Note, all links are shortened via Adf.ly This is a new policy here because… well I need money (you know to eat, pay for my internet connect etc.) Let me know via the comment if you strongly object to that.
If you’re interested in cryptography and/or security related events you may have come across the news that the PR arm of Al-qaeda (AQ), the “Global Islamic Media Front” have released an plugin for the popular open source chat client, Pidgin. The client uses the RSA public key cypher to encrypt messages send (and decrypt messages received) via pidgin.
I thought I download and have a look at this plugin (mostly so I can play with IDA and hopefully find a nice little hole in it }: ). Below is a initial quick review of the plugin.
Download it from the GIMF (Warning dodgy terrorist site)
Download it from MEGA
While the virus total report for the installation file reported it as fine, I wasn’t about to run the risk of installing something nasty on my machine by mistake. So I used a great little application called Universal Extractor to unpack the installation file and access the plugin dll.
Not the first.
Asrar Al-Dardashah isn’t the first public key crypto plugin for Pidgin and initially I thought it was just a re-packaged version of Pidgin-Encryption a project last updated in 2010. However doing a binary diff between the two plugins shows their quite different however Asrar Al-Dardashah does appear to use some of the same code as Pidgin-Encryption.
Not the best.
One of the worrying things about Asrar Al-Dardashah is the amount of debugging information that’s dumps from it to the user’s hard drive.
When you consider it’s designed to be used by people committing very bad acts do you think it should be logging when it’s decrypted something
Information about the key you’ve just deleted (I think it’s the user’s name but it may be the key signature or even the key itself)
Yet another crime!
Pidgin makes it very clear, *ALL PLUGINS* (even ones written by islamofashists) need to be released under a GPL or compatible license, (this is why I can re-distrbute the plugin). Now clearly a breach of the GPL is hardly the most serious crime that AQ has committed, however if the police do catch the people involved in the Global Islamic Media Front and can’t do them for a terrorist offence they can be done for a licence violation.
Where next?
There is still a lot of work to do in looking at this plugin, including looking at some very interesting data (primes, hashes and what looks like an S-Box) stored within the code. I’ll be sure and report back what I find.
Note, all links are shortened via Adf.ly This is a new policy here because… well I need money (you know to eat, pay for my internet connect etc.) Let me...
