From: "Brian B. Riley" <brianbr@together.net>
Date: Tue, 22 Sep 1998 17:03:24 +0800
To: "Jim Choate" <cypherpunks@einstein.ssz.com>
Subject: Re: Stego-empty hard drives... (fwd)
Message-ID: <199809222204.SAA28569@mx01.together.net>
MIME-Version: 1.0
Content-Type: text/plain



On 9/22/98 1:43 PM, Jim Choate (ravage@einstein.ssz.com)  passed this 
wisdom:

>Forwarded message:
>
>> Date: Tue, 22 Sep 1998 11:07:34 -0500
>> From: Petro <petro@playboy.com>
>> Subject: Re: Stego-empty hard drives... (fwd)
>
>> 	I don't know how hard this would be, but how about running a
>> seperate memory check, and while those numbers are flashing on the screen,
>> do the wait for imput?
>
>So hide the keyscan in the memory counter code. Would work externaly, would
>probably not show up on TEMPEST. Since both the keyscan and the memory scan
>are repetitive TEMPEST might have a problem telling them apart. Provided you
>could get the keyscan in the same footprint as the mem check the BIOS
>would not show up as anomolous in size. As long as they're not running
>around doing checksums you'd be ok (I suspect).

 Don't most memory scans do a keyscan anyway? looking for an ESC to 
bypass the scan? So have it also check for something else to bring up 
your special routine. It should pass all but the most detailed signature 
analysis.


Brian B. Riley --> http://members.macconnect.com/~brianbr
 For PGP Keys  <mailto:brianbr@together.net?subject=Get%20PGP%20Key>

 "Give a man a fish and you have fed him for a day, but give him a case
  of dynamite and soon the village will be showered with mud and
  seaweed and unidentifiable chunks of fish." -Joe Chew