SNOW stego

[pauldotcom at grymoire.com (Grymoire)]

> It might be interesting to see if it survives being replied/forwarded too.

It got converted to quoted-printable. So '\240' (the space character
with parity bit set) got converted into =A0

Hmm....... Just looking at the tail end of the message where the
whitespace is, I used the following filter on the quoted printable
forwarded message:

sed 's/=A0/X/g' </tmp/b |tr -cd 'X ' | tr 'X' '\240' | od -c

and got:

0000000 240 240 240     240 240 240     240     240 240 240     240 240
0000020 240     240 240 240 240     240 240 240 240 240     240 240 240
0000040     240     240 240 240     240     240 240 240     240     240
0000060 240 240     240 240     240 240 240 240     240 240 240     240
0000100 240 240 240     240 240 240     240 240 240 240 240 240     240
0000120 240 240     240 240 240     240 240 240 240 240 240     240 240
0000140 240     240 240     240 240 240     240 240 240     240     240
0000160 240 240 240     240 240 240     240 240 240 240 240 240     240
0000200 240 240     240 240 240     240 240 240     240 240 240     240
0000220     240 240 240     240 240     240 240 240     240 240 240 240
0000240 240 240     240 240 240     240 240 240     240 240 240     240
0000260 240 240 240 240     240 240 240 240     240 240 240     240 240
0000300 240     240 240 240     240 240 240 240 240    
0000314

I used 
                tr -d 'a-zA-Z,<>'| od -c
on the tail end of the original HTML message gives:

0000000 240 240 240     240 240 240     240     240 240 240     240 240
0000020 240     240 240 240 240     240 240 240 240 240     240 240 240
0000040     240     240 240 240     240     240 240 240     240     240
0000060 240 240     240 240     240 240 240 240     240 240 240     240
0000100 240 240 240     240 240 240     240 240 240 240 240 240     240
0000120 240 240     240 240 240     240 240 240 240 240 240     240 240
0000140 240     240 240     240 240 240     240 240 240     240     240
0000160 240 240 240     240 240 240     240 240 240 240 240 240     240
0000200 240 240     240 240 240     240 240 240     240 240 240     240
0000220     240 240 240     240 240     240 240 240     240 240 240 240
0000240 240 240     240 240 240     240 240 240     240 240 240     240
0000260 240 240 240 240     240 240 240 240     240 240 240     240 240
0000300 240     240 240 240     240 240 240 240 240      \n
0000315

So I think it's conclusive that it does survive forwarding