PaulDotCom mailing list archives
SNOW stego
From: pauldotcom at grymoire.com (Grymoire)
Date: Wed, 30 Sep 2009 10:08:51 -0400
The ASCII part of your message does not look like there is any
stego. I don't see any extra spaces.
The text/html base64 encoding looks like there is some stego invloved.
Here's a od dump of the tail end.
0000400 n d i n g i n e m a i l . <
0000420 b r > \n 240 240 240 240 240 240 240 240 240
0000440 240 240 240 240 240 240 240 240 240 240 240 240 240
0000460 240 240 240 240 240 240 240 240 240 240 240
0000500 240 240 240 240 240 240 < b r > L o
0000520 v e , 240 240 240 240 240 240 240 240 240 240 240
0000540 240 240 240 240 240 240 240 240 240 240 240 240
0000560 240 240 240 240 240 240 240 240 240 240 240 240 240
0000600 240 240 240 240 240 240 240 240 < b r >
0000620 I r o n g e e k 240 240 240 240 240 240 240
0000640 240 240 240 240 240 240 240 240 240 240 240 240
0000660 240 240 240 240 240 240 240 240 240 240 240 240
0000700 240 240 240 240 240 240 240 240 240 240 240 240
0000720 240 240 240 240 240 240 240 240 240 240 240 < b
0000740 r > 240 240 240 240 240 240 240 240 240 240 240
0000760 240 240 240 240 240 240 240 < b r > \n < b
0001000 r > \n 4 323 ^ < 345 356 { 341 355 374 i 335 335
0001020 { N ; 341 306 333 337 N
0001030
Current thread:
- SNOW stego Grymoire (Sep 30)
- <Possible follow-ups>
- SNOW stego Grymoire (Sep 30)
- SNOW stego Adrian Crenshaw (Sep 30)
- SNOW stego Dimitrios Kapsalis (Sep 30)
- SNOW stego Adrian Crenshaw (Sep 30)