9 June 1998

    Date: Tue, 09 Jun 1998 11:34:00 -0400
    From: Sunder <sunder@brainlink.com>
    To: cypherpunks@cyberpass.net
    Subject: SpookTech 98 - them spies are everywhere...

    Okay, so last week on Friday, SpyKing had the SpookTech 98 convention.  I'm
    not gonna get too deep into details of things as they've nothing to do with
    the cypherpunks list's interests...

    However, the following is of great interest:

    1st, as offered they "broke" a PGP message.  Not by the traditional factoring
    of keys, nor with any weakness in PGP, but rather by simply grabbing the
    target's keyboard.   A simple key stroke grabber program installed on the
    machine did the trick.  But there's more.

    They've developed a program called "DIRT" which is aimed at LEA's tracking
    for example pedophiles.  (Of course it's not just limited to those, and of
    course it could be used in industrial espionage - a topic heavily discussed
    by Winn Schwartau who also did a presentation.)

    The program captures your keystrokes and saves'em for later.  When you
    establish your PPP connection, it anonymously emails out the keystrokes about
    every minute or so.  If your pedophile is online at the same time as you, the
    program acts as a kind of ftp server and you can browse his hard drive,
    download and upload files, and even run other software.

    There was of course talk of "if there's a microphone (or camera) attached" to
    the machine it could also be used - although that might generate a bit too much
    traffic but whatever.

    DIRT is so far only available against Win95 machines, with NT versions
    possibly available in the future, so pedophiles using 95 will be caught,
    however ANYONE with a bit of programming knowledge, can write such a beast
    and use it to spy on anyone else.

    I did get about 10 minutes on the "infected" machine in question and did the
    obvious searches for places where programs could be run from in the system
    files, and in the registry, and then because I saw the subject of the messages
    sent by DIRT to it's mommy, I did a file search for strings on the subject and
    on the keystrokes I typed in.  I turned up nothing.  At 1st glance, the machine
    doesn't look changed, if you look at your system files, you don't see anything
    there, don't see anything out of the ordinary.

    Of course the machines in question didn't have any debuggers or else I would
    have done a trace of the system calls to see what patched the keyboard handler,
    but at a 1st glance, you won't notice this program running.

    Since it sends out small little tiny email packets at a time, you won't notice
    it generating any extraneous traffic.  So it's very very very hard to even
    suspect that someone is spying on you.

    As we all know so well, 95 is not a secure OS, but you could easily write
    such a beast for NT, Mac, for various flavors of Unix, and whatever else.
    It's certainly not hard for most programmers who have a good refrence for the
    OS they're targetting.

    Hell, the spies from France and Japan probably already have written such
    things and placed them on the PC's of every important person in companies
    they wish to conduct industrial espionage against.

    Given enough time one could spot this program and notice it, however, unless
    you suspect something are you gonna even be looking for it?

    Never mind that you might be running OpenBSD with tcp wrappers and ipf and
    tripwire and cops and lsof...  if someone has access to your machine ONCE
    they could modify enough of your OS and enough of the watcher programs so
    you won't even notice such code!

    Other stuff overheard from some ex-police dudes:  Turns out all the
    construction at Grand Central recently has added some very nice hardware.
    (Now again this was part of a conversation, so again, it's hearsay, so take it
    as it's given, it might not be 100% true.)  Turns out that there are various
    cameras everywhere tied in to a computer system that watches for about 120,000
    different well known "terrorist" faces.  If it recognizes as, the armed ninjas
    will jump out of the walls and shoot, yes shoot, not arreset, but directly
    shoot on sight.  They would then remove the body swiftly and quickly and
    pretend they were shooting a movie or some such.  The incident wouldn't likely
    even make the news.

    I wonder how well tested the system is.  I wonder if there were any false
    positives so far...

    Other stuff.. Winn was there going over infowar stuff (old news to most of us),
    I found his talk quite intelligent and mostly true to real life.  There was a
    showing from EHAP - Ethical Hackers Against Pedophiles and the dude from EHAP
    broke into someone's bind - usual buffer overflow against named... and the
    usual PI bugging devices and TSCM...

    The interesting bit (to me) was the amount of corporate spying out there that
    mostly goes either undetected, or unreported against US corporations.  At the
    rate it's been going the USA will technologically lose in something like 30
    years (if I recall the numbers.)  Things like gifts of desk pen sets contain
    bugs, to people mailing junk mail to executives and including small tiny bugs
    in the lining of the envelope - so that day by day they can hear what's going
    on, to people grabbing the nice spent film carts from fax machines, etc....

    'nother cool thing was the freebie pinhole cameras given out... :)  Real nice
    and tiny... now if I could only find a nice tiny small VCR with time
    lapse on it, maybe I could catch the book theif at work.... heh... :)

    --

    =====================================Kaos=Keraunos=Kybernetos==============
    .+.^.+.|  Ray Arachelian    |Prying open my 3rd eye.  So good to see |./|\.
    ..\|/..|sunder@sundernet.com|you once again. I thought you were      |/\|/\
    <--*-->| ------------------ |hiding, and you thought that I had run  |\/|\/
    ../|\..| "A toast to Odin,  |away chasing the tail of dogma. I opened|.\|/.
    .+.v.+.|God of screwdrivers"|my eye and there we were....            |.....
    ======================= http://www.sundernet.com ==========================