Technical Analysis of Jihadi encryption tools
Perhaps the title of the post is a misnomer. Intrepid infosec blogger Dancho gives a great analysis of the Global Islamic Media Front's boasting about their security toolset. See here and here for more. I confess to having missed this one entirely. I've not even heard of GIMF. However, as someone with a passing familiarity with encryption tools and network security, I can say that the key phrase in the article is this:
I snarfed my Red Bull when I read that one. I used to be an avid reader of Phrack, 2600 and cDc's various white papers. In full nerd fashion, I went to HOPE twice and once even bamboozled my company into paying for it. At H2K one group emphatically decided I was an FBI agent and despite my protestations gave me a wide berth and breathlessly warned anyone I spoke to that I was a Fed. Rather amusing. (Oddly enough, a contact I made at that conference ended up working for a different three letter agency and in a truly bizarre turn of events I ended up working for him as a contractor but that's another story).
While I don't know enough about the tool(s) in question to comment on them it is no small thing that the Jihadis are expanding their battlespace to include cyberwarfare to the media warfare portfolio to round out their information warfare capabilities. Based on reading the posts above and their source material, I can tell you they are significantly behind the US Airforce in terms of preparedness and maturity. The specs noted seem impressive as they are current but more important (and unknown) is deployment and how good their opsec practices are. I disagree that a brute force attack would be ineffective against even 256 bit encryption as the algorithms are likely not employing strong passphrases which would cut the brute time required significantly. Additionally, the Jihadis tend to use a narrow set of key words and phrases as they are very evocative and easy to remember. I think I'm getting too far out on a limb here so I'll cut it short.
"If you perceive the Technical Mujahid magazine as a threat to the national security of any country, old issues of Phrack magazine must be giving you the nightmares."
I snarfed my Red Bull when I read that one. I used to be an avid reader of Phrack, 2600 and cDc's various white papers. In full nerd fashion, I went to HOPE twice and once even bamboozled my company into paying for it. At H2K one group emphatically decided I was an FBI agent and despite my protestations gave me a wide berth and breathlessly warned anyone I spoke to that I was a Fed. Rather amusing. (Oddly enough, a contact I made at that conference ended up working for a different three letter agency and in a truly bizarre turn of events I ended up working for him as a contractor but that's another story).
While I don't know enough about the tool(s) in question to comment on them it is no small thing that the Jihadis are expanding their battlespace to include cyberwarfare to the media warfare portfolio to round out their information warfare capabilities. Based on reading the posts above and their source material, I can tell you they are significantly behind the US Airforce in terms of preparedness and maturity. The specs noted seem impressive as they are current but more important (and unknown) is deployment and how good their opsec practices are. I disagree that a brute force attack would be ineffective against even 256 bit encryption as the algorithms are likely not employing strong passphrases which would cut the brute time required significantly. Additionally, the Jihadis tend to use a narrow set of key words and phrases as they are very evocative and easy to remember. I think I'm getting too far out on a limb here so I'll cut it short.
Comments
Two of the six guys in my office had a-fib in the last three years, which is WAY out of the norm. After their respective spectacular episodes, it came to light that the first guy was pounding Rock Stars all day every day, and the second guy was doing the same with Red Bull.
It messes with the electrical impulses that drive your heart. A can a day probably doesn't do anything to hurt. A can every other day would be much better. All things in moderation, ya know.
That having been said, the phrase "brute force," strictly interpreted, is not covered by your protestations. Brute force is supposed to be when all passphrase analysis has been shunted aside, and your attack descends to the level of a mathematical exhaustion on a bit-by-bit basis. An effective key strength of 256 bits in a symmetric encryption system should be adequate for the foreseeable future, classified technology aside.
Actually, I'd be interested in knowing if there's something that can crack 128, presuming it's a quality, peer-reviewed cipher.
Yes, I know what Hugh Jackman can do in the movies with a good-looking blonde globblin' his knob...but c'mon...
I was probably unclear about "brute" I was using it in the broader sense of hurling passwords/passphrases at the thing until you got something. Key intercept is clearly better but not easy.