Untraceable (2008)

Untraceable follows an FBI cyber crimes investigator as she attempts to track down a spree killer who posts live videos of his victims being tortured and killed on the Internet. As if that was not bad enough, the victims are killed faster as more people visit the Web site.

The title is derived from the fact that the FBI investigator, played by Diane Lane, is unable to track down the killer nor shutdown the his Web site down.

So how did the suspect hide and prevent the FBI from bring his site down? The movie describes it this way:

"The site's IP keeps changing constantly. Each new address is an exploited server. It is running a mirror of the site. The site's Russian main server uses a low TTL so that your computer constantly queries the name server's record. And that is how it gives you a new address so consistently. There are thousands of exploited servers on the Internet, so he is not going to run out of victims anytime soon. But he is accessing these servers so quickly; he has got to be running his own botnet. I mean, we are black holing these IPs. Every time we shut one mirror down another one pops up."

What this technical monologue describes, with surprising accuracy and correct pronuciation, is fast-flux DNS. Let me explain how it works in a little more detail.

DNS, or Domain Name System, are the servers--sometimes known as name servers--that turn human readable domain names, such as www.killwithme.com, into numeric Internet address, such as 64.37.182.110. These mappings--known as DNS records--include a mechanism to tell the requester how long the mapping is valid. That mechanism is know as time-to-live, or TTL.

Bot herders, the nefarious operators of botnets, figured out that you could use a low TTL to avoid having a botnet or phishing site shutdown. To do this, these lawless vagabonds create DNS records that map a single domain to hundreds or thousands of IP addresses. When they add the low TTL, which causes the IP address maps to update as fast as once per minute, it makes it possible to deploy a phishing site or botnet controller across thousands of mirrors--computers with copies of the Web site or controller application--while the ISPs' security staff played whac-a-mole trying to knock the servers off the Net.

In spite of the fact that the the screen writers got the description of fast-flux correct, in the scenario that they presented, it would not have prevented the FBI from tracking down the source of the videos. What the screen writers missed in their logic was the fact that the videos were live, not pre-recorded. A pre-recorded video would have been extremely difficult to track down unless the investigators knew exactly when it was seeded to the mirrors; had the video been seeded into a peer-to-peer network for distribution, it would have made the source almost impossible to find.

With live video, on the other hand, a network stream would have to originate, in real-time, from the physical location where the event is taking place. To track down the source of a live video, the FBI could have started with a single mirror of the Web site and worked backwards based on the network traffic being sent to it. As you can see from the diagram below, even if the killer hid behind multiple layers of servers, a properly trained investigator would still have been able to determine the origin of the video by tracing the network traffic from node to node.


The investigator would have used data generated from a tool known as Netflow. Netflow works by extracting information from network packets that are received by a router's interface and creating records that describe the unique flows. For the layman, flows are groups of similar packets from the same source and destination that are sent and received during the same period of time. For the more advanced reader, flows are based on the 5-tuple, which is source address and port, destination addresses and port, and protocol. Start time of the flow is defined when the first packet is seen, and an aging timer is used to determine the end time--when the router sees a new packet it resets the aging timer, if the timer reaches zero before another packet is seen, the flow is considered complete. For TCP, the end time is also determined when a session teardown is initiated with FIN/FIN-ACK packets.

The live video would have produced an easily identifiable flow that could have been used to track the network location of the creator and subsequently their physical location. With a little router command line magic, it could have been done in real-time. Whether the FBI could have mobilized fast enough to save the victim and catch the bad guy is another issue, but the bad guy would have definitely been traceable.

Untraceable, Continued

National Treasure: Book of Secrets (2007)

The second installment of the National Treasure franchise brings us more riddles that unlock clues that bring more riddles. One of these clues (or was it a riddle? I cant keep track) is a burned piece of paper that contains a partial cipher text message. It turns out that this message was encrypted with the Playfair cipher, which was created in the mid-1800s by a gentalman named Charles Wheatstone and named after Lord Playfair, who promoted its use.

By modern standards Playfair is extremely weak, but at the time it offered a relatively simple method for encrypting messages that made frequency analysis attacks difficult, if not impossible, to perform.

If you are not familiar with substitution ciphers, the simplest example is ROT-13 (or rotate 13), a variation of the Caesar cipher that creates cipher text by replacing, or substituting, each letter in a word by the letter that is 13 places away in the Latin alphabet.


Any fan of Wheel of Fortune can tell you that the three most common letter in the English language are E, T, and A. With frequency analysis, it is pretty easy to determine that R, G and N represent E,T and A, simply by the fact that they occur most often in the cipher text. You can do further analysis by looking at the common ending letters, letters that most often follow E, etc. This type of analysis is made easier by the fact the ROT-13 keeps the structure of the words and sentences.

While still considered a substitution cipher, Playfair does a couple of things to break up frequency and structure. First, the plain text is broken down into groups of two letters called digraphs. If a grouping produces a double letter digraph, or there is a single letter left at the end, a substitution character is used, typically "X," for the second letter. For example, "he departed yesterday" becomes "he de pa rt ed ye st er da yx." Second, the plain text is encrypted using a 5 x 5 table containing a key word or phrase and some relatively simple rules that encrypt the plain text with 676 possible variations per digraph, versus 25 for each letter with Caesar type ciphers. The resulting cipher text will look something like "DA EA RD SA AE WT YG AQ ET ZY."

One obvious weakness of Playfair is the fact that a digraph and its reverse will encrypt with the same pattern. From the example, you can see that "departed" has a reverse digraph, "DE" and "ED." In the cipher text they can be easily found as "EA" and "AE." Knowing that "ED" is one of the 10 most common digraphs in English you might be able to decipher "EA RD SA AE" by replacing the reverse digraphs to get "DE RD SA ED."

So, while Ben Gates was racking his brain to figure out what debt that all men pay, his unfunny sidekick Riley Poole could have easily enhanced his computer program to discover the key or simply figured it out by hand. The small amount of cipher text may have complicated his analysis, but there are only so many word combinations and digraphs that could have produced "ME IK QO TX CQ TE ZY."

CSI: NY "You Only Die Once"

With the writers of Numb3rs playing it safe this season by limiting their expedient exaggerations to areas of physics and mathematics, I was relieved to see that CSI: NY stepped up to the plate to keep me occupied.

As you may have guessed from the title, this episode deals with a band of James Bond like criminals who drive around in a high-tech sports car and fast-rope out of high-rise luxury condos. The CSI team discovers that the criminals are not looking for traditional valuables such as furs and jewelry--they are after personal information stored on electronic devices. The team surmises this while examining a coat that was taken off a man found face down in a gutter.

How did they come to this conclusion? The department IT folks called and informed the team that they had a firewall breach and someone was illegally accessing the network. Our quick-witted investigators power down the lab to contain the breach, but are puzzled when the examination table's florescent lights continue to flicker. They determine it has something to do with the jacket, so they pull it apart and find a mesh of wires connected to a MiniSD memory card.

What they discovered in the jacket was a device that can magically download information off of any device using wireless connections. The most amazing part of this contraption is that the whole thing is heat activated. I can only assume that they meant that it was powered by body heat, or other heat sources, because a device like this that only turns on when its hot doesn't make any sense at all.

A little research on my part found that a group of German researchers at the Fraunhofer Institute have created a similar generator that can produce 200 millivolts of power. But, According to our friends over at Engadget, you'd need about 1 watt to power just the processor of a modern hand held device. The Fraunhofer generator produces about 2 milliwatts. Sorry Charlie, even with the long underwear, you come up short in the power department.

To compound the power problems, you would need both WiFi and Bluetooth radios, plus a CPU and operating system that can perform moderately complex cryptographic functions. None of which I saw on the device.

I'm not sure why the wannabe secret agents needed a device like this in the first place. They were the party planners and staff, so rigging a laptop to do the same thing and attaching it under the buffet table would have been much easier, more effective, and would have gone completely unnoticed. Moreover, if you take the risk of breaking into someone's condo, you're better off attaching a USB or Firewire drive to the computer and downloading the information that way--when you are in the middle of a B&E, you really don't want to wait around for your system to crack the WiFi and then break into the computer, assuming that there are any vulnerabilities to be exploited in the first place.

As for how the lab was hacked, what they were trying to describe is an "evil twin" attack. By mimicking an existing WiFi access point, or AP, an attacker can trick a computer into connecting to a network they control. By exploiting weaknesses in a commonly used WiFi link encryption protocol, you can even mimic an AP that has encryption enabled. At that point, the attacker has a direct network connection to the computer, but would still need to exploit a vulnerability to gain access to anything on it. Technically speaking this bypasses any network based firewalls that may be in place, but does not render them insecure as they stated in the script.

If you like to learn a little more on the WEP attack, Infoworld as detailed (but non-technical) description here.

Watch CSI: NY for free on CBS.com:

CBS Innertube

The 13 Hackiest Hacking Movie Moments

Maxim Magazine has jumped on the bandwagon and created their own list of ridiculous movie hacking moments. They missed some classics, but still a good list. Checkout it out here.

Live Free or Die Hard (2007)

The latest installment in the Die Hard series has our hero John McClane chasing after a crew of hacker-terrorists that are systematically shutting down the critical infrastructure of the United States. The movie describes this as a "fire sale," as in "everything must go."

While I do not pretend to be part of the in-crowd when it comes to national security terminology, I don't recall ever hearing this term used to describe any scenario relating to critical infrastructure attacks. I suspect the screen writers just made it up.

At any rate, the action begins in an FBI operations center that makes the fictional NORAD command center from WarGames look like, well, the real NORAD command center. Even with its modern architecture and sleek interface design, the most amazing part of this set is the fact the 20-foot projection screens have relevant network security information from every U.S. government network, as well as the national energy grid--truly unbelievable.

With all of the creativity that Hollywood has to offer, I'm sure its still difficult for someone to visualized a network intrusion in a way that most people would find interesting, but showing computer screens dim, go black and then suddenly come back to life just doesn't do it for me. But this is exactly how the action gets kicked off and, without much investigation, the FBI knows immediately that it was the work of hackers. Holy crap, I thought someone forgot to pay the power bill!

So what was compromised exactly? The power supply to the monitors? It obviously wasn't the computers because when the screen can back on, there was nothing to indicate that they were compromised or had even lost power. I don't mean to suggest that a comprised system would have some sort of visual indicator, but with all that the operations center had to offer, you'd think the screen writers or director could have come up with something a little more realistic or clever, such as showing that all of the FBI's computers are sending out spam for herbal Viagra. Just a thought.

I could bore you with paragraphs on SCADA system security, or ask why someone would spend money to build a networked system that shuts off lights that don't need to be turned off, but I'll simply focus on one of my biggest beefs with this movie which is the use of what I call "magical hacking tools."

While everything in a Hollywood production is larger than life, there seems to be an obsession with showing omnipotent hacking tools with elaborate graphical interfaces which, in addition to allowing easy access to every function of extremely a complex system, can also mimic any system's GUI.

In reality, even commercial security tools do not have this level of functionality or interface design, but I don't want to denigrate the advances that our blackhat friends have made over the last couple of years with their software. Take a look at this Web GUI used to control botnets. Most corporate systems don't look this good.

Burn Notice "Pilot"

What do spies do when they've been blacklisted? According to Burn Notice, they hang around in Miami, avoid their mothers, and get advice from alcoholic ex-spies. In this "Get Shorty meets The Equalizer" one hour drama, you also learn that blacklisted spies have many useful skills that they can pull from their tradecraft to assist people who can't get help from the law.

One of these skills is using latent fingerprints lifted from a fingerprint reader to open a safe.

You might be thinking that this is something the screen writer made up to get himself out of a jam, but according to a Japanese researcher, it can be done--with about an 80% success rate. However, what was shown in this episode is an overly simplified, and slightly inaccurate, depiction of what you would actually need to do to pull it off. Let me explain.

If Burn Notice were a two-hour procedural drama, you would have seen Jeffrey Donovan's character find a non-porous surface, such as a water glass, that he knew the safe's owner had touched. Getting the print from the safe seems like a logical idea, but in reality, the size and weight of the safe would make it difficult to work with.

Next, he would use a technique called cyanoacrylate fuming to draw out the latent prints. Cyanoacrylate fuming is just a fancy way of saying you expose the surface to vaporized Krazy Glue. These vapors, or fumes, react with with the amino acids and other proteins that are left when you touch something with your fingers. This reaction forms a white sticky material that outlines the ridges of the fingerprints. This white sticky material is another reason why you wouldn't want to use the safe to get the print--you'd have to clean that sticky crap off before you left.

Once the reaction is complete, you can stain the results with colored dust and photograph them. Despite what you may have seen on those CSI shows, this process can take more than two hours and also requires the object to be placed in an sealed container. You'd probably be better off doing this in a safe place, in other words, not a house you just broke into.

Next, he would transfer the photograph to a computer, enhance it with Photoshop and print it out on transparency paper. The transparency would be placed over the photosensitive material that hobbyists use to create custom circuit boards. The material would then be exposed to ultraviolet light and washed with acid. ] The pattern that was printed on the transparency would now be etched into the board, creating an accurate mold of the fingerprint. The materials needed to do this are available at most electric hobby shops for around $50.

To create his fake fingertip, he would pour gelatin into the mold and let it harden. He could then place the gummy fingertip on his own, and use it to fool the fingerprint reader and open the safe. Nice and easy.

Someone could probably create a portable kit so that this could be done on scene, but they'd need to speed up the cyanoacrylate fuming process to make the process streamlined enough for a black bag job.

What the CIA Could Learn from Hollywood

What I learned today is that at least one of the three writers that got WGA credit for The Recruit understood the basics of how cell phones work and what data is collected by service providers, but apparently failed to portray CIA training in an accurate light. Go figure.

If you are not familiar with this 2003 yawner, it follows several young CIA recruits though their training and first covert assignments. Towards the end of their training, the recruits go out on a surveillance and evasion exercise. Prior to the start of this exercise, one of their instructors specifically tells them to "turn your cell phones off because they act like tracking devices."

Obviously this doesn't happen during real CIA training. My evidence? Two dozen CIA agents were indited in Italy for kidnapping a suspected al Qaeda agent in Milan and transporting him to Egypt. How did Italian prosecutors track down those accused of the kidnapping? Cell phone data.

Seems that the alleged kidnappers not only left their cell phones on, they actually used them throughout the operation, which allowed investigators to track them from the location of the kidnapping to the Air Force base that was allegedly used to fly the abductee out of the country.

Read they story in Congressional Quarterly:

http://www.cq.com/public/20051026_homeland.html

You can't make this crap up.