Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:11:00
Dan Todd (dantodd@dnai.com)
Fri, 21 Aug 1998 09:07:43 -0700
Who needs stego.
A simple script can be written that would, upon receiving a particular
password simply substitute an unencrypted file for the one being
investigated.
Do you really think a customs official is going to know the difference?
These people won't be able to dis-assemble pgp.exe to see if there is a
backdoor that randomly opens another text file on a specific password.
Whether it is done with a script or a backdoor it is just as easy to
disguise an unsuccessful decryption as it is to create stego files and it
will probably take less space.
If you don't like that approach just label your cyphertext files as
executables. What customs official will ask you to run al the executables
on your laptop? If that's a problem just drop them into a development
environment and tell them it is code in progress and doesn't work right now.
Remember, social engineering works both ways. :-)
cheers,
dan
-----Original Message-----
From: Mike Stay <staym@accessdata.com>
To: cryptography@c2.net <cryptography@c2.net>
Cc: CodherPlunks@toad.com <CodherPlunks@toad.com>
Date: Friday, August 21, 1998 8:54 AM
Subject: Re: Encryption is like a locked suitcase
>Are there any stego filesystems out there? If they want to open your
>briefcase, be sure it has a hidden compartment...
>
>Ian Brown wrote:
>>UK Customs' view of encrypted laptop hard disks...
>>
>>http://www.telegraph.co.uk:80/et?ac=000116192758126&rtmo=keZ71kkp&atmo=ggg
ggggK&P4_FOLLOW_ON=/missions/connect/ecnlap20.html&pg=/et/missions/connect/e
cnlap20.html
>>
>>Customs targets laptop hard drive contents
>>By Simon Davies
>>...
>>A spokesman for Customs and Excise said officials would routinely
>>scan laptops for illegal material such as pornography. Encrypted
>>files will be treated in the same way as a ordinary luggage. "So far
>>as we are concerned, there is no difference between an encrypted
>>file and a locked suitcase," said the spokesman. "All travellers
>>entering the country should be prepared to have their equipment
>>scanned.".
>>
>>Laptop carriers will have little choice but to submit to the demands
>>of Customs officials. People refusing to open files or divulge keys
>>will be subject to a court order. Refusal to obey the order would
>>constitute contempt of court - an offence that can result in
>>imprisonment.
>>
>>Unlike cases involving body searches, Customs officers are not
>>required to establish grounds for "reasonable suspicion" before
>>conducting a computer search.
>>
>>The Home Office has not issued specific guidelines on the practice,
>>leaving Customs officers free to take copies of disk scans. This has
>>alarmed business leaders, who have raised concerns that sensitive
>>commercial data could be compromised.
>>...
>--
>Mike Stay
>Cryptographer / Programmer
>AccessData Corp.
>mailto:staym@accessdata.com
>
The following archive was created by hippie-mail 7.98617-22 on Sat Apr 10 1999 - 01:11:00