A little bit of Russian diplograms across the Baltic during the Georgian fray

Just to be cheeky, hereunder I bring you a sample of a Russian Diplomatic message sent this Saturday most likely either from an antenna farm in northern Russia, or from a Slava-class cruiser based in Kaliningrad westwards to an embassy in Copenhagen or London.

Their are still using the true and tried 20-tone MFSK.
Here is the transmission decoded:

33333333333YYYYYYYYYYYYYYYYYYYYYYYY3YYYYYYYYRRRRRRRRYYYYYYYY RRYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYRRRRRRRRYYYYYYYYYYYYYYYYYYYY3YYYYYYYYYYYS9
block sync
44444444444444444444
block sync
825 825 825 1 825 825 825 1 825 825 825 1 S9S9S9S9S9S9S9S9S99S9S9S9S9S9S9
block sync
44444444444444444444
block sync
4MMMMMMMMMMMMMMMMMMM 01853 03163 29583 62608 85848 20890 32229 47135 33407 01770 17829 29581 45886 18313 64193 84251 03877 14691 85520 51668 51392 97315 92028 58289 97780 86264 57560 26044 56769 76566 71984 78741 96125 82152 92638 18078 80783 12147 82868 94553 00621 94296 11650 04592 05130 05154 30534 14159 15260 64338 11984 67929 77386 73687 77328 81014 75848 43731 69507 83252 17342 71045 68924 65525
block sync
99481 76088 79303 0M871 25937 10116 72734 07113 02604 26174 70409 28835 20009 94220 29759 32628 57604 26642 95017 00115 92616 89331 70493 19462 18539 99399 08531 22668 28656 34746 19424 34051 05205 36361 55293 42453 81253 59983 79552 32527 87120 93334 03071 37980 89417 59675 09082 71198 60251 23574 49641 12374 97985 37176 01615 59203 00971 42814 93426985912 91039 16372 84963 09709
block sync
40051 20229 01134 87393 63119 79089 92815 76114 32335 14460 08450 53790 14615 18880 33373 39165 61725 05102 28457 98259 795M3 91277 30424 83432 07990 96001 68014 41459 25815 92978 49783 94985 01336 45337 17339 73020 77269 33542++++++++++++++++++3333333333

Again, this is a decoded transmission, not unbuttoned, (not deciphered). Of course, they are using a one-time pad, (note the 5-digit groups)

Also worthy of note is the S6 and S9 number station-like S code, which is associated with the Russian Man numbers station known for saying funny and innocent things in English.

Numbers stations, CPU signals, Russian poker

The numbers station have been outdated. The new smart and wily kid on the block is actually the old cyphertext. Not only does the text look innocent, having been encrypted with NORVA, but it also serves as a vehicle for unrelated, second purpose messaging.

Thus, a message in NORVA

LITTLE JENNY TAKES SAWFLY LINE LEAF RISES SUNNY DAY

Besides conveying a message the likes of

DO NOT SEND DATA CHANNEL BRAVO KEEP GOLF OPEN

The secondary meaning of the NORVA is

573917739

which could stand for anything, unrelated to the plaintext.

@@@@@@@

The new methods of the side-channel attack are the CRT diffuse visible light scan (link to PDF), CPU’s HLT state pickup, HD head seek scan.

It is also possible to distinguish various behaviors of CPU and memory operations. This is observed for artificial cases, like cycles of various CPU instructions, as well as for real-life cases, like RSA decryption.

A low-frequency acoustic source yield information on a much faster CPU in two ways. When the CPU is working on a long operation, it creates a characteristic acoustic spectral signature. Second, the temporal information about the length of each operation is obtained, and this can be used to launch a timing attack, especially when a cryptomaster can affect the input to the operation.

The valuable acoustic information lies above 10KHz, whereas typical noises, including computer fan noise, are found at lower frequencies and can thus be filtered out by proper equipment. In a task-switching systems, different tasks can be distinguished by their different acoustic spectra. When several computers are present, they can be told apart by their unique acoustic signatures, since these are dictated by the hardware, the component temperatures, and other environmental conditions. Very similar to working submarine passive sonar. Here is when SALWISS comes in handy.

The CPU instruction that is the least difficult to detect is the 80x86 HLT instruction. This instruction puts the CPU into a low-power sleep phase until the next hardware interrupt. Modern CPUs temporarily shut down many of the on-chip circuits, thereby significantly lowering power consumption and altering acoustic emissions for relatively long time. The difference between active computation, which never involves HLT instructions, and an idle CPU, where the kernel executes HLT instructions in its idle state, is very distinct. If the only program open is a cryptographic application, then this already suffices to detect the moment the program wakes up for input and when it finishes its cryptographic tasks, and this information can be used to launch timing attacks. There are, of course, other, subtler acoustic cues that carry detailed information.

***********

I hope more of you knew of Alexander Zaporozhsky. He is the one who helped CIA to bust Hansen. The Russians outsmarted Langley by letting Zaporozhsky visit Moscow unencumbered, building up his feeling of a secure status quo. His last visit was a result of his own yearning to come, entirely oblivious to the intensive operation culminating with his arrival in Moscow for the last time, putting an end to his cushy life in a Maryland suburb.

It seems (hoping against hope that it is no more than “seems”) that while the US security organizations are preoccupied with politically correct policies reflecting the views of new world order, grand new democracies and nation building, Russia, now rid of ideologies that used to guide USSR and KGB till the point of bankruptcy, has succeeded in streamlining its security operations into a no-nonsense, low-profile, mean, lean spying machine.

Nobody got lucky with the original NORVA message (see below).