WHAT'S GOIN' ON HERE?

Friday, September 26, 2008

From the RAT Files Circa 2003: Terrorism...and Amateur Radio!?!

The following was originally composed as radio copy for THIS WEEK IN AMATEUR RADIO which is due to air in August of 2003. Please click on this address: http://www.twiar.org/ for more information on this amateur radio news service. The call signs and names noted in this copy are fictitious and do not represent any specific amateur radio or citizen band station, but there is an Empire State Plaza. It's located a just few blocks away from this keyboard. Like several previously scripted Random Access Files, this feature was first aired as spoken word and then later was edited and scoped down to a ten minute produced version which has run from time to time overThis Week in Amateur Radio.

A man sits in a small room. A squalid little pay-by-the-hour 10-by-10. At the Blodgett Motel.A 24-unit dump just off Central Avenue on Arcadia Street in Colonie. A mellow-yellow, white-bread suburban community just a few minutes west of Albany. The capital city of New York, The Empire State. His dusty complexion and jet black hair suggest that he is Middle Eastern, Perhaps Eurasian. Maybe Mediterranean. But he could be South American. One can not tell for sure. He is perched on the edge of a severely "tested" and hopelessly worn-out mattress, marked with some incidental and somewhat ambiguous brownish-yellow stains. But he is not concerned with this.

He unpacks the sleek silver laptop. Disconnects the cheap close-out RadioShack beige-colored plastic room phone. Plugs in the Dell Inspirion 600m. For his own odd sense of security, he decides to do a dial-up. The connection to EarthLink is made. A click on the WinPack icon renders an instance of this popular packet program, up and good to go. It happens to be version 6.8. The man types in the telnet address for VE2UPZ. VE2UPZ is an amateur radio packet bulletin board system with Internet connections located near Montreal. The WinPack Selection List Editor has been set to reject all message inventory except those containing JPEG images issued from a certain GW3 ham station, encapsulated and transmitted within an eclectic data format known as 7PLUS.

During this session, three out of an expected five zipped JPEG files plus one tiny text message are downloaded. The images appear to be intended for any ham's view, sent "@WorldWide". But the tiny text was sent personally to the man's legally-obtained KC2 call sign. WinPack dutifully unzips and decodes the images. These are images of a World War II Boeing B-17 bomber. Shots taken at the big Oshkosh Airshow just a few months prior. The personal text is also unzipped and decoded. There is a single word: FRAGOR.

FRAGOR is Latin for BOOM.

A click on another icon brings up something just as interesting.. This is called: The Evidence Eliminator. It happens to be version 1.6. This is a so-called Steganography application which can encode and decode text messages embedded in JPEGs, GIFs, bitmaps and other image formats. The keyword FRAGOR is entered into the interface. The three B-17 pictures are called up. The Evidence Eliminator performs its assignment flawlessly. Some remarkably strategic documentation is extracted. Sensitive information detailing certain architectural flaws in a New York State government structure referred to as the Empire State Plaza is now before him.

The Empire State plaza is an huge, sprawling World's Fair-like office complex in Albany's downtown business district, complete with an over-sized museum, a forty-story skyscraper and a bulbously bloated toilet bowl-shaped theater which everyone in these parts euphemistically calls "The Egg".

But the man had anticipated two additional images.

Still online with EarthLink, another telnet session is made to the G8QAR amateur packet Internet gateway at Kidderminster in the United Kingdom. A check of stations heard list on the 2 meter - 144.85 radio port reveals a certain GW3 station has been beaconing on the frequency. The man jumps into the radio network and connects with the open terminal of the GW3 Terminal Node Controller.

The man types:
"Hello Ian. Here is Anthony. Are you there?"
Moments later:
"Yes, Anthony. Ian is here. How is the family?"
"The family is well. We received some snapshots but two were missing."
"Oh that is too bad. Did you check with Francois or Niles? I think they may have those..."
"Not yet, but yes, I will give them both a call now. Thank you Ian, please give your son a hug for me."
"I will. Hope to hear from you soon." *click*

The man who calls himself Anthony knows that Francois is the F6DEE Internet BBS near Toulouse and Niles is actually NL1DBU, a citizen band bulletin board system in Uitgeest, Holland. Winpack now up again and a link to F6DEE. All five images are there plus his personal message and just for curiosity, he logs in with NL1DBU but finds only one of the five images and no personal message. No matter though, he has what he needs. This mission will be accomplished soon. For a small moment, the man who calls himself Anthony reclines on the spotty old mattress and muses: How easy it was to pass through the lax security at the Albany International Airport. All he had to do was take off his shoes. The so-easy-to-use western technology Microsoft Windows XP laptop computer.

The Empire State Plaza structural weakness data first harvested perhaps five years ago, forwarded at that time by hand over land and sea with great risk and delivered to an electronic database located in a place where the need to know is held by the select few. This same data just now relayed back to provincial upstate New York, hidden in full view and embedded in simple JPEG photo images of American airplanes.

Easy access to commercial Internet telephone lines. Easy access to homebrew radio transmission networks constructed by unsuspecting and apparently quite naive amateur and citizen band radio "hobbyists". The two missing photos are now before him. More shots of the same B-17, providing the needed additional thought-to-be-secure data plus contact and so-called "equipment" information.

If all goes well.. By 3PM Tuesday...............FRAGOR!





Hi this is Bill Baran - N2FNH with the Random Access File. The tragic events of September 11th, 2001 in New York have given me pause for thought in a perhaps unusual sort of way. What if those in the world who would attempt to render us harm, possible terrorist operatives known in the popular media as "sleepers", actually employ our packet radio network systems for nefarious gain. A "triviality" perhaps. Why bother? Who would waste their time? 1200 baud? You must be joking! But please consider:Amateur packet radio, once a rag-tag, hodge-podge collection of disparate regional radio networks can now be easily daisy-chained together where ever there is a nearby radio-to-the-Internet gateway to fashion a highly usable communications network available to anyone who understands the strengths and weaknesses of these networks and also understands how to gain access. And access is easy. An operative need not make use use of any archaic and torturous 1200 baud radio links. He can bypass those by carefully intercepting one of approximately 500 strategically-located Internet gateways, nodes, online packet bulletin board system or even DXClusters.

The availability of low cost or free domain names for dynamically addressed Internet communications systems has made it possible for a small fleet of online BBSs and DXClusters to mushroom forth, with little or no need for radio circuits. Therefore, information transfer becomes instantaneous. Less stringent requirements for amateur radio licensing in the United States and many other countries makes it more easy for an operative to secure a license legitimately. But there is a wide range of other more sophisticated communications options available: Cellphones, Satellite telephones, 802.11 WiFi, even Nextel walkie talkies with coast-to-coast coverage. Why would a terrorist make use of amateur packet radio? Why?

Because access is easy. A legal call sign gets you in. To date, I have not come across one Sysop who would subject a prospective user to the kind of scrutiny a government or military agency might employ to verify an identity. Plus, both amateur radio and citizen band packet networks are: Effectively out of the way. If the Internet is akin to a galaxy, studded with stars, suns, planets, moons and comets, then ham and CB packet radios with their associated wireline systems are nothing more than an infinitesimal pinpoint of light, virtually invisible on the extreme fringe. Effectively, out of the way. Easily missed. Totally unnoticed. And often forgotten even by its own architects, maintainers and supporters.

Government regulatory agencies such as the Federal Communications Commission expressly forbid the use of codes or encryption. But who could guess that names like Francois or Niles might be keywords representing select mailboxes on the Internet? Average everyday although highly strategic message boards that more commonly carry the occasional FOR SALE item, the oddball trivia factoid or the meaningless rantings about Land Line Lids. How could a local ham watching his packet monitor in the British Isles know that common given names like Ian or Anthony might actually be aliases for Mustafah, Singh, Anatoli or Fidel?

And would an eyebrow be raised if these names were actually seen? Most likely not. In the global village, such names are common everywhere. But an operative working surreptitiously will take no chance. When in Rome, use a Roman name. There are however some disadvantages to using such networks. Such networks are homegrown affairs. They are not commercial services. They are the efforts of hobbyists, who offer up their discretionary time for the better cause.But if a critical node or gateway crashes and drops off the screen, it might be days, weeks, maybe even years before the time is taken to effect a repair. Thus, a clever operative however will maintain an up-to-the-minute awareness of the systems needed to get the job done. And who could guess that text messages could be embedded in simple computer generated images?

You can try this your self: Click on: http://www.evidence-eliminator.co.uk/ (tread light here, not sure if this is still safe) and download a program identified as Dound's Steganographer. It happens to be version 1.6. It's freeware and it allows the user to encrypt or digitally watermark any bitmap image, making use of any keyword you choose. Remarkably, it works! By the way, even as this Random Access File was being written, check out this real packet message I just intercepted from the VE2TOY BBS at Laval. It's from G6HXW and it was sent to CODE3(at)WW on the 25th of August, 2003:
............................................................................
From : G6HXW
To : CODE3(at)WW
Type/status : B$
Date/time : 25-Aug 20:47
BID (MID) : 670378G6HXW
Message # : 394681
Title : Night owl to Squirrel
(This message has been read 1 times so far in this BBS.)
Path: !VA2BBS!VE2WXK!VE2PKT!KB2TXP!VK3TE!VK3KAY!PP5AQ!HA3PG!IK1ZNW!LZ0FBB!
!GB7CRV!GB7CIP!GB7WSX!GB7IPW!
From: G6HXW@GB7IPW.#38.GBR.EU
To : CODE3(at)WW

The night owl has spotted the squirrel eating at the tree stump.
Put plan B into operation. Test over.
73 - Lionel, G6HXW @ GB7IPW-2
;-)

Message timed: 23:52 on 2003-Aug-25
Message sent using WinPack-AGW V6.80
--- End of messsage #394681 to CODE3 from G6HXW ---
............................................................................
Could this be some secret terrorist communique? Or is it just another typical test message from some funny guy ham operator? I would say the latter, wouldn't you? But then again...
- 30 -

No comments: