43 ms·
How to catch a spy that is using a numbers station – The KGB Experience
- Shaddox 6y agoHello everyone. This is a translated excerpt from a desecretized KGB operations manual that offers an example on how their counter-intelligence division caught a spy using a numbers station for one-way communication.
- rshnotsecure 6y agoToday we're seeing number stations move off of ham radio and onto protocols like MQTT. Additionally a lot of "weather stations" around the world are simply number stations. They vary the numbers reported, and wherever they diverge from whatever is determined in advance as the "canonical" source is how information is communicated. This paragraph and the above are just my personal observations please note. Lastly good examples of weather stations in general (not actual spying things please note) can be found here [1] and here [2]. [1] - http://weewx.com/stations.html http://weewx.com/stations.html [2] - https://joesdatacenter.com/hvac/ https://joesdatacenter.com/hvac/
- draugadrotten 6y ago> Today we're seeing number stations move off of ham radio and onto protocols like MQTT. Wouldn't a MQTT station be lacking one of the major advantages of a radio number station - that it is very difficult to know who is listening to the broadcast. Using weather reports (or obituaries in newspapers etc) are not number stations, though they can be used as covert channels.
- doctor_eval 6y agoI would have expected steganography in YouTube videos to be the numbers stations of today?
- draugadrotten 6y agoYou seem unaware of the difference between unicast IP and broadcast radio. Watching youtube is just as anonymous as a phone call, not very hard to map to a person. Youtube has a log of every IP accessing their servers and what they do, augmented by cookies and google accounts. A radio station does not know who is listening.
- macintux 6y agoConversely, unlike a numbers station theoretically only the intended recipients know which videos should contain messages. So the counterespionage personnel may be able to track who has watched one specific video, but only if they know which video to track.
- doctor_eval 6y agoYou don’t seem to understand my point. With good steganography you don’t know a message is being transmitted in the first place. It doesn’t matter which IP addresses accesses a video because you don’t know which video contains a message. Given the number of videos uploaded to YouTube, checking them all for embedded messages from a sophisticated state actor would seem to be quite a significant challenge. Even more difficult if you’re in Latvia, the agent is Russian, and the video is hosted in the USA... This approach offers a way of transmitting much more data, on demand, with very little risk of detection of either the existence of the communication channel itself, or of the recipient. The recipient could casually watch on wifi in a food court, using a modified app, while eating lunch. They would obviously need to exercise good secops, presumably as part of their trade... it seems quite a reasonable approach to me, but I’m no expert, it was just a thought.
- saffronique 6y agoThe internet can be switched off, and the websites are potentially controlled by your enemy.
- barrkel 6y agoThe way you catch the spy is apparently by monitoring sent mail and comparing handwriting. Very little of this is specific to numbers stations.
- willvarfar 6y agoBut still a fascinating account, well worth reading.
- jFriedensreich 6y agoexactly my thoughts, its like articles about serious "hacks", when the critical steps turn out to be social engineering, definitely interesting, but not what the title suggests.
- 082349872349872 6y agoI agree, but https://news.ycombinator.com/item?id=24520757 https://news.ycombinator.com/item?id=24520757 is about at least seven dozen people from three of the five eyes on one side, and someone who was infamous for "hacking" Tony Blair and Uscentcom on the other, yet nothing in any of the articles suggests anything much more technical than social engineering[1]. (Indeed, the story as written does have Hollywood MacGuffin floppy disk written all over it, in that I'd find it implausible that, even in a war zone, no one kept anything on-prem, or at least backups? At least performing a "kill -9" via Hellfire missile does upstage Stanford gangstas https://www.youtube.com/watch?v=Fow7iUaKrq4 https://www.youtube.com/watch?v=Fow7iUaKrq4 .) [1] Compare https://www.haaretz.com/israel-news/.premium.MAGAZINE-why-whistleblowers-betray-their-countries-according-to-an-israeli-expert-1.9167750 https://www.haaretz.com/israel-news/.premium.MAGAZINE-why-wh... and remember that the case of TFA starts in 1974 with social engineering via "Nadia." I'm pretty sure the Arthashastra mentions social engineering via thirst trap, and https://en.wikipedia.org/wiki/Xi_Shi https://en.wikipedia.org/wiki/Xi_Shi has a similar story. Then there's https://www.theatlantic.com/magazine/archive/2001/12/all-you-need-is-love/302351/ https://www.theatlantic.com/magazine/archive/2001/12/all-you... 's account of deradicalisation via honey trap. Q. How did Adam and Eve anticipate the twenty-first century? A. They failed to read Apple's Terms & Conditions and got in trouble for misunderstanding the Privacy Policy.
- 082349872349872 6y agoI've sometimes wondered why the Hershey Fonts have such a nice set of cyrillic vectors. Maybe making things like https://i1.wp.com/www.numbers-stations.com/wp-content/uploads/2020/09/20200224_141721-scaled.jpg?ssl=1 https://i1.wp.com/www.numbers-stations.com/wp-content/upload... is something one would prefer to do on an in-house plotter, rather than sending it out to an ordinary print shop? https://en.wikipedia.org/wiki/Hershey_fonts https://en.wikipedia.org/wiki/Hershey_fonts Edit: the bus stop has been replaced, and the kerbside tree is gone: https://www.google.com/maps/place/Druzhby+St/@55.7139414,37.5237665,3a,75y,79.32h,90t/data=!3m7!1e1!3m5!1srsOzcsVPtYRIf_3fYOQGfg!2e0!6s%2F%2Fgeo0.ggpht.com%2Fcbk%3Fpanoid%3DrsOzcsVPtYRIf_3fYOQGfg%26output%3Dthumbnail%26cb_client%3Dsearch.gws-prod.gps%26thumb%3D2%26w%3D86%26h%3D86%26yaw%3D79.316605%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656!4m12!1m6!3m5!1s0x0:0xfae7174706dad052!2sMoscow+State+University!8m2!3d55.7039349!4d37.5286696!3m4!1s0x46b54c73b2e759b3:0x4e37c4dc72181b0!8m2!3d55.7139492!4d37.5238828 https://www.google.com/maps/place/Druzhby+St/@55.7139414,37.... (it was conveniently located between an "embassy row" and a nice park with scenic overlook) https://www.google.com/maps/@55.709541,37.5422738,3a,75y,90t/data=!3m8!1e1!3m6!1sAF1QipOKxdlwq3Kkyh8vCxfq0GZmDeVyaa9vpUwSPD0B!2e10!3e11!6shttps:%2F%2Flh5.googleusercontent.com%2Fp%2FAF1QipOKxdlwq3Kkyh8vCxfq0GZmDeVyaa9vpUwSPD0B%3Dw203-h100-k-no-pi-0-ya255.63419-ro0-fo100!7i8704!8i4352 https://www.google.com/maps/@55.709541,37.5422738,3a,75y,90t...
- 082349872349872 6y agoand the dead drop location from: https://www.numbers-stations.com/articles/trigon-numbers-station-the-case-of-alexandr-ogorodnik/ https://www.numbers-stations.com/articles/trigon-numbers-sta... https://www.google.com/maps/@55.7272732,37.5479753,3a,75y,15.27h,86.72t/data=!3m7!1e1!3m5!1sG_UsSwO0t5KreO6pb35tuQ!2e0!6s%2F%2Fgeo1.ggpht.com%2Fcbk%3Fpanoid%3DG_UsSwO0t5KreO6pb35tuQ%26output%3Dthumbnail%26cb_client%3Dmaps_sv.tactile.gps%26thumb%3D2%26w%3D203%26h%3D100%26yaw%3D160.11198%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656 https://www.google.com/maps/@55.7272732,37.5479753,3a,75y,15... (unfortunately nowhere near close enough to see if the sign is still there)
- jojobas 6y agoSo, basically the answer is "expensively monitor all outgoing international mail and hope for someone as stupid as to sign his spy letters".
- kozak 6y agoIn 1970s USSR there wasn't much outgoing international mail, so the monitoring wasn't really that expensive.
- jojobas 6y agoThey weren't just quickly inspecting it, they found invisible ink on it.
- 082349872349872 6y agoOutgoing international mail sent by a nonlocal tourist might have been a quick triage signal for the local postmaster? These days, of course, our communications pass through various boxes that can automate inspections, so no need to involve wetware. Keyword search in 1960s US: https://en.wikipedia.org/wiki/IBM_7950_Harvest#Usage https://en.wikipedia.org/wiki/IBM_7950_Harvest#Usage
- 082349872349872 6y agoThe answer is that in 2020, when the median page weighs 2 MB and makes 70 requests over a dozen TCP connections, everything is a potential numbers station. I had been joking about www.duckdascism.gov in https://news.ycombinator.com/item?id=24458630 https://news.ycombinator.com/item?id=24458630 but https://news.ycombinator.com/item?id=24526075 https://news.ycombinator.com/item?id=24526075 has people who've used that channel. (for the record, ~64kbps is more than most people had over dialup in the early days of the web)
- rnhmjoj 6y ago> To intercept the agency letters sent by Filatov or to detect if he has made new places to hide or send documents, a event called “Ruby” was carried out in his work cabinet, his living place and his mailbox by using a special chemical agent. Do you have any idea what they are talking about here? I'm imagining dispersing some invisible chemical (or isotope maybe?) in his house and then looking for increases in concetrations in areas where he might have been to.
- jm4 6y agohttps://en.m.wikipedia.org/wiki/Nitrophenyl_pentadienal https://en.m.wikipedia.org/wiki/Nitrophenyl_pentadienal
- willvarfar 6y ago"Spy Dust" https://io9.gizmodo.com/how-the-soviet-union-tracked-people-with-spy-dust-1705065672 https://io9.gizmodo.com/how-the-soviet-union-tracked-people-... In SpyCatcher, Peter Wright describes contemplating a similar system to catch spies removing sensitive documents from MI5. From the book: "I was asked if there was any technical way we could prove Vassall was removing documents from the Admiralty. I had been experimenting for some time with Frank Morgan on a scheme to mark classified documents using minute quantities of radioactive material. The idea was to place a Geiger counter at the entrance of the building where the suspected spy was operating so that we could detect if any marked documents were being removed. We tried this with Vassall, but it was not a success. There were too many exits in the Admiralty for us to be sure we were covering the one which Vassall used, and the Geiger counter readings were often distorted by luminous wristwatches and the like. Eventually the scheme was scrapped when fears about the risks of exposing people to radiation were raised by the management" Peter Wright also described a radioactive agent for discovering secret writing, which may be similar to how the secret writing that tipped them off was detected on the letters to the embassy to begin with: "The techniques of secret writing are the same the world over. First the spy writes his cover letter. Then he writes the secret message on top, using a special sheet of carbon paper treated with a colorless chemical. Tiny particles of the chemical are transferred to the letter, which can then be developed by the recipient. Most developing agents make the chemical traces grow, so that the message becomes legible, and unless the correct agent is known, the message remains undetectable. But Morgan created a universal developing agent, using radioactivity, which transformed the possibilities of detection."
- kingkawn 6y agoWhat stands out for me after reading this is the number of civilian lives disrupted to carry out this operation. Whether mass surveillance or moving neighbors, the system successfully rooted out a single mole but paid little mind to the impact that doing so had on the rest of society. Short-sighted strategic excellence can conceal long term self-sabotage and risk.
- pps43 6y agoI expected to see something along the lines of vans with directional antennas driving around Moscow listening for spurious emissions from local oscillators of superheterodyne receivers 465 kHz away from the number station frequency, as in Operation RAFTER.
- saffronique 6y agoInteresting, some I've some googling to do!
- jacquesm 6y agoAny radio that uses a mixer is also a transmitter.
- pps43 6y agoOnly if it's poorly designed (leaks local oscillator frequency back into antenna) and not shielded. Modern receivers use quadrature sampling detectors rather than traditional superheterodyne. In that setup any leakage would be on the same frequency and harder to detect.
- jacquesm 6y agoIt is as good as impossible to run an oscillator based receiver that is also connected to an antenna that does not radiate. That's nothing to do with poor design, it's just physics. Zero coupling does not exist in practice. By design the mixer stage sits pretty close to the initial amplifier and it will result in some of the oscillator energy making it back to the antenna circuitry. FWIW I built a ton of transmitters and radio gear in my teens, it is pretty easy to take a theoretical stance here and declare that anything that leaks is not designed properly but that's about as 'true Scotsman' as you could get.
- giantrobot 6y agoNote also with a highly directional high gain receiver that tiny bit of radiating energy is very detectable. It's just going to feed into background noise for most receivers so no one cares. But it will be detectable by a motivated hunter with the right equipment.
- sandworm101 6y ago>> When Filatov was at work, the operative workers infiltrated his apartment and installed technical surveillance resources for video surveillance and photography. 1977. Video equipment was VERY different then, especially on that side of the iron curtain. It would have had moving parts, motors, probably requiring a degree of soundproofing. I want to see pictures of where/how they hid this stuff because it wasn't easy.
- formerly_proven 6y agoPerhaps it is lost in translation, but video isn't film. So video surveillance probably means they placed a video camera (probably based on a video tube) and ran cables.
- sandworm101 6y agoLol. Kids. Video is certainly not film, but once upon a time was regularly recorded onto magnetic tape running over reels (google "VCR" or "VHS"). Still photography also used moving parts. Things like shutters would make audible clicks when exposing the photographic film, which then had to be moved out of position mechanically. That "click" noise on your iPhone camera is actually designed to mimic this ancient camera technology.
- vageli 6y agoCCTV has been around since the 40s.
- jacquesm 6y agohttps://en.wikipedia.org/wiki/Video_camera_tube https://en.wikipedia.org/wiki/Video_camera_tube
- smogcutter 6y agoThe tape deck would’ve been a separate unit and could be kept anywhere you could run a cable to. It’s clear that the poster you’re condescending to understands this.
- JulianMorrison 6y agoMorals of the story: 1. Do not try to sneak stuff past the Russians in invisible ink. 2. If you are a spy and your friendly neighbours suddenly have to move, consider taking an unscheduled vacation in GTFO.
- jmnicolas 6y agoThe way I see it: don't spy. You will get caught and the third party won't even reward you if you make it alive. After release he demanded compensation from the US embassy, but was denied as a non citizen.
- jonshariat 6y agoAgreed it seems the only reason to do it would be as a service to you nation or political ideals.
- SpaceRaccoon 6y ago> To compensate this issue a new optic surveillance system “Negus” with 300-400 meter range that was capable of detecting, when objects entered the house, what he did in the stairway and some of the main areas of his apartment. Seems like the "Negus" device is a photo-camera with a large magnifying attachment, sturdy base, stereo viewfinder, and knobs for focus. I found a description and some pictures here: http://ussrphoto.com/Wiki/default.asp?WikiCatID=46&ParentID=1&ContentID=1273 http://ussrphoto.com/Wiki/default.asp?WikiCatID=46&ParentID=...
- LordRen 6y agoNice one.
- yborg 6y agoTo me the most remarkable thing about this story is that the KGB was apparently stymied for an extended period by the fact that Filatov had a "difficult" lock of "foreign origin" on his apartment door, to the extent that they had to steal and copy a key carried by his wife using an elaborate setup. It seems odd that an agency known for its skilled spycraft apparently was unable to pick a door lock.
- sciurus 6y agoI'd guess the problem is if you spend a long time trying to pick a lock in an apartment building, it looks pretty suspicious.
- godelski 6y agoWell if you watch videos like Lockpicking Lawyer they make it seem like a skilled person can open a typical door in a few seconds. Though he's probably pretty experienced compared to even the average locksmith or spy.
- R0b0t1 6y agoIf you learn a lock you can open it quickly when pressed, but most pick-resistant locks are quite troublesome to open. If you can't bump the lock or use a pick gun and the area is not secluded it may not be reasonable to pick the lock.
- Tanath 6y agoAnd I think that's the issue. It was a foreign lock they weren't familiar with so didn't have one to practice on. It was apparently easier to copy the key.