Sniffer dog finds child abuse images

Recondite49 · 08-07-2014 1:12pm #1

A suspect has been arrested after a dog trained to detect electronic circuitry found a memory stick containing images of child sexual abuse hidden in a tin box inside a metal cabinet.

Full story : http://www.bbc.com/news/technology-28194514

While I decry those who peddle in Kiddy Porn this could have implications for people who want to keep their data hidden. I used to feel comfortable with the idea of hiding my USB key behind a picture in my living room, seems nowhere is safe?

Suggested ways around this? Burn images to DVD? Do we think a Micro SD card could be sniffed out?

dm09 · 12-07-2014 10:28pm

Recondite49 wrote: »

A suspect has been arrested after a dog trained to detect electronic circuitry found a memory stick containing images of child sexual abuse hidden in a tin box inside a metal cabinet.

Full story : http://www.bbc.com/news/technology-28194514

While I decry those who peddle in Kiddy Porn this could have implications for people who want to keep their data hidden. I used to feel comfortable with the idea of hiding my USB key behind a picture in my living room, seems nowhere is safe?

Suggested ways around this? Burn images to DVD? Do we think a Micro SD card could be sniffed out?

Eh you could just etch the raw data in binary on wood, might take you a thousand years but lets seem them train a dog to detect that :pac:

Thoie · 12-07-2014 10:32pm

Unless they're very tall dogs, stick the usb key to the ceiling? I've got those downlighters that are set into the ceiling, and are a complete bitch to take in or out. Could stick a usb key in behind there.

The other alternative is just to make your entire house smell of electronic circuitry. And ham.

rotun · 12-07-2014 10:35pm

Store your files on the cloud?
Presuming they're all legal of course

Oink · 12-07-2014 10:35pm

Recondite49 wrote: »

I used to feel comfortable with the idea of hiding my USB key behind a picture in my living room, seems nowhere is safe

And I dont feel comfortable hearing about people who need to put their data on a usb and hide it from the guards
:-)

Recondite49 · 13-07-2014 5:56pm

Oink wrote: »

And I dont feel comfortable hearing about people who need to put their data on a usb and hide it from the guards
:-)

I think that's a bit unfair Oink, it plays to the 'nothing to hide' fallacy - do we really have to go into this or can we take it as read that there are perfectly legitimate reasons why someone might want to keep their data private from everyone else without being a terrorist or paedophile?

Given the subjectivity also introduced by laws which forbid articles 'useful to terrorism' even possession of something as innocuous as blueprints of a public building could be a crime.

I also find it hard to believe you've never downloaded pirated software or copyrighted films or music but I won't judge you for that.

Recondite49 · 13-07-2014 6:01pm

rotun wrote: »

Store your files on the cloud?
Presuming they're all legal of course

An excellent idea Rotun, I suppose you could encrypt before uploading. Before switching to USB, I used to have an encrypted file container stored in Dropbox.

gctest50 · 13-07-2014 6:06pm

OMG Jimmy Savile has been reincarnated as a Labrador

Rucking_Fetard · 13-07-2014 10:16pm

gctest50 wrote: »

OMG Jimmy Savile has been reincarnated as a Labrador

:D

Recondite49 · 13-07-2014 11:14pm

gctest50 wrote: »

OMG Jimmy Savile has been reincarnated as a Labrador

And they call it puppy love . . . :-D

bappelbe · 16-07-2014 2:17pm

Recondite49 wrote: »

An excellent idea Rotun, I suppose you could encrypt before uploading. Before switching to USB, I used to have an encrypted file container stored in Dropbox.

if you encrypted on Dropbox, why not encrypt a USB stick?

I encrypt backups of work data (accounts, suppliers, customers etc) which I consider sensitive on USB and cloud, it strikes me that this is a much easier way to keep privacy than hiding a USB key behind a picture frame.

Recondite49 · 16-07-2014 2:30pm

bappelbe wrote: »

if you encrypted on Dropbox, why not encrypt a USB stick?

I encrypt backups of work data (accounts, suppliers, customers etc) which I consider sensitive on USB and cloud, it strikes me that this is a much easier way to keep privacy than hiding a USB key behind a picture frame.

Hi bappelbe,

Thanks for your message. The answer to your question is quite simply that I do encrypt the data on my USB sticks, however at the time I did this originally I was living in the UK where they have compulsory key disclosure laws (google 'RIPA') for more information - you can be jailed for up to six months now for failing to disclose the password to an encrypted device i.e simply for maintaining your right to silence.

I don't know where the law stands in Ireland but it seems the Police do have the power to compel someone to render encrypted data into a readable format. I am not sure what the implications of this are though and naturally anyone who really is a paedophile would laugh at six months for a minor computer crime compared to becoming a registered sex offender.

bappelbe · 16-07-2014 2:41pm

Fair enough.

I suppose it goes back to rotun's phrase "Presuming they're all legal", if the data is secured for a legit reason (perhaps even legaly required - data protection act) then you have no problem, just making life for people doing illegal stuff more difficult.

No harm really unless you live in an opressive regieme eg North Korea.

Khannie · 16-07-2014 2:48pm

bappelbe wrote: »

if you encrypted on Dropbox, why not encrypt a USB stick?

You can be required to decrypt it or face prison time.

Recondite49 · 16-07-2014 2:50pm

bappelbe wrote: »

Fair enough.

I suppose it goes back to rotun's phrase "Presuming they're all legal", if the data is secured for a legit reason (perhaps even legaly required - data protection act) then you have no problem, just making life for people doing illegal stuff more difficult.

No harm really unless you live in an opressive regieme eg North Korea.

As we discussed above bappelbe, the problem we have here is that this "nothing to hide" notion often works against innocent people. Even information as innocuous as your whereabouts at a particular time or the fact you corresponded with a certain person can be used to help incriminate you - ask the Birmingham Six what they have to say on the matter!

The data I have is for my eyes only but it doesn't automatically follow that everyone who feels the same way is automatically a paedophile/terrorist etc.

Edit : If you're still unconvinced why you should keep your private data just so, please see Moxie Marlinspike's thoughts on the matter.

Rucking_Fetard · 18-07-2014 1:31pm

Recondite49 wrote: »

An excellent idea Rotun, I suppose you could encrypt before uploading. Before switching to USB, I used to have an encrypted file container stored in Dropbox.

Snowden: Dropbox is hostile to privacy, unlike 'zero knowledge' Spideroak

howamidifferent · 18-07-2014 1:56pm

From the comments on that article I found this.
No idea if its really secure or not but here you go....

http://www.arxshare.com

Recondite49 · 18-07-2014 1:58pm

Rucking_Fetard wrote: »

Snowden: Dropbox is hostile to privacy, unlike 'zero knowledge' Spideroak

Thanks RF, I use Wuala personally which operates in a similar way to SpiderOak.

The difficulty we have with SpiderOak, as the prism-break website points out is that it's difficult to verify whether SpiderOak and Wuala is really zero knowledge due to the fact they use partially or fully proprietary software. We simply have to take their word for it.

Of course there's no reason you can't encrypt it first before placing it on there. I'm currently using tc-play, the open source successor to Truecrypt which has no funny licence or security issues, do you think it'd be better to put everything inside an encrypted container to be on the safe side?

Edit : For Windows and Mac users who don't like too much change, there is also BoxCryptor which will encrypy your existing Dropbox/Google Drive files in the cloud.

Chance The Rapper · 18-07-2014 2:01pm

Recondite49 wrote: »

Hi bappelbe,

Thanks for your message. The answer to your question is quite simply that I do encrypt the data on my USB sticks, however at the time I did this originally I was living in the UK where they have compulsory key disclosure laws (google 'RIPA') for more information - you can be jailed for up to six months now for failing to disclose the password to an encrypted device i.e simply for maintaining your right to silence.

I don't know where the law stands in Ireland but it seems the Police do have the power to compel someone to render encrypted data into a readable format. I am not sure what the implications of this are though and naturally anyone who really is a paedophile would laugh at six months for a minor computer crime compared to becoming a registered sex offender.

True crypt solves that problem, you create two layers, you supply a password for the fake one and have a few dummy files in there

Recondite49 · 18-07-2014 2:05pm

Chance The Rapper wrote: »

True crypt solves that problem, you create two layers, you supply a password for the fake one and have a few dummy files in there

Hi Chance the Rappper,

I think your idea is excellent in principle - having a hidden volume can of course be a huge advantage, however I'm a little wary about endorsing Truecrypt specifically. As you know development on it has ceased and there were some security concerns.

As mentioned above there is an excellent free and open source successor to Truecrypt named tcplay for Linux which you can use to create and mount Truecrypt compatible volumes. It supports hidden volumes, keyfiles and multiple ciphers just as Truecrypt did/does.

Of course the problem you have in this regard is whether the files in your outer container are those you might want to have hidden. I have my credit card / banking details in there as well as backups of my Bitcoin wallets. Hopefully that would fool the powers that be, what do you think?

Recondite49 · 18-07-2014 2:07pm

Anyone interested in tc-play, can see a step by step guide on my tech blog here. I'm a shameless plug I know..

Chance The Rapper · 18-07-2014 2:08pm

I'd imagine it would. Regardless, aren't you technically complying? Unless they can prove that there is another hidden volume

bappelbe · 18-07-2014 2:42pm

Chance The Rapper wrote: »

I'd imagine it would. Regardless, aren't you technically complying? Unless they can prove that there is another hidden volume

As I understand it there is a weakness in flash memory systems that can enable proof of a hidden container.
In short: ware leveling is used in flash systems, if the contents of the hidden volume are altered then an old version may remain on the flash system when the new data is written, this would appear as different "random" data to what is in the container and the only reason for this would be a hidden partition.
(I think I have explained that ok)

Recondite49 · 18-07-2014 8:14pm

bappelbe wrote: »

As I understand it there is a weakness in flash memory systems that can enable proof of a hidden container.
In short: ware leveling is used in flash systems, if the contents of the hidden volume are altered then an old version may remain on the flash system when the new data is written, this would appear as different "random" data to what is in the container and the only reason for this would be a hidden partition.
(I think I have explained that ok)

Hi chief, you're absolutely right about the difficulty of deleting data stored on a solid state drive. Of course you can mitigate this risk by encrypting the entire drive. You could do this from Truecrypt (although I wouldn't recommend it) and if you use Linux, the built in Disk Utility for most flavours will also encrypt an entire stick with a password for you.

Of course if you did the latter you wouldn't be able to have a hidden container but you could plausibly say that the device wasn't encrypted and you had simply filled it with random data in order to securely erase it. From a technical point of view it would be impossible to detect whether or not you're telling the truth ; whether a court chooses to believe you or not is another thing altogether!

Also we have to consider this new threat model which is that electronic circuitry can be sniffed out by a specially trained dog. If a USB stick were found carefully hidden away it beggars belief that you would go to all that trouble to conceal a USB drive you'd deleted - perhaps as Chance says the best thing to do would be to have a hidden container if that's what you want, or to keep the data in the cloud.

Recondite49 · 18-07-2014 8:21pm

Chance The Rapper wrote: »

I'd imagine it would. Regardless, aren't you technically complying? Unless they can prove that there is another hidden volume

Hi Chance,

Technically speaking RIPA requires you to surrender any and all keys in your possession, although from a technical point of view it's impossible to prove from analysing a volume header alone whether there is a hidden volume, once you've supplied the password to the outer one.

The answer to your question is that as far as I can see in the UK at least, this point hasn't been tested in court. Some people have been jailed for refusing to hand over their passwords, however from my judicious googling I've not yet encountered a case where someone was jailed because the court believed that the person had handed over a password to an outer volume.

Of course I think it pays to be prudent, so you need to make the data in your outer volume look legitimate. As stated before, I keep a backup of my Bitcoin/Litecoin wallets in mine and a list of passwords for things like internet banking and e-mail - i.e information the Police could see if they wished anyway.

The scary part of it is, as this article points out, if you were to keep files of random data on your computer e.g astronomical noise and/or the Police became convinced that you were hiding data stegenographically in files e.g your holiday snaps, they might demand passwords where none exist. The onus is then upon you, the suspect to demonstrate this isn't the case before a court. This is why I think it's better either to encrypt an entire drive or to put your data in the cloud, where no one will know about it.

Capt'n Midnight · 20-07-2014 1:08am

Khannie wrote: »

You can be required to decrypt it or face prison time.

multiple layers of stenography

https://xkcd.com/538/

[edit] you could have a very large "one time pad" on your drive

Recondite49 · 20-07-2014 10:33am

Capt'n Midnight wrote: »

multiple layers of stenography

https://xkcd.com/538/

[edit] you could have a very large "one time pad" on your drive

Hi Captain,

I remember this cartoon came up last time we discussed one time pads - gave me a giggle but as you say it's not much good to an adversary if you have plausible deniability when it comes to encryption.

This is one of the beauties of Truecrypt and tcplay over traditional stego tools as the presence of the programs on your hard drive doesn't conclusively prove that you've hidden data.

Unfortunately this works both ways - if an adversary finds your holiday snaps, even if there isn't any data hidden inside them, they still might keep at you with a wrench until you give up a password - if that's the case then you both are in for a very long night as naturally you wouldn't be able to tell them anything!

I agree an exchange of hard drives filled with random data would be a good idea - however I'd still suggest having pads of a standard size as otherwise an adversary would be able to tell the file size roughly.

My own suggestion for using these tools would be to zip a text file and possibly an image or two into a single file and send.

For larger files you could just encrypt these in the usual way, upload them to a file-sharing site and put the link and very long password into your text document - do you think this makes sense?

Recondite49 · 20-07-2014 10:49am

Needless to say that if you're going to the trouble of meeting up with someone to perform a physical exchange of keys, you might as well work out some kind of nomenclature while you're at it to keep your messages safe from prying eyes.

For instance you could say that every day you mention is offset by three, and every hour by an offset of four e.g

'Meet me on Friday at Midnight' actually means 'Meet me on Monday at eight pm".

Names and places are also very easy to swap out for code names so 'Meet Molly outside the Post Office' could become 'Meet Godzilla in Normandy' - naturally you could have a system in place to vary these changes too e.g Any place in France could mean the same post office.

Of course the usual disclaimers about Schneier's Law which states that any fool can come up with a security system that they themselves can't crack!

Also a reminder that the CIA were, in practice able to crack OTP's used by Russian agents by capturing enemy code books and extorting detainees to explain how they system works, whereas the lessutheoretically secure VIC cipher wasn't broken until a Russian defector voluntarily explained its workings.

Sniffer dog finds child abuse images

Comments