols, and you can reply in kind. This is good on one level as reasonably no-one can read these emails, however it is trivial to work out that we're communicating - and this forms a pattern. Even if you can't work out what's being said, just knowing that certain parties are talking to each other is enough to build up a web of who's connected with who.
Exchanging data in the way mentioned above is a way that an interested third party is unable to work out who's sending, and who is receiving the message - if lots of people can receive it then it becomes harder to tell out of those who can receive it, who is able to read it, or make anything of it - ie, who is actually able to exchange useful information in this fashion.

Back in my day

[eagl (86459)]

Back in my day, we called that a prank.

Ha. Hah.

*golf clap*

One Time Pads

[tradecraft1 (993475)]

You just have to love the simplicity. There were so many amatateur cryptananlysts thowring all sorts of methods at these messages. A sound implementation of a OTP is a formidable foe. --Chris

Re:One Time Pads

[QuantumFTL (197300)]

A sound implementation of a OTP is a formidable foe.

OTP has two huge problems associated with it, despite the mathematics being sound (assuming you have good random numbers):

1. Key distribution - do you like sending long messages? You'll need a key that's at least as long as the compressed message, and that distribution system must be absolutely secure. Also you'll need to make sure no one ever has a chance to access your key before or after the message is sent, otherwise you're screwed.
2. Overconfidence - Congratulations, if you've done it correctly you have 100% secure communications channel. The endpoints, however, are not protected by this mathematics, and are succeptable to everything from hidden bugs to software hacking or even "rubber hose" cryptoanalysis.

Re:One Time Pads

[QuantumFTL (197300)]

Oh, I don't disagree with you at all... In fact if I ever try to do something like this, you better believe I'll be using OTP. I just worry that some people perceive this to be a "magic bullet," which it most definitely is not. In another post [slashdot.org] that even attracting attention with encrypted messages (especially those the government cannot break) could soon be an unacceptable risk for many people, and unfortunately OTP can't help with that.

Re:One Time Pads

[X0563511 (793323)]

Better method:

1. Encrypt data with OTP.
2. Hide this encrypted data in some false information (stenography)
3. Encrypt the result with something that can be broken (but not too easily)

This way, even if they managed to extract the original data from the stenography, they would just get what looks like random junk. It would actually be quite hard to even realize what you have extracted was real (rather than an error)

Re:One Time Pads

[X0563511 (793323)]

Oops, forgot to specify:
The data you hide the OTPed data in, does not have to be text. You could use an audio file (notch out a frequency on the edge of the sample range, and then use very small amplitudes to put the data in) or an image, or even a video. You could even put this data out on P2P (encrypted data in porn? who would bother to look?) and simply email an ED2K link or something to the intended recipient. Hmm, porn-link swapping; fairly benign behavior.

Re:One Time Pads

[foniksonik (573572)]

Dude is that why I keep seeing pr0n that looks slightly mangled? I thought it was just amateur encoding jobs... now you're telling me i'm watching encrypted messages while.... NOW I feel dirty... it's like some guy was talking to me while i was... ewwwww...

Stenography vs. Steganography

[sshore (50665)]

I'm sure someone has pointed it out by now, but stenography [wikipedia.org] (shorthand) is not the same as steganography [wikipedia.org].

The mistake is apparently common enough that the first line of the wikipedia entry for steganography says, "Not to be confused with stenography".

Stenography Encryption

[QuantumFTL (197300)]

I think we're moving to a society where just being suspected of a crime will be so bad (in terms of government harassment like no-fly lists, wiretapping, etc) that the most important thing will not be to make sure that the government can't read what you communicate, but rather have no reason to suspect you're doing anything they don't like. With current advances in data mining, it's going to be an arms race - the stenographers against the miners. I for one am fascinated by both technologies, and frankly rather terrified of how they each may be used. It was be interesting to see, but one thing is for sure - encryption will no longer be enough.

Re:Stenography Encryption

[hcob$ (766699)]

Of course, if you are visible as a "citizen" through credit card purchases, debit cards, atms, banks, etc. and all your other traffic is encrypted... It might make a case for a visual tail to be attached to you. Warrants are only required for searches... not observations in public areas.

Re:Stenography Encryption

[Kadin2048 (468275)]

All very true. Which makes it more important -- if you're up to some sort of "no good" (where 'no good' is defined by the people with the most guns in the vicinity) -- that you maintain a passable facade of normalcy, at least as far as the government/credit bureau databases are concerned.

If you're the only person on your block using encrypted email, and using it for all of your email, you're an obvious red flag for some form of side-channel attack (i.e. they just sneak into your house when you're away and bug your keyboard). So if you did want to use encrypted communications, not only would you have to hide said communications in other things, but you'd also have to maintain the regular volume of unencrypted traffic from your email accounts so as not to arouse suspicion.

Email use is a trivial example, but it extends to anything else that can be tracked. The exact same thing goes for purchasing patterns: if you're spending large wads of dough (in cash) buying things that the government doesn't want you to have (*cough*recreational drugs*cough*), then you had better make sure that the rest of your purchasing habits aren't affected, so that nobody can find out how much money you're diverting into your illicit hobbies, just by looking at the difference between your income and your creditcards+savings+retirement accounts.

I, too, see this as becoming a cat and mouse game; as the authorities become better and better about mining information, people are going to start to become more clever and more aware about not only limiting the information they give out, but about putting out patently false information in order to create a semblance of "Joe America" when in reality they could be the Shah of Iran.

Re: Stenography Encryption

[Black Parrot (19622)]

> I thin k we're moving to a society where just being suspected of a cr i me wi ll b e so ba d (in terms of government harassment like no-fly lists, wiretapping, etc) that the most important t h ing w i ll not be to m ake sure that the government can't read what you communicate, but rather have no reason to suspect you're doing anything they don't like. With current advances in data mining, it's going to be an arms race - the stenographers against the miners.

A little analysis reveals your cause for concern.

Re:Stenography Encryption

[Deadstick (535032)]

the stenographers against the miners.

Wow, fighting it out with typewriters against picks and shovels. Wait till the steganographers get in the act...

rj

Re:shortwave radio number stations

[gEvil (beta) (945888)]

I'm still more interested in the orginals!

Shortwave numbers stations are a social experiment being conducted by the aliens. They'll present their findings at GALAXICON on July 8, 2047.

Re:shortwave radio number stations

[mikael (484)]

And there will be a guest talk by John Titor on implementing secure communication links using time travel.

Re:shortwave radio number stations

[QuantumFTL (197300)]

Shortwave numbers stations are a social experiment being conducted by the aliens.

Actually they are mostly tenticle-enlargement spam, but we don't have the proper char-set support yet. Hopefully this will be included in Vista.

Re:12 24 55 88 45 97 96

[CUatTHEFINISH (970078)]

In related news, slashdot member accidently picks correct lottery nubers for the next 4 drawings.

Re:12 24 55 88 45 97 96

[CUatTHEFINISH (970078)]

and in other related news, I can't spell numbers.

Re:What was the point again?

[Dachannien (617929)]

A post containing the actual encoded message might get deleted from Craigslist due to its content (or lack thereof). A cleverly disguised reference to a phone number where the message can be retrieved fits in with the natural flora of Craigslist.

It's like doing the same thing on a restroom stall. "For a good time, call 202-555-3988" will probably get passed over as graffiti, but a large block of cryptic-looking numbers looks unusual enough to attract attention.

Re:What I want to know is...

[digitalchinky (650880)]

All the three letter agencies across the world have finite resources. Supposing you had a box on every backbone, it's still not practical. Logically you need to have knowledge of your target beforehand, otherwise it's needle in the haystack stuff.

There are very few viable solutions, one might have 'the next terror act (tm)' sitting somewhere on a collection system, though how would an analyst ever know what that snapshot actually means without additional information? Hindsight doesn't help much.

There's an awful lot of noise out there to hide behind, and it's only ever going to get worse.

Signed.
Ex 3 letter agency drone.

Puzzles = High entropy

[Kadin2048 (468275)]

Actually a while back I was talking to someone who was writing a little steganographic program (not sure if he ever completed it) that was designed to make "word find" puzzles out of encrypted or encoded text. So the result would be a block of letters that you could print up as a trivial word-find puzzle, the ones where you look for the words printed vertically, horizontally, diagonally, etc., but then if you actually analyzed the letters (I think he was using some sort of trivial cipher that could be broken via distribution analysis) it contained a message.

I thought that was pretty neat; "puzzles within puzzles" and all that. When you think about places where you can hide messages though, there are lots of opportunities when you have puzzles, because people expect a certain amount of randomness there. In a newspaper, there aren't a whole lot of other places where you can just have a whole block of random letters and not arouse suspicion; if you find someplace where there is already expected to be high entropy, then you can sneak in your encoded material much more easily.

Sudoku puzzles and crosswords could also be good candidates, but there are even ways you could probably work them into more subtle things if you had a predetermined scheme for encoding the message. I'm sure you could probably work the chess puzzles if you knew what you were doing.