Quote:

---

Dave_Howe said:
Re: "mime attachments are never invisible"
investigate the RFC for Mime Multipart/related - RFC 2387 - and you will find an interesting concept, of mime parts that are *hidden* from the viewer and can be referenced in the html of the mail as embedded objects such as a SWF.

---

The key phrase there is "invisible to the viewer". There's no way to conceal an attachment from the software parsing the mail. Whether and how your e-mail client displays attachments is up to its developer (and in some cases configurable by the user).

My point, though, is that the evidence is still contained in the original MIME-encoded e-mail sitting in the target's mailbox. The target's mail client will display the decoded contents, but most mail clients also offer an ability to view the "raw" (i.e. encoded) contents as well, and of course the mail file itself can be viewed with any text editor. Anyone bothering to do a little investigation would discover the "hidden" content, provided the receiver hasn't already deleted the mail. From the standpoint of someone sending a bit of tracer code, the risk of leaving this evidence behind on the target's computer is impractically large, particularly if the target works in a paranoid environment.

It's also worth noting that spam and mail-borne viruses have encouraged the development of software that closely inspects the raw and decoded contents of the e-mail you receive, and these filters look explicitly for embedded malware, web bugs, and suspicious MIME structures in the process. With more people using these kinds of tools to defend their mailboxes against spam and malware, it becomes much harder to "hide" such tracer code from the target--it gets flagged as suspicious automatically.

Post Extras:

Quote:

---

Lightstar said:
You don't know jack shit about computers. First off, you can hide an application in an e-mail and make it invisible. Second, you don't have to have the reciever activate the tracer, it activates upon opening of the e-mail. My dad worked for the NSA as a cryptographer. I would know.

---

If you want to argue on the basis of credentials, I write anti-spam and anti-virus software for a living, specifically mail server scanners (witness Maia Mailguard), and I lecture on related topics such as cryptovirology and malware. Your uncle Jack and I have known each other for more than 25 years

It is my business to understand e-mail-borne threats and how to neutralize them at the mail server, before they ever reach the recipient's mail client. When I speak of "visibility," I'm not talking necessarily about what the mail client exposes to the end-user, but rather what any raw mail processor (e.g. a mail filter or scanner) can see in the mail. There are certainly tricks to fool a mail client into not displaying an attachment to the end-user, but any application that offers a "raw" view of the mail will expose the malicious code for what it is, to humans and applications that know what to look for.

Web bugs are a perfect example of this sort of thing. They're HTML call-backs, essentially, and rely on modern e-mail clients to blindly try to load remote links (such as images) in HTML code. A mail filter can detect these trivially and neutralize such links before they are sent to the HTML processing engine--a feature that has been incorporated into many mail clients these days. I catch and neutralize several hundred of these attempts on a daily basis in my personal e-mail.

Now, if you want to talk about exploit-ware--malware written to exploit known vulnerabilities in specific mail clients--that's a similar matter. Once the exploits become known, new filter patterns are written to detect their characteristics in arriving e-mail. Only so-called "zero-day" exploits, which are as-yet unrecognized, will slip through to the recipient. With more and more ISPs and end-users running anti-virus and anti-spyware software on their machines, pre-processing their mail for them, the delivery of exploit-ware is unreliable.

More to the point, reliance on exploit-ware requires knowledge of the recipient's specific mail client--do you know she's using Microsoft Outlook? If she's using Mozilla Thunderbird, or Eudora, that exploit won't work. It even requires assumptions about the platform the recipient is using--an exploit that targets Thunderbird under Windows won't necessarily affect someone running Thunderbird under Linux, or on a Mac. It's far from reliable as a tool for targeting a specific recipient, unless you know these things ahead of time. Even then, the target recipient may read her mail from multiple platforms and with multiple clients--perhaps Outlook Express on a Windows box at home, Thunderbird on a Mac at work, and via Yahoo! web-mail when she's traveling.

My point (as I believe I've stressed several times by now) is that it would be drop-dead stupid for the NSA or any other organization to try to pull a stunt like this with e-mail, particularly against a target who is known to be paranoid in the first place and technically competent (e.g. Tankado). There is no way to hide the evidence, since the exploit code must be transmitted in full to the recipient. It will have passed (in uninterpreted, raw form) through multiple mail relays by then, including one or more mail filters (any one of which might quarantine the item for being suspicious), and thanks to financial sector rules like the Sarbanes-Oxley Act, an increasing number of companies are required by law to archive all of the mail they send or receive on write-once media (e.g. CDs or DVDs). Such archives would preserve the evidence indefinitely.

Post Extras:

Quote:

---

Ski said:
Has anyone heard of "ECHELON"?

---

Certainly; it's been around for decades. Pick up a pay-phone at an international airport sometime, call a friend and use the word "bomb" in your conversation, and then time how long it takes airport security to converge on you. That's the sort of thing ECHELON was ostensibly designed to help with.

The trouble, of course, is that the same eavesdropping technologies that can help tip us off to impending acts of terrorism can also be turned against the population at large. It's not just diplomatic cables and airport pay-phones anymore, it's Internet traffic, satellite communications, and cellular phone networks as well.

The head-shakingly fraught part of it all, really, is the arrangement that participating nations have with one another to spy on each other's citizens--since spying on their own citizens may be deemed illegal according to their own constitutions. The U.S. spies on British citizens, while the U.K. spies on American citizens, and both countries tacitly agree to exchange information. Canada and Australia are also participants in this sordid enterprise, with similar agreements.

The advent of widespread strong encryption is throwing a bit of a wrench in the gears, however. While privacy advocates advise ordinary citizens to encrypt their e-mail and such, the courts have lately started viewing the presence of encryption software (e.g. PGP) on a suspect's computer as "circumstantial evidence" of a desire to commit a crime. Not a good precedent to set.

There's some interesting information about this and other related topics on the Digital Fortress Secrets Page, incidentally.

Post Extras:

Quote:

---

Ski said:
And with the 911 event we can expect to see even more new laws that will limit our freedom of privacy and speech.

---

Ironically, encryption technology is at the heart of the battle for freedom of speech not just in developed countries, but in third-world dictatorships where electronic communications are gated and scrutinized as a matter of course by government officials. Even a relatively innocent e-mail can get you arrested if you send it from the wrong country in the clear. Police seizures of computer equipment are commonplace, and often foreign aid workers are accused of being spies if anything remotely interesting gets found on their laptop computers.

This chilling reality was driven home to me about a year ago, when I received an e-mail from an organization that supplies free software to NGOs (Non-Government Organizations, i.e. foreign aid organizations). The writer was thanking me for the open source anti-spam and anti-virus product I developed, but he also wanted to explain to me the need to provide support for strong encryption all the way down to the mail database itself. He shared the harrowing tale of aid workers in the former Yugoslavia who had been arrested for providing dissidents with the means to spread their message outside the country via the Internet in spite of government bans. The aid workers for the most part got off easy, spending time in jail and losing their computer equipment before being deported. The dissidents--who were identified via the data on the aid workers' laptops--were executed.

Needless to say, I was moved to add strong encryption features to my software overnight. It also brought home to me just how vital it was that the encryption be well-implemented, since a flawed implementation could cost someone her life. It highlighted the fact that for some people in some parts of the world, encryption is the only safeguard they have for their freedom of speech.

What most people don't realize is that e-mail is not a particularly secure medium. In fact, e-mail is more like a postcard than a sealed envelope--anyone that handles the mail as it travels between the sender and the recipient can read it. The sender's company can read it. The company's ISP can read it. The recipient's ISP can read it. And all of the higher-level traffic carriers that link those ISPs can read it. If anyone at any of those levels wishes to scan for mail that contains certain patterns (say, credit card numbers) or keywords, there's nothing to stop them--unless you encrypt the contents before sending the mail.

Unfortunately, a lot of people have this belief that if you're using encryption in your communications it's because you have something to hide. You're up to something. You're conspiring with someone. Never mind the fact that we routinely fold our cheques when we put them into envelopes, or enfold them in another sheet of paper to obscure the fact that we're sending money in the mail. And we know the vulnerabilities of postcards, such that we keep our public writings very innocent for the most part, saving the more scandalous bits of our personal correspondence for sealed envelopes. But encrypt an e-mail to a friend? That seems excessive to most people, and smacks of paranoia. "As if my personal e-mail is interesting enough for anyone to want to read..."

At the same time, encryption is also being used by criminal organizations, terrorists, and "freedom fighters" of every stripe, and a lot of innocent people worry that if they start encrypting their e-mail they'll start looking like Bad Guys to the authorities. It's the old, "if you're innocent, what have you got to hide?" argument. If courts of law are going to take a biased view of a case because encryption tools were found on your computer, then your right to online privacy is at serious risk.

Conversely, encryption is used against us on a regular basis in the form of computer viruses and worms, most of which use some form of code obfuscation to hide themselves from virus scanners. The payload of a computer virus is usually encrypted in one manner or another, so that its contents appear to be random, making it harder for virus scanners to recognize a fixed sequence of bytes. The code to decrypt the virus is included in the clear, of course, though it, too, can be cleverly disguised using a tactic called polymorphism or metamorphism that allows the same code to be written many different ways.

Just to add fuel to an already raging fire, a new crop of computer worms makes use of encryption in novel ways, taking the victim's computer hostage by encrypting all files of a certain type (e.g. documents, spreadsheets, text files, source code, images, etc.). The worm's authors then demand a ransom, which must be paid before the victim is sent the decryption key.

Encryption is just a tool like any other. It can be used in the service of good deeds as well as evil ones, and just as it can safeguard your privacy and save the lives of foreign aid workers, it can also conceal the plots of terrorists and render your own data useless to you. Do the benefits outweigh the costs? I think so. The right to free thought, free speech, and free association is too valuable to discard just because we're afraid of something. If we start down that slippery slope, trading rights for security, we'll only encourage the powers that be to increase our sense of insecurity, until our rights become meaningless. We just have to look at the places we send foreign aid workers to understand what that end result looks like.

Post Extras: