Slashdot Mirror
German Authorities Find Al Qaeda Plans Disguised In Porn
According to CNN, which credits Hamburg-based newspaper Die Zeit, German investigators have uncovered a trove of more than 100 Al Qaeda documents recovered from a "digital storage device" (and memory cards) which were found hidden in the underpants of Austrian citizen Maqsood Lodin, who had recently traveled to Pakistan. The documents "included an inside track on some of the terror group's most audacious plots and a road map for future operations." Among these future plots: "[S]eizing cruise ships and carrying out attacks in Europe similar to the gun attacks by Pakistani militants that paralyzed the Indian city of Mumbai in November 2008." The documents were reportedly neither in plain view nor simply encrypted, but instead steganographically embedded in a pornographic video.
Of course, a terrorist group wouldn't use one of the most widely-distributed types of video to conceal information in plain sight, knowing that communication with the actual target would be concealed by the tens, if not hundreds, of thousands of others downloading it.
Absent the decryption key and/or software, I can't see a solid basis for destroying this guy's life. Of course, that won't stop them. New terrorist strategy: Make everyone a terrorist by distributing encoded terrorist documents.
#fuckbeta #iamslashdot #dicemustdie
Steganographically hide sensitive information in an innocuous looking video, and then hide it in your underpants thus guaranteeing it will arouse suspicion on discovery. How stupid are these guys??
11 years later, some are calling them stupid, but given the state of the United States, their plans seemes to have worked perfectly. Homogenizing religious people as stupid or ignorant seems like a pretty dangerous thing to do.
while(1) attack(People.Sandy);
Importing porn to Germany from Pakistan is about the most suspicious thing anyone can do.
Steno doesn't require encryption. It prevents the information from getting into the hands of the opposition to begin with. They are probably under the assumption that trying to encrypt something (A) is a waste of time if they are likely to have the resources to break it and (B) will attract attention.
Analysis of randomness is quite an advanced science. It's not nearly as difficult as you might imagine to spot an anomaly in random data. Few things in life are truly random, and if you are familiar enough with the kind of randomness in something, you will have a very good statistical chance of noticing it.
As for the steno itself, there's a double-edged sword there. The same as encryption, only a fool designs his own. Without a really deep understanding of encryption it's easy to make a subtle mistake in you design that introduces a significant weakness. So on that hand we have to assume they are using something at least somewhat commonly available. But that's where the other edge gets you... it becomes MUCH easier to spot steno'd data when you are checking for a list of specific methods of steno. The analysis tool will scan the data against dozens or hundreds of common tools, and draw a nice graph with the line mostly hanging around the 2% point at the bottom, except for one eyesore of a spike for one of the tests. Then they take off the gloves and get to work.
Just tossing out a very basic example, lets say they are steno'ing encrypted data into a big tiff by overwriting the LSB on teach byte. Visually you won't notice this because the difference is too small Mathematically the data you're storing is more-or-less flat random. BUT the data you replaced ISN'T. The LSB in an image is far from noise, and will have areas that are related by their relative position in the image. This will stick out like a sore thumb when you run a little analysis on the bits in the image. It'll be too random. And at this point your steno is busted, and it comes down to breaking the encryption. The lesson there is pretty basic - encrypted data will stick out about as well as data in the clear. All you're doing at that point is buying a little time. And intel agencies are both persistent and patient. You're better off investing more time in better steno.
To throw in an analogy, look at smuggling. If a truck is being searched at the border and the smugglers did a good job distracting from the small hide where the goods are, they get past the checkpoint with zero problem. It doesn't matter if the goods are in a safe in the hole or just tossed in a grocery sac, being in a safe didn't help. On the other hand, if the guards notice the missing volume, you're done. It doesn't matter how well you've concealed the opening, it doesn't matter how sturdy the latch, it doesn't matter if the goods are in a safe. You've been found out, and you're done. They will tear the truck apart until they get into the hole, and bust open the safe. The same principles are at work with steno.
I work for the Department of Redundancy Department.
It's all about layers.
Hiding data in your underpants is very suspicious.
Keeping a steganography program along with the data is very suspicious.
Having a big stash of porn if you're a fundementalist is a little bit suspicious.
All those are independent.
The fact it was in his underwear is definitely relevant, since the whole point of steganography is to hide. Every time you do something suspicious to make people look harder, you defeat the purpose of the steganography.
If it was a memory card in his backpack, in his camera, which matched his camera, had consistent dates and had a bunch of touristy videos on it and nothing else, they might wehh lave not looked any further.
Of course they might have done.
But if most of the files were chaff and had embedded random data (to make the noise levels match) and one had encryped data, even with a moderately good password, they might well have wasted a ton of time on the wrong files and given up.
The fact he had it hidden in his pants pretty much guaranteed that they looked until they found something.
Of course if he'd done all that and had a really good password, they would have been SOL, either way. They would have probably been very suspicious, but unable to prove anything either way.
SJW n. One who posts facts.
That sort of argument is unlikely to fly in front of a jury given all the other evidence against him. Bear in mind this wasn't just a random stop-and-search, they already suspected he was an al-Qaeda member. He tried to hide the incriminating files. Probably more that isn't in the story.
Having said that, I think this sort of story just re-inforces the general impression that the counter-terrorism apparatus is way too big for the size of the threat it presently faces. If this is the way AQ move sensitive files around, they are clearly unable to recruit members with any technical sophistication. I can easily believe intelligence agencies have got a lot better over time, not to mention ruthless and focused, but it seems that if these guys can pull off a devastating attack then basically anyone can and we may as well give up now. No need for "training in Pakistan" for those guys.
If this guy really is a terrorist and they really did recover these encoded files they wouldn't be announcing it in the news as that is irresponsible and stupid.
So why is it being announced? It should be classified.
It's a mistake to presume that Al Qaeda is staffed by religious fanatics. They are generally opposed to their own governments as much as ours, and attacked the U.S. because the U.S. was supporting tyrannical and corrupt governments in their region. Hopefully the Arab Spring has changed this somewhat.
Like most religious wars, religion in this case is just used as justification. The conflict has other causes.