PaulDotCom mailing list archives
SNOW stego
From: pauldotcom at grymoire.com (Grymoire)
Date: Wed, 30 Sep 2009 10:32:09 -0400
It might be interesting to see if it survives being replied/forwarded too.
It got converted to quoted-printable. So '\240' (the space character with parity bit set) got converted into =A0 Hmm....... Just looking at the tail end of the message where the whitespace is, I used the following filter on the quoted printable forwarded message: sed 's/=A0/X/g' </tmp/b |tr -cd 'X ' | tr 'X' '\240' | od -c and got: 0000000 240 240 240 240 240 240 240 240 240 240 240 240 0000020 240 240 240 240 240 240 240 240 240 240 240 240 240 0000040 240 240 240 240 240 240 240 240 240 240 0000060 240 240 240 240 240 240 240 240 240 240 240 240 0000100 240 240 240 240 240 240 240 240 240 240 240 240 240 0000120 240 240 240 240 240 240 240 240 240 240 240 240 240 0000140 240 240 240 240 240 240 240 240 240 240 240 0000160 240 240 240 240 240 240 240 240 240 240 240 240 240 0000200 240 240 240 240 240 240 240 240 240 240 240 240 0000220 240 240 240 240 240 240 240 240 240 240 240 240 0000240 240 240 240 240 240 240 240 240 240 240 240 240 0000260 240 240 240 240 240 240 240 240 240 240 240 240 240 0000300 240 240 240 240 240 240 240 240 240 0000314 I used tr -d 'a-zA-Z,<>'| od -c on the tail end of the original HTML message gives: 0000000 240 240 240 240 240 240 240 240 240 240 240 240 0000020 240 240 240 240 240 240 240 240 240 240 240 240 240 0000040 240 240 240 240 240 240 240 240 240 240 0000060 240 240 240 240 240 240 240 240 240 240 240 240 0000100 240 240 240 240 240 240 240 240 240 240 240 240 240 0000120 240 240 240 240 240 240 240 240 240 240 240 240 240 0000140 240 240 240 240 240 240 240 240 240 240 240 0000160 240 240 240 240 240 240 240 240 240 240 240 240 240 0000200 240 240 240 240 240 240 240 240 240 240 240 240 0000220 240 240 240 240 240 240 240 240 240 240 240 240 0000240 240 240 240 240 240 240 240 240 240 240 240 240 0000260 240 240 240 240 240 240 240 240 240 240 240 240 240 0000300 240 240 240 240 240 240 240 240 240 \n 0000315 So I think it's conclusive that it does survive forwarding
Current thread:
- SNOW stego Grymoire (Sep 30)
- <Possible follow-ups>
- SNOW stego Grymoire (Sep 30)
- SNOW stego Adrian Crenshaw (Sep 30)
- SNOW stego Dimitrios Kapsalis (Sep 30)
- SNOW stego Adrian Crenshaw (Sep 30)