~ Essays ~

				essays

(Courtesy of fravia's searchlore.org)

---

Searching scarcity: Steganography and just-in-time info on the web

by Jeff

slightly edited by fravia+, published @ searchlores in December 2001

---

Coupla months ago, helding another seminar in Brussels for EU-officials, I explained that knowing how to search the web is of paramount importance, inter alia for all those 'rootgrass' organisations of the 'civil society', desperately trying to save or ameliorate a world that has -alas- been left hostage of the big commercial corporations and their lobbies (with the corresponsability of all local, national and european administrations).
Somebody asked for an example of 'civil society related' search, and in that very moment a noisy jet passed over the town. A classical example: those that make their money with transports (and airports) couldn't care less about disturbing a million people (nor about killing somebody, think at all the risks connected with planes flying over densely populated areas) whenever the fly routes allow them to spare a few bucks and the political lackeys are so corrupt to stay mum.
So we searched, and we quickly found among other things this document... the public was duly impressed :-)
The reason of this lenghty introduction is to have readers remember that we are not just 'seeking for the sake of it'. Armed with the techniques and approaches we seekers are able to teach, rootgrass organisations may dig out of the web all sort of appropriate documents and information and counter many an evil deed and plan. Indeed transparence is a powerful democratic weapon in a society that is getting more and more oligarchic. This essay moves along this path: but ~S~ Jeff will show you not only how to find, on 'civil society' request, an useful -and hard to find- document, but also how to hide it again :-)

Hi fravia+

Well as you know I can't write essays; I shouldn't have called it
'essay' at the board; It's, rather, just my notes.

In Search of Scarcity :)

The Target is a Paper that Forseti was looking for, named: "Water Scarcity in the Twenty First Century"

This search came about in a thread at ebenezers when forseti posted that he would like a particular article that he still had not had time to find :) In addition GoW was looking for a project to do for xmas, and fravia+ suggested a searching project.

Several of us went on the hunt (and you will find some great links and ideas in the minds of the searchers as they looked for this article in the thread above)
After what seemed a long weekend, and many attempts, using many combinations of search terms gathered as I read hundreds of pages... I finally brought up what I was looking for.

I found it... and I decided to hyde it inside an image

After I found it, it suddenly occurred to me that its exposure in
google was not so forthcoming (it was that, or people just were not
spending as much time on it as me, and hense it just hadn't been found
yet :) So since a searching project had been mentioned, i thought to
make it a little bit more interesting, since the document lay buried in
several legs of a journey.

I decided to take what +mala, Alice, dan, and harlequin had taught me,
and wrap the search into a color puzzle for all those participating in
the document search.

I wanted to keep this very simple and very exposed to viewing; this is
not to say that for peoples unexposed to this type of handmade color
stego scheme that it would be simple; but i figured it would be
fairly easy for some.

handmade xmas gifts

this is a handmade 'color stego' puzzle.
(thanks go to Harlequin for patiently teaching me one way to write this
variation in a different image)

The target image is here: santa1.gif

tools needed:
uedit or peek
Paint shop pro or a paint program
ascii chart

time needed: about 5-10 minutes depending on your familiarity with the
tools

After doing a search for santa, [since it was a xmas search project
after all] it occurred to me that if my project was to involve a 'stego'
of a sort, then one of the first things to come into someones mind,
after the teachings at the fortress stego pages, was that they would
think that they would need to 'compare' my image to an 'original
image'...
That is not so in this case... it is possible to break this handmade
steg without the original... but
For those who might take that thought path I decided to take some more
teachings from searchlores to make that a possibilty for them.

From image searching we have learned to try to identify the time period,
the country, the style, the dress, etc of the image subject... so in
this case i tried to make the santa an identifiable search subject;
rather than happazardly scanning thousands of santa image returns...
I picked russian... doing an image google search of : russian santa
you would have been able to locate this santa image. Although i
slightly changed the file name so it wouldn't make it tooooo easy, the
pixel size is the same, although the content lenght has changed :) ...
So if you want to compare the 2 files and find the changes; then thats
one way to do it.

a few other ways to bust this without finding, and using, the
original:
download and save the gif

Now one of the things that I have recently learned is that a gif file
has a set file size found in the header area; this means that you can
add anything on at the very end of a gif file without it interfering
with the gif file itself on execution.
It also means that if you decode the file size header and it says it
contains 100 bytes; but, if your file size properties menu tells you
that the file size is 120 bytes .... hummmm, you better look deeper

If you open this gif file in uedit, for example, and hit ctrl+end (or
scroll to the end)
you will see that I left you a clue in text...
[note: if you do not have a hex editor, or uedit specificaly, you can
always RENAME the gif file too .txt and open in notepad...
scrolling to the end you will find the same message]
the message reads:
Peeking R you? :) Follow the Light !!
[Peeking was another clue but thats for another explanation below]
Follow the light!! ... was hopefully to ZERO YOU in on looking at
the lantern light in the santa image.

If you open in paint program (paint shop pro is what I am using) and
Magnify that lantern greatly, you will very quickly see an area in the
latern at the top that has a very unusal color string that seems to be
foreign to the picture and out of place... (if you have found the
original you will know immediately it doesn't belong there, and, so it
must have been added :) I could have disguised it much better but I left
it out in the open ... its my intention for you to have fun doing this
and not make it so tough that it wasn't any fun... I perfer hansel and
gretle trails :)

So, what does the color string mean?
The pixels are made up of different colors generated by the RGB Values
in a color pallette; obviously the RGB colors that used to inhabit the
co-ordinates of this area have been changed... but to what??? :)
(I am not going into HOW TO create this string) but in psp (if you have
it) take your eyedropper tool and place it on the first pixel color, in
the string; at (314, 133) ... look over at your RGB values (depending on
your version) ...
what do you see in RGB?

R=70
G=111
B=108
the combination of these 3 colors produced the color of this first
pixel... note down the values

place the eyedropper on the second pixel color... look to RGB
R= 108
G= 111
B= 119

do you have an idea of where we are going with this yet???
How to decrypt it?
take out your ascii chart.... what does dec 70 equal?

       70= F
      111= o
      108= l
      108= l
      111= o
      119= w
      

I leave the rest of the color string message for you to decipher...
follow it to a place that can tell you where to locate the elusive
document...and when you get there you may find that you have some
further work to take you way back in time :)

Exposure number two:
This color string can also be read in another way, though you will never
see the color string text in its gif form.
Open the gif in psp
you'll note it is in 8 bit, 256 colors (harley explained to me why this
next proceedure to read the hidden text cannot be done in 8 bit but I
forget because i really didn't understand it) but the gist of the matter
is that to produce what we want to be able to see, and read, we must
convert this gif to 16 bit.
we can do this by 'increasing colors' to 16 million, and then we Must
SAVE the 16 bit file as a .raw file.

Now when you have the santa1.raw file, a very convient tool to have and
use is PEEK... right click the raw file and choose peek... it
produces/generates/ a nice txt file with the color string converted to
TEXT--- scroll til u see the text that seems to make some since to you
:) ... Follow ----

**********
if you are still working on the above proceedure donot read beyond this
point unless you want it spoiled for you.

**********

Finding 'just in time' info on the web

Target/Signal/Task: The Paper "Water Scarcity in the Twenty First Century"

I have tried numerous keywords (and by watching the lists that come up
to the top that have not been clicked on previously) I continued to look
into all the returns looking for quotes, or for an ellusive 'old
url address link'...
The search brings up many many many great articles on world water
papers... but alas the great majority of the returns are of the
reference index type for the specific query, with no direct links other
than vvf's password protected source site.
(anybody bust that one yet?)

finaly this search: intitle:Water Scarcity in the twenty-first
Century
gave me these returns:
Water+Scarcity+in+the+twenty-first+Century

its simplicity staggers me, after all I have used The Title of this
paper over and over in my searchs and this url (below) never seemed to
come up.
but using the term: intitle: reveals several I haven't clicked on
in the last 3 days :)

links 1-2 don't seem relevant at a glance
links 3-4-5 i had already previously looked at (highlited red)
so
the 6th link, worldbank.org ---would--- give up the ghost...
(in fact worldbank.org has its own search engine and inputting The title
of the paper (with exact phrase) generates a page return with 2 links with the title "Water Supply and Sanitation at the World Bank" that go to topics/economics.html

oh great; just plain old fashioned sheeee-it... i just know its going to
be another one of those damned referenced index pages when I click on
it... arrrrgg..
but my hair stands up on end
on this economics.html page at bottom (FINALLY) the reference area has a
URL address!!!!... this is what I have kept my eye peeled for; FINALLY!,
for even if it is a dead link there are still a couple of possibilities for accomplished searchers:
1. The dead link may have been archived at archive .org
2. Someone may have kept the file name the same, and a search of the
filename may produce it elsewhere.

the ellusive link on this page is:

Water Scarcity in the Twenty-First Century
Seckler, David, David Molden, and Randolph Barker, International Water
Management Institute, 1999.

...and the dam link--- is indeed 404

but, the first try at the wayBack machine webarchive produces the
prize!! :)
http://www.cgiar.org/iwmi//WB1Cover.htm

Water Scarcity in the Twenty-First Century
[I must say though...my heart skipped a beat when the page came UP...
YEsssssss there it was!!!! Then my heart stopped !!!, for all I saw on
the Page was a few sentences....!!!!! I sat stunned for several moments
in defeat... and then I noticed the LINKS at the TOP of the page ...
wheeeeeew! :)

...so WB1Cover.htm == Water Brief 1

now that we have a filename lets see if anyone has published
it...inurl%3AWB1Cover

nope... thank goodness for webarhcive :)

the page has 7 links and only 5 work... the maps and tables links were
not archived by archive.org... :(

but i had a thought... the address contains a DATE in the
URL...19991103164511
Nov. 3rd 1999 (I am not sure what 164511 is?)
so I changed it to 19991103 and viewed it/ only one return... then had
another thought that it was only giving me a return FOR Nov 3rd
so i changed it again to read only /1999/
this produced three updates for the whole year here:

1999*hh_/www.cgiar.org/iwmi/WB1Cover.htm

but earlier archives didnt have the maps and tables pages either ...I
assume that webarchive just doesn't grab that type of stuff then...
(haven't checked but its probably stated in the FAQs page )

on further checking for tables and maps ...googles image search for
Scarcity.gif did not seem to bring up the specific pages i wanted for
the missing links... however forseti wrote me and said:

...snip...
And here's where it get's interesting... the link to the maps -
'Scarcity.gif' - has yielded some interesting leads including this one
from google's images:

href="scarcity.gif

And check this one out!

href="waterbook intro

A 'waterbook':

and holy shit, we found water maps and tables forecasting the 21st
century!

forseti

unsnipp...

*********
... so I figure even if they aren't the correct ones (??) ...he knows if
they are close enough and his excitement means they are close enough for
horseshoes :)
thasss all
jeff
12-10-01

Bk:flange of myth 
(c) 1952-2032: [fravia+], all rights reserved