BA jihadist relied on Jesus-era encryption An IT worker from British Airways jailed for 30 years for terrorism offences used encryption techniques that pre-date the birth of Jesus. Rajib Karim, 31, from Newcastle, was found guilty of attempting to use his job at BA to plot a terrorist attack at the behest of Yemen-based radical cleric Anwar al-Awlaki, a leader of al- …
Rule #1 of encryption, randomness, steganography, copy-protection or a million and one other related areas:
Just because you *think* it's better than a published algorithm reviewed by thousands of experts, doesn't mean it *IS* better.
Rule #2: Never "make up" your own encryption, random number generator, steganographic technique, copy protection etc. - it'll never work and if you *ARE* an expert, you'll know that you'll need to have people attacking it for decades before you declare it "secure enough". Even using the published ones "with a twist" or a new from-scratch implementation will compromise your encryption most of the time.
Rule #3: Don't trust in God when 2048-bit, peer-reviewed, PKE exists and has *never* been "cracked", even when terrorists used it and we needed access to the information contained within for anti-terrorist purposes. Seriously. There's never been a case where "real" encryption that wasn't hideously out-of-date was used and some random three-letter agency managed to decrypt it. There's a reason for that - that's what it was DESIGNED for.
"Despite urging by the Yemen-based al Qaida leader Anwar Al Anlaki, Karim also rejected the use of a sophisticated code program called "Mujhaddin Secrets", which implements all the AES candidate cyphers, "because 'kaffirs', or non-believers, know about it so it must be less secure"."
If they had had employed methods that the infidels are used to they might well have gotten away with it. But, with the typical 'wisdom' shown by hard-core beleivers they came up with a huge fail.
There is a highly technical solution but the twats though they were better.
What are you talking about? All encryption methods can be broken within 60 seconds. I have seen it on TV: the movie Swordfish, the show "24", so it must be true. :P
"This is Jack Bauer. I had to shoot the suspect. I am at his terminal of doom, but it requires a password."
"Ok, let's see what we can do." Clickety-clickety-click ... (60 seconds of ADVERTISING) "Jack, we got the password."
"Give it to me."
"8Fz*,FX"mUKIudo1N*J6h%"h4mmJ@*+G1g7yblvg"jR@7cWiRsx"
Although I would point out that, just because a particular type/strength of encryption hasn't been anounced to be cracked, doesn't mean that it's not crackable by GCHQ/NSA. It may be a routine crack, it may be very non-trivial but doable. They are very unlikely to announce they can crack particular cyphers.
Bear in mind that we now know that GCHQ operated PKE for years before it was "invented" by messers Rivest, shamir and Adleman.
This post has been deleted by its author
I think it's reasonable to assume that these big orgs have the resources to invest in a distributed system that cracks files, large databases that host reverse hash lookups of every password of some arbitrary length, song lyrics, every book passages, religious verse, movie quotes, phrases, sayings and idioms and numerous other languages with appropriate transliteration. It's even likely they know of weaknesses in crypto that reduce the effort to brute force attack encryption reducing the number of rounds it takes.
What isn't likely is that there is some magic backdoor in the crypto. AES and its ilk has been analysed for years. The user's choice of passphrase is likely to be far more vulnerable than the algorithm. Therefore anticipate what the attackers are likely to be capable of and make the passphrase stronger than that.
Of course GCHQ / NSA aren't brute forcing random messages. They're probably eavesdropping on particular sites, and email providers, and cell phones and so forth. They probably have a fair idea that something is up and who the perps are simply from monitoring messages passing between certain people even if the content of said message is unknown. I bet this maroon was a suspect way before they got around to cracking his messages. Therefore it would be as important to communicate in a way which didn't arouse suspicion as much as it would the manner in which it was done.
History is full of cases where three-letter agencies or their equivalents have worked out how to crack what were believed to be state of the art encryption schemes. There's a reason for that too - that's their job. If they're doing it properly the first we'll know about it is when the documents are eventually declassified.
Hello Mr Terrorist,
We kaffirs all know about encryption so if you want my advice you should use lemon juice as invisible ink.
When your mate warms the paper in an oven it will show up your secret message. You should definitely do this because no one else uses it so it's more secure.
P.S. We also know about explosives so next time, use water bombs because we won't be expecting that and we'll be very afraid.
should sell them an app that simulates the Enigma machine. Then we can put a remade Colossus or Turing bomb to good use again. ;-)
You really have to laugh at their stupidity. I new how to decrypt single letter replacement schemes as a kid (10 or 12 y/o).
If you REALLY want to be secure, use a (sufficiently random) one time pad. This is provably uncrackable. Truly random bits can be obtained can be obtained in many ways (including the use of various quantum devices, and radioactivity (no bad Fukushima jokes please)).
Honestly, this is how I like my jihadist terrorists. I'd rather do without them entirely, mind, but if, then IT bods that insist on rot-N fit the bill nicely. This is NOT how I like the prosecution. Not even if they were prosecuting me*. Why do they insist on matching both sides on equal stupidity? Is this what's supposed to protect us? Hello?
More proof that the security circus is a waste of time and money and a fertile source of injustice. And no, not strictly because most "holy warriors" turn out to be, shall we say, a bit warped.
* I admit to no more untoward thing than general commentarding and occasional calling for firing and blackballing of egregiously incompetent shmucks from jobs that involve the public trust, guv.
This post has been deleted by its author
I'd probably think more seriously about not doing whatever it was that was going to get me into prison. Given that perspective, it's hardly surprising that someone who is enough of an idiot to think terrorism is a good idea is also enough of an idiot to not understand the basics of cryptography.
After all, it is exactly this kind of idiocy that gave us the shoe 'bomber', the underwear 'bomber' and some improbable plot about liquid explosives that allows BAA to confiscate drinking water and sell it back to us at £10 a litre on the other side of an arbitrary checkpoint.
This post has been deleted by its author
Idiots as a Service. Also exemplified by Farcebook, Twatter and Google (clever, that last one - can't find a good word to rename it - anyone?).
The problem is that they learn every time they cock up. There must be a better way to tackle this threat than a technology war.
If they[the idiots] had used PGP (or equivalent supposedly uncracked enryption) and the gov wanted to prosecute them, they[gov] would have to admit they had cracked it wouldn't they? If this were the case, then an announcment saying something like "they were using a really shit substitution system" would throw people off the scent..perhaps.
Anyway, a true code is uncrackable, but then anyone could guess they used the Koran as the document.
They wouldn't admit to cracking the code, they'd go to great lengths to find evidence elsewhere and protect the fact that they'd cracked the code.
If you know that person X is going to bomb something ony Friday, it's fairly easy to arrest them on Friday with a bomb. You don't need to let on about cracking the encryption in this case. Actually they'll go to far greater lengths, but that's the general idea.
Just because it's old doesn't mean it's not sophisticated! Kids these days, thinkin' they're all the sh*t because they got nuthin better ta do than follow current pop trends...most of which are recycled from stuff that was new (read: old and recycled) when I was a lad.
Now get off me lawn!
So by the sound of it, he used a "Caeser Box" (columnar transposition) cipher*, thought to have been first described by that well known muslim brother and jihadi Julius Caeser, using instructions he certainly got off the internet - which as we all know was invented by a cabal of radical islamists - and implemented it using software developed by well known fighters for the caliphate, Microsoft.
Shame he didn't bother his sorry arse to check the kaffir's literature - there's a whole chapter on this in Fouche Gaines, for instance - or the kaffir's Google search which yields the exact method by which to crack such as it's first result.
Upgrade the terror alert status to "Mong" and spin up the ROFLCOPTER
As for using more sophisticated ciphers, well.
Cops : "Give us the key"
jitardi: "No"
Judge: "Five years in solitary chokey for you"
... five years later ...
Cops: "Give us the key"
jitardi: "No"
... etc ad infinitum ...
(Note : there is simply no way that GCHQ et al are going to use decrypts from any modern crypto system in open, or even closed court even if they can break them.)
Either way you're fucked once the rozzers have put your front door through, it's just funnier the way he did it. Possibly worth noting that shit crypto was the least of his opsec problems. Hats off to the security services for the catch, because in all seriousness this dickhead could have done real damage.
*@TeamReg, you mention transposition tables, so I'm going with that. ICBW. Substitution ciphers are a different beast. I shall look forward to the forthcoming articles on jihadtard crypto.
Yes, Register: more Campbell and less Page. Or at least less Page banging on about nuclear "triumphs" instead of his firmer stomping grounds of military spending rants and particle punishment bulletins. Because at least the comments on the latter topics provide insider insights rather than an echo chamber of "What is the world coming to?" outbursts as those accusing the media of alarmism presumably rush off to get their nightly dose of indoctrination from the very same sources.
Hmm, his distrust of Kaffir technology didn't seem to influence his original reason for coming here, to get the NHS to attend to his 3-year-old son's ill health. I can understand traumatised lost souls becoming radicalised, but this one? to whom we only extended compassion and free treatment?
I alway thought the laws of hospitality were absolutely the most fundamental, across all religions and peoples.
#1) When they expect High Tech, go low tech.
(Credit Gibson with that one... its in one of is short stories in his anthology 'Burning Chrome' I think...) [Maybe I should get a PhD in Science Fiction? :-) ]
The Brits got lucky. There are other low tech techniques that would have been more difficult to break...
>>"Writer Duncan Campbell, who acted as an expert witness for the defence during the trial, said: "Tough communication interception laws [RIPA] were passed in the UK 10 years ago on the basis that they were needed to fight terrorism. Ludicrous articles were published then about the alleged sophistication of their methods."
>>"The case just dealt with shows where we have got to in the real world. The level of cryptography they used was not even up to the standards of cryptology and cryptography in the Middle Ages, although they made it look pretty using Excel.""
Isn't that rather like saying that there's no need for weapons legislation because one retard just tried to hold up a Post Office using a banana?
Should legislation really always be based on the inadequacies of the last person stupid enough to get caught?
Then again, does anyone seriously expect that we're actually going to get told about every case where properly encrypted communications *are* intercepted and *can't* be decrypted?
Even when interception/decryption happens, it seems likely that often there'll be misdirection involved to make people think a plot was foiled some other way, in the same way that if information is obtained from housebreaking/keylogging/etc, it's likely that *that* will often not be mentioned, but some other explanation would be offered or hinted at as to how information was discovered.
Most police and prosecutors exaggerate their cases in court. Look at all the drug cases where drugs worth gazillions of dollars when priced by the police actually amount to substantially less in the real market.
Likewise with terrorism cases, some little bomb is going to blow up some metropolis. The FBI affidavits seem to be more fiction that fact.
To quote the article: "Despite urging by the Yemen-based al Qaida leader Anwar Al Anlaki, Karim also rejected the use of a sophisticated code program called "Mujhaddin Secrets", which implements all the AES candidate cyphers, "because 'kaffirs', or non-believers, know about it so it must be less secure". Unquote...
In South Africa you could be prosecuted for using the word "k*ffir" which is regarded as a racist and demeaning term.
Anyone who has an informed opinion about this subject is in a small windowless room in GCHQ and unable to comment on the various strengths and weaknesses of any given encryption package by the Official Secrets Act.
AES is an approved form of encryption and it is doubtful the US Gov would allow it unless it was readable.
In the end though; Encryption only delays access to information, it does not deny access.
>AES is an approved form of encryption and it is doubtful the US Gov would allow it unless it was readable
That's exactly why you know it ISN'T readable. The US govt wouldn't use it if their enemies in the secret service could break it, the secret service wouldn't use it if their enemies in the NSA could break it, etc etc
The Whitehouse don't give a damn about the Russians reading their emails - it's the CIA reading them that is a threat
Sorry for all the cryptonuts out there all happilly bragging about the length of their keys, but the time a message's protection are the weakest are before it's transmitted and when it's received. After all, the message is not what kills you, it's the acts the receiver commits due to the message that we want to stop. If you know someone dodgy is sending nasty stuff and you can't get to him, then you look to where he is sending it, "collect" the receiver and ask him what the message said. As likely as not, just by holding onto the receiver you stuff up the bad guys' plans. If an encrypted file is going to take five years to decrypt using brute force then it's simpler, faster and cheaper just to do decryption by the waterboard method. The alledged CIA rendition program was simply that, the route one approach to stopping AQ acting. Whilst AQ spent years setting up a tightly secured IT program for email exchange, all they actually did was highlight to the NSA and CIA the location of the jihadis out in Pakistan and the West. Whilst that argument will upset the handwringers, how do we know it worked pretty well? Simple - how many successful AQ attacks in the West have their been?
Ah Matt, you are so mistaken.
It is nothing to do with the waterboarding - for example, the fact is plain to see that while waterboarding took place there *were* attacks in the West (7 July 2005 springs to mind, as does the Madrid train bombing). And given that waterboarding has ceased, with no concurrent rise in sudden explosions it seems obvious this is an incorrect assumption. It is not a case of upsetting handwringers, it is actually a case of upsetting the barely controlled sociopaths who delight in the suffering of others under false pretexts.
Now, the real safety net has been a small stone I picked up in Avebury. Every day I water this stone at 0716hrs. And in doing so I have single handedly prevented countless terrorist attacks taking place. I admit, that a few times I have been late, or forgotten, and bombs have gone off, but you cant have everything can you? Just think of all the lives I have saved.
Now Matt, I am sure you and the countless others who agree with doing "whatever it takes" to stop the EVIL TERRORIST will be happy to fund my continued watering of this stone. At a mere £800 per day (7 days per week, plus VAT I assume) it is even cheaper than waterboarding. Unless of course, you only agree to untested, unproven, unprovable even, methods that involve the abject suffering and torture of other humans? That would be kind of weird, wouldnt it?
Before anyone goes off on one about "it not being the same thing" - I feel I must point out the fact that I have exactly as much evidence as supporters of waterboarding.
"a good cypher like 2048-bit"
I stopped reading after that.
Seriously, this issue is totally a non-issue. All the people who are scared that NSA can crack 256-bit AES can just easily overlay (known-to-be-hard) encryption schemes. I'd love to see them crack something encrypted with Serpent, then HC-256 (or Salsa20) and then Twofish (especially if they're combined with a strong key-derivation function).
They can have some specific attacks for Serpent, Twofish and HC-256, but I doubt they can find any flaw that extends over those (quite different) three encryption methods.
Also, to address the author of the article: to assume that any small change done to a thoroughly reviewed cipher automatically makes it presumably unsafe is bollocks. In fact, just to give you a quick counterexample: for almost any Feistel cipher, you can safely add ANY constant bijection over GF(2^n), where n is the blocksize in bits, between every three cipher rounds and it will never make the cipher worse (in fact, it might make it better). So, yeah... adapting a well-known cipher design to make a secure custom cipher is not trivial, but it's also not impossible.
tl;dr: just because you can't modify a symmetric cipher in a way that the end result is still safe, don't assume no one else can.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
