PACTOR - The mediator

It was during summer 02001. I went to see my sister that was working for an NGO in Ikonda, Tanzania, there, at the Wakinga Mountains.

At that time I was an IT student and got quite surprised about how they were able to receive emails in a place where there were not even telephone lines (do not talk about cell phones).

She explained me that they were using a device called PACTOR, some kind of modem to transmitt data over RF. But nobody in Ikonda was able to explain me how it worked exactly. Somehow it came to my mind the other day and I wondered about the security of the system. How secure could it be if RF signals are, by definition, broadcasted? For sure there was a method, so I decided to do some research.

PACTOR systems are an evolution of AMTOR and Packet Radio. They use Frequency Shift Keyed modulation (FSK) with CRC error correction and automatic repeat request (ARQ) to stablish a reliable link-to-link connection between two radio stations even though they can eventually, use a data broadcast mode if necessary.

It is mainly used by Marine operators and amateur radio operators in remote locations, as my sister was. Besides the computer, the PACTOR modem and the radio, it is necessary to contact a service provider to gain access to email (the most popular use case) or any other data service. There are several companies providing this all around the globe.

Don't forget to send me an email!

PACTOR has evolved during the last two decades. PACTOR I (1989) has the worst performance of the family, but still in use because it is an open technology and the most economic. PACTOR II (1995) and PACTOR III (2002) are great improvements on the same idea and much more efficient, but they are still propietary technologies. It is possible to upgrade from II to III just by a software update. All PACTOR systems are compatible and, if someone is interested, I have found a very good description and comparison between all types.

So, what about security?

If a user is concerned about privacy in their emails or other data, he can use two main methods:
· To stablish encryption in the link using the modem's firmware. This method is not so widely used, as it requires more resources.
· Use PGP or other encryption methods at both ends to protect the information itself.

Nothing we could not have thought about, right? But learnt some things in between to share with you. ;)

Luis Tarrafeta
S21sec labs

Note: Great thanks to Martin Clas (SCS) for his kind answers to my questions.

Time Series

Time series analysis is a very interesting area of reserch in many current subjects and, obiously, it is also very interesting in computer security. This kind of series can be used, for example, to protect the corporate image, to obtain behavior patterns, etc..
Time series are defined as a set of observations uniformly ordered throughout the time. One of the many ways to categorize this type of series is according to the number of random varibles used to obtain of the model:

• Univariate: The time series are described by means os a single random variable (e.g. The evolution of petrol price).
• Multivariate: The time series are described by means of more than a random variable (e.g. The creation of carbon dioxide (CO2) according to carbon and oxygen concentration).

On the other hand, time series are formed by the following elements:

• Trend: It is a component of the time series that reflects its direction in a long period.
• Seasonal variables: It is a component of the series based on the oscillations that occur around the trend. This kind of variables are repetitive in a short-term periods over the time.
• Other fluctuations: Components of the series which takes the residual values of which are not explained by either the trend or seasonal variations. This component may or may not have a random behavior.
  

Something which is really interesting in the time series analysis is the possibility of forecasting the future values. Time series analysis and forecasting can be performed by means of several algorithms including regression (the simplest), the Holt-Winters algorithm (forecasting of time series based on the decomposition of the series) or the Box-Jenkins methodology.


Other current techniques for time series analysis and forecastig are, for instance, wavelets, segmentation based on patterns to forecast chaotic time series, or the identification of anomalies in time series based on dimension fractals difference on the serie, for example, identifying anomalies in the time serie calculating it distribution over space (along with their microfluctuations), Minkowski-Bouligand dimension, and comparing it with the new data in the time serie, Procacci-Grassberger algorithm. This last technique, based mainly on the chaos theory, derived from physics, which is in continious evolution.

Aitor Corchero Rodríguez
S21sec labs

HAR2009 (II)

This week at Thursday the doors will open for HAR2009.

Not only the program of the talks is very promising, but also the growing amount of self-organized workshops and projects seem to be lots of fun.

One can learn about microcontrollers and build a LED-Cube, get into reversing MacOS or just go for a talk in one of the various and also themed Villages.

If you want to test your skills, you should sign for the Kaminsky Challenge where you have to take over the DNS system in three levels. Or take part at Capture The Flag - a combat of different teams which try to hack the system of other participants in order to gain points and take over the leading flag.

To keep yourself up2date about whats going on @har2009 twitter will be a good choice.

See you there!

Clemens Kurtenbach
S21sec e-crime