This article smells very bad. Lets take a sniff…

Al-Qaeda group’s encryption software stronger, security firm confirms

By Ellen Messmer
Network World
02/01/08

Shame on you for propagating this nonsense.

Al-Qaeda support group Al-Ekhlaas has improved the encryption software it now provides to its online members, according to one security researcher who examined the software, known as “Mujahideen Secrets 2.”

Al-Qaeda support group, also known as ‘NSA’.

Anyone who is smart enough to know how to write an encryption algorithm and a package to deliver its functionality, and who is responsible for keeping people secure, knows that it is far better to use an off the shelf set of tools rather than build your own application and algorithm from scratch.

If ‘Al-Qaeda’ was real, and someone in their group knew about encryption, all they would need to do is settle on standard tools to keep their communications secure; they would never risk, or waste time trying to create from scratch, using their own proprietary system.

Mujahideen Secrets 2 has added the ability to encrypt chat communications, which the first version lacked, says Paul Henry, vice president of technology evangelism at Secure Computing. Henry says he got the software through a contact in the intelligence community.

OH REALLY??!?!? a contact in the ‘intelligence community’???!!!!

It is OBVIOUS to even the most casual observer that the way to infiltrate a group like this, that is paranoid about security, would be to infiltrate them and then provide them with a ‘secure’ way of chatting that logs all of their communications. You could do this even if the clients were secure; all you would need to do is control the chat server.

I assure you that all of the people, even those that are casually interested in cryptography understand this. They would immediately recommend open source publicly available tools to do this job. For example, if you want to have one to one encrypted chat, you use Adium. If you want encrypted email, you use GNU Privacy Guard. If you want to shred files, manage keys, recipient keys, encrypt attachments and files there is no better tool than Enigmail. Any tool that is not peer reviewed cannot be trusted. This tool, by its very nature, is untrustworthy; this whole story doesn’t sound right.

The home-grown Mujahideen Secrets 2 encryption software, based on open source RSA code, can encrypt binary files so they can be posted on ASCII-text-based bulletin boards and Web sites.

‘Pics or it didn’t happen’. Without looking at the source of this programme, it is impossible to say how good this software is, and once again, there are other, better more secure tools to do this.

Lets think about the sentence above. If you are going to post an encrypted binary on an ascii bulletin board, you need to encrypt it to the members of that board, using the private key of each member. If you cannot control who is on your board, i.e. you have a single infiltrator, your enemy will have access to the file and the list of recipients. The whole point of posting files on a board is to distribute them widely, and so you do not want to encrypt them in this way; if you want to send encrypted binaries to multiple people, you send the file by email, encrypting the file for each recipient individually. Once they get on your board in the scenario provided by this ‘journalist’, your enemy can get a hold of the file, at any time after it was posted, and then list the keys needed to decrypt the file, giving a list of all the nicknames of the recipients of the file. Sending

“They have improved the operation of the graphical user interface and it will now encrypt chat communications,” says Henry, who adds that the Arabic translation suggests the software is encouraged for use by Al-Ekhlaas members to evade U.S. government efforts at surveillance.

This sentence is the exact OPPOSITE of what the truth is; it is software encouraged by U.S. government to aid its efforts at surveillance of Al-Ekhlaas.

Tampa-based ISP NOC4Hosts and Rochester, Minn.,-based SiteGenesis in January found out their operations were being used to host the Al-Ekhlaas Web sites where Mujahideen Secrets 2 can be found. Both hosting firms pulled the plug on the Web sites after receiving specific technical information about the content.

From whom?

This week another Web hosting company, CrystalTech Web Hosting in Phoenix, shut down sites linked to the Al Qaeda-link support group.

Once again, these people could, if they were real, host their websites anywhere in the world. They would not host thier sites in Minnesota or Pheonix. This is just utter nonsense of the first order, and those sites were most probably ‘honey pots’ set up to get this Back Orifice ‘Jihad Edition’ into the hands of dweebs that want to help the CIA operaton ‘Al-Qaeda’ who they will then use as patsies to carry out false flag attacks, all under the guise of ‘Radical Islamo Facscism’.

“As soon as we found out, we brought the IP sites down,” says Bob Cichon, president of CrystalTech Web hosting, who blamed a reseller for it happening. “We’re a very large host and it’s hard to track everything.”

Its not your fault Bob.

In its analysis of Mujahideen Secrets 2, Secure Computing has noticed that the software appears to violate copyright law.

“Typically with open source, they still require a copyright notification,” Henry says. “There’s no copyright notification whatsoever here.”

So, the latest supercrime of Radical Islamo Facscists is not blowing up buildings and making them fall in defiance of the laws of physics, NO, we can prosecute them for violating the GPL.

Another notable thing is that the public-key signature in Mujahideen Secrets 2 leaves a tell-tale sign that the Al-Ekhlaas home-rolled software produced it. The encryption itself is strong at up to a 2,048-bit key length, and like the previous version, provides e-mail and file encryption using public-key certificates.

All contents copyright 1995-2008 Network World, Inc

http://www.networkworld.com/news/2008/020108-al-qaeda-encryption.html

Once again, if any of this is even true, there are only a handful of people who are capable of understanding how to best fulfill the requirements of encrypting chat and instant messaging, and then the subset of people who can actually pull this off in a software client is even smaller. No one in their right mind would do this in a ‘home-rolled’ package…unless your home is the NSA.

Everything that this journalist claims could be done with off the shelf packages, and in fact, it would be safer to do it with off the shelf packages.

Lets say that the above report is true, and these packages are out there. The only way you can know that the package has not been tampered with is if you can check the signature against it. GPG does this so that you know that you are getting an un-tampered with binary or source. Publicly available tools give you a high level of confidence that your communications will not be susceptible to a ‘man in the middle attack‘. By settling on those tools, rather than rolling your own, you get a higher level of trust. And everyone who understands how this works knows that.

Rolling out your own tools, from whatever angle you look at it, is insane. It is clear that this whole story is a glimpse into some secret operation to recruit patsie jihadies. In that respect, it is fascinating.

What will be even more interesting is to read a report from a trusted peer, who would, amongst other things, run a packet sniffer to see if and where this sneaky piece of infiltration-ware phones home.

Is this a warm up article for another attempt to crack down on freely available encryption tools?

This entry was posted on Tuesday, February 5th, 2008 at 10:48 am and is filed under Bollocks, Geekn, Insanity, Software, Someone Stupid Said, Strange, Tools.