Showing posts with label steganography. Show all posts
Showing posts with label steganography. Show all posts

Tuesday, March 25, 2008

Russian list of US codewords, Putin's letter

In this post, new stuff that the bot fetched:
  • Bits and pieces of a Russain classified letter
  • Russian-compiled list of US codewords, for evryone's entertainment
The mysteriously delicious garble

I forgot about the adding to the post on the Russian Sigint station on Cuba, and sent out a bot with keywords in Russian (the list that was prepared by a good friend that speaks excellent Voronezh Russian (plus Chinese, Spanish, Tagalog, Persian, Arabic, Japanese, Hebrew [always a shadow of Mossad, isn't there?], German and Norwegian, has American citizenship, was born in a Moslem country and has a perfect Nordic look - all of which make his adventures fun and a great learning experience.

Thereupon I have opened the bot GUI, copy-pasted into the string window about 50(sic!) keywords in Russian, which equivalent to CODEWORD, SIGNATURE, PUTIN, IRAN, AGREEMENT, SECRET, GOLD, DOLLAR, RUBLE, USA, USN, etc (военно-морские силы, код, подпись, связь, валюта, соглашение, секретные)

The bot was out in the wild no more than 600 milliseconds after the 1.2 second it took to reach main(?) servers, when it returned (faster than previously, in the instances of the FSB Directory, or the first results) a harvest that included several raw TXT files, two of which contained live, classified content. First file name was IRANTRANS.DOC which, at the time, I had no patience to unbutton. I have copied unto here the only paragraph containing legible Russian material:

доКŃ�Ń�виŃ�оНŃ�и¶я~ ЃуК‚УщКСЕ Đ˝Đž, Ń�огОднŃ�пл.ВосстанияŃ�Мо ПОМнО Ń�ĐşВасильеостровская аСаўчЄ Ч КДПО ?1іы юЁ:Ń�Ń�, ГУФ Ń�Ń�Đž CD-Ń�окОŃ�ПетропольĐ´ĐľŃ� Он и в Đ�Ń�Ń�икоЮЫ‡ЩyзљЭIФ¤o-w C&'D-Ń�ДрезденокОхекаŃ�Đ´ĐľŃ�, аКЗакПО,Ленинакан,18П.З ]3Đ´Đž Ń�Ń�ОвнŃ� High End Они пОка Đ˝ĐГУКľ дОйŃ�аНиŃ�Ń�. Đ� Ń�ак, Marantz DR700 ПОМоŃ� ĐžŃ�комитетчиком десятогоŃ�Ńвосьмого�ĐľŃ�Ń�ĐМГИМО˛ĐťŃ�Ń�Ń� СапиŃ�Ń� Ń� аĐТЭЧ˝Đ°ĐťĐžĐłĐžĐ˛ИстихбаратОгО иНĐ�иŃ�Ń�ОвОгО вŃ�Ода (ОпŃОАПО ПЗКПП ĐşĐo.СРЕДНИЙ�иŃ�ĐľŃ�СпНГРУ žĐłĐž иНĐДальне-Восточный,округ 55 отряд 7 п.з кОаĐhtw-=2ş;038Ń�Đ¸ШЏщ†ы wг)аНŃ�нОгО)105-й на Ń�поŃ�иаНŃ�Đ˝Ń�Đľ ľŃ�Đş"ĐźŃ�СŃ�каНŃ�Đ˝Ń

the text also contained the only link next to a military unit designation ("ТЭЧ 979 иап") that pointed to this photo:

the link (http://scucin-avia.narod.ru/liotchiki/albom_kirichekvlad/albom_kirichekvladfiles/postrojenije-tech.jpg)

characters in purple are of questionable interest ("Marantz" could be intriguing, though: a modified CD recorder?)

пл.Восстания Vosstania Sq., a St. Peterssburg subway station 1
Васильеостровская Vasilieostrovskaya, a St. Petersburg subway station 2
КДПО a KGB/FSB uniut associated with border patrol
Петрополь according to my source - a bar near station 2 frequented by the SpB University's foreign language and middle east studies students
Дрезден Dresden - Putin's foreign service assignment?
КЗакПО,Ленинакан,18П.З a border guard outpost in Armenia
ГУК undetermined acronym
комитетчиком десятого...восьмого "KGB (associate from the) 10th...8th (directorate)"
10th directorate is uncertain, thought the 8th was the crypto and communications department
МГИМО the prominent Moscow State Foreign Relations Insitute
ТЭЧ a Technical Management Unit
Истихбарат Istihbarat, the Libyan Security Agency
ОАПО ПЗКПП ...o.СРЕДНИЙ a border outpost near Srednyy (no time to look up)
СпНГРУ a GRU diplomatic/intelligence/DATT unit
Дальне-Восточный,округ 55 отряд 7 п.з a border guard unit ID in the Russian Far East
105-й a KGB, then FSB or GRU unit associated with DATT service

What is this file? What kind of text is this? A garbled crypto, innocently de-garbled by the bot?
Someone said that it is a garbled Cyrillic embedded into Polish. You can only guess. I will have more definite analysis of this material in later posts.

Russian-compiled list of US codewords

The second source's file name is FLOTKODOVO.doc, and it contains many of the codwords in ordiginal English.

After consulting with a friend who is in USN Reserves, I realized that the list is that of US Naval and Coast Guard codewords used by a US Joint Task Force (Four?) in the Caribbean-Atlantic. The Russians, or Russkies, as I like calling them critters on this blog, no offense intended ( it is my Southern charm background shinin' through), must have done a good homework of radio monitoring and put together this rather interesting compilation. Due to translation and formatting, it is non-alphabetical.

The Russian understanding of the meaning was very much off, for example, they could not know that BILLY BUD meant a situation where sexual crime was committed aboard a searchable vessel. A Russian listener associated it almost literally to a billy club ("битой" - with a baseball bat ?!) I s that how they opearate: when in doubt -fudge it?

Many of these were easy for the Russian to know/figure out/ distill out of Google, but there are things like BILLY BUD, where I provide the Russian interpretation and the real meaning used by the US:

RESISTOR сопротивление, resistance - no clue, actually: a non-cooperative boater
CAPACITOR
конденсатор, capacitor - really: a vessel with a probable cause for search
DIODE
диод, diode - really: Dead in Water, drifting vessel, no way on
COIL
катушка, coild, really: suspicious
TRANSISTOR -really: passenger vessel
POWER SUPPLY - no clue, really a vessel with contraband
9-SHOT -
неизвестный p. (unknown meaning, no clue) really:port turn
MONITOR
неизвестный p. really US Coast Guard
OREO Russians have no clue, but it is P3 Orion
I/O no clue, but it is: INS matter
FUSE no clue, US Customs
BUMP "push", no clue, really: hail someone by a click of an non-secure radio
UTL no clue, but: unable to locate
LL no clue, land line
CAR-LEFT , no clue, - left sideband of CB, non-obvious way of communicating
SOS no clue, but, US Secreatry of State
NCIC "Mational Crime Computer System" almost right: National Crime Information Center
PCW Russian got it right, but it means more: a violation of Pemit to Carry Concealed weapons
PSTIM no clue, possession of stimulants
PDOWN no clue, possession of donwers,
UILT no clue, under influence of liquor or THC
SCARAB Russian:"designer boat", really an innocent boat running scared
CIGARETTE Russian: "designer boat", really a guilty, arrestable boat running away
POPEYE, no clue, but it is am exerienced/retired sailor/boater
BUG no clue, it is an illegal immigrant/stowaway/INS problem
RAM no clue, cargo hold
ROM no clue, radio shack, radio report
C-NOTE Russians: $100, really: 100 gallons. tons
K - Russians: 1000, almost right - 1000 tons, gallons
ANALOG -no clue, really a bulk carrier
DIGITAL - no clue, really a container ship
CYCLE - no clue, really a round trip
HIGHWAY -no clue, really a plotted course
ZIGZAG - Russians: zigzagging course. Almost there: suspicious, avoidance course
BLUE - no clue, US Coast Guard
BLACK no clue, USN
8-BALL - Russians: captured, confiscated. Not exactly: a shootable target
BEERFRAME - no clue, really a confiscation and arrests
PHONE - no clue, really a backtalking subject
CAPTOR - Russians" captive torpedo; really an ex-captain, -military, smart attitude
CAPITAL - no clue, really a captain's personal cash
XPIG -Russians, a very creative guess: an ex-policeman; really a ship's piggy bank
FLOYD no clue, Florida
GEORGE - no clue, really Georgia
SCOTT -no clue, SC
NICK -no clue, really NC
VIRGIL - no clue, really VA
DALE - no clue, really DE
MARLIN - no clue, really MD
FIL - no clue, really PA
NUGENT - no clue (funny!) really NJ
ROSIE - no clue, really: Roosevelt Roads
KAY -no clue, really Key West
MAY -Russians: Mayport Naval Base; really: Miami
MOVIE - no clue, really Hollywood, FL
ESTEE no clue, really Ft. Lauderdale (think cosmetics)
WINNIEPEG - no clue (?) West Palm Beach
CHAPPA-Q no clue (and no chance -
editor) Palm Beach (think Kennedy)
VR no clue, Vero Beach
CAPE COD - Russians went for the obvious, but is is Cape Canaveral (think Kennedy)
INDY - no clue - Daytona
MAYNOT - no clue, though it is Jacksonville Mayport NAS
COKE -no clue, really: Pensacola
TSAR - no clue, though they could try: CZAR is St. Petersburg FL
GITMO -Russians git right, it's a no brainer, Guantanamo
AT&T -no clue, it is US BATF
MOUSE - no clue, it stands for a radar report
MODEM -no clue: a secure comm channel
ROTA -US NAS Rota, Spain
PHIBRON -Russians got it right: USN amphibious Squadron
DATT -Russians correct: defense attache system
SIG -Russians went literal: "signal", whereas it is USN NAS Sigonella
AISSO - Russians Googled it: Automated Informations Systems Security officer
WIZZO -no clue: weapons systems officer
TACO - no clue, though they listened to S-3, P-3 talk- it is a tactical air combat coordinator


You never know what these bots would turn up next.

Wednesday, August 1, 2007

How to do steganography and NORVA Messaging the crypto way

Veering off the topic of SALWISS displays, we are going to examine, and possibly quiz some of you on the CAIRNORVA decryption. Meanwhile, here is a how-to on a neat steganography method that I found on a forum. It is a set of very simple steps:

  • Create a public key;
  • Export the public key;
  • Use Clip Secure, or an equivalent;
  • Set Clip Secure to the OFB mode;
  • Encrypt a short text mesaage with CS in OFB mode, make sure that the cyphertext is no longer than 64 symbols;
  • Copy and paste the cyphertext at the beginning of the public key, then - trim the key so that the whole assembly looks innocent. Make sure the cyphertext is not chopped or altered.


Test:
Load the
key text minus the headers into SC and decrypt. Should be fine.
The public key, however, is corrupted beyond recovery. That is OK.
You post it anonymously to the internet, for example, as a new user of a forum which has an naturally designated slot suitable for a PGP key in user profile, or just into any other area where it is unlikely to arouse suspicion, but render it easy to locate intentionally.

Provided the user's true identity and anonymity has been preserved, it is additionally crucial to ensure that this modified key can be traceable. Now the person for whom it was intended may safely copy it without arousing any suspicion by being aprt of a completely benign traffic of the forum.

The bogus key may arouse suspicion
(which is highly unlikely) only when and if a third party will attempt to use it.

Back to the CAIRNORVA. The encrypted message:

GLENN STAKE THAT FAME THREE FOUR THREE ON BOOK.

BUSH LAKE GATES THREE SEEING MOLD MAKE.

GROVE NOTHING BOOK SEVEN WARMING THE JACK.

Take note of the definite, non-abstract nouns – these are your hints. Of course, this goes without saying, do not go on the wild goose chase analyzing the BOOK being repeated, if you have no previous experience with CAIRNORVA.

I used the simplest lexicon encryption. Almost the one you can find on Spammimic.I think you’ll have no problem unbuttoning this:

Dear Salaryman , Thank-you for your interest in our

letter ! If you are not interested in our publications

and wish to be removed from our lists, simply do NOT

respond and ignore this mail . This mail is being sent

in compliance with Senate bill 1619 ; Title 6 , Section

307 . This is not multi-level marketing . Why work

for somebody else when you can become rich inside 43

MONTHS . Have you ever noticed people will do almost

anything to avoid mailing their bills and more people

than ever are surfing the web . Well, now is your chance

to capitalize on this . WE will help YOU turn your

business into an E-BUSINESS & use credit cards on your

website ! You can begin at absolutely no cost to you

. But don't believe us ! Mrs Anderson who resides in

Arkansas tried us and says "My only problem now is

where to park all my cars" ! This offer is 100% legal

. If not for you then for your loved ones - act now

. Sign up a friend and you'll get a discount of 40%

. Warmest regards .

This rather wordy encryption unbuttons to data relayed , using rancid as the password.

Again, I would remind you that repeat occurrences of nouns can truly throw you a curve ball. That much I can disclose to you.
The beauty of CAIRNORVA is that you can encrypt short messages without a code book or a PC, or a palmtop. An added-on value is that the method would teach you to think clearly, formulate your message into a simple, crisp sentences, and you might just benefit from this process of a collateral benefit – you might become a Hemingway! Send those unbutton messages by e-mail, y’hear?