According to Wikipedia [1], ‘dead drops’ are a type of espionage tradecraft which allow individuals to exchange items and information without compromising operational security. They are a passive type of communication which allows people to hide information in plain sight, both physically and on the internet, with the intention of it being picked up at some later time.

The idea has been popularized in mainstream entertainment for a long time, and thanks to technology it has made a resurgence recently with things like the Piratebox [2] and USB dead drops [3], although the prospect of plugging a device into a random USB drive sticking out of a wall doesn’t sound like a good security choice (especially with the BadUSB exploit [4]).

Another low-tech passive communication example we saw in 2014 was when the Turkish President Abdullah Gul tried to block social media sites across the country [5], and the resultant pushback by citizens, who spraypainted instructions on walls for how to bypass the censorship [6].

There are also many more interesting ways in which people can communicate using digital dead drops - potentially allowing them to bypass surveillance completely:

NEAR FIELD COMMUNICATION

Reddit user /u/mofosyne/ recently posted a link to a prototype NFC Message Board android app they made [7] (Source code [8]). It allows people to place cheap, often water resistant NFC tags in pre-defined public places so those wanting to communicate can post and receive short messages to the chip using their smartphones. The messages are currently only plain-text, but there is scope for future development with encrypted signatures in larger capacity NFC tags.

The really cool thing here is that you could basically fit these NFC tags into tiny cracks in walls and behind almost anything, and it’d still function. Since the NFC tags need no external power supply, they can potentially last a very long time.

FILE STEGANOGRAPHY

Steganography [9] is basically the act of hiding information inside other information so that it is concealed in plain sight.

One of the most used steganography techniques is employed by many printer manufacturers. Every time you make a printout, tiny yellow dots are included on the page that are invisible to the naked eye, allowing for various types of information to be embedded.

This makes it perfect for secret communications. For example you could set up an account on imgur, posting your favourite cat pics and gaining reputation and legitimacy. All you would need to do is tell the recipient to follow your account and you could upload images with encrypted messages inside the image code. Everyone outside the involved parties would be oblivious.

In fact this already happens, just we don’t often hear about it. In 2010, the FBI alleged that their Russian counterparts were using steganography to hide text messages inside images [10]. It’s not just the reserve of spies though. Developer Josh Lindsay created a PHP program named “BuriedUnderTheNoiseFloor” [11] which compresses, encrypts and hides messages inside PNG files.

BLOCKCHAIN STEGANOGRAPHY

What happens when you take that a step further and distribute steganography? The Bitcoin blockchain provides a way to hide information inside a distributed, immutable ledger. There are already a few different ways to add information directly into the ledger [12] [13] [14].

You could also do something else like sending tiny transactions to a specific address and having the numbers relate to a predefined cypher which changes it to a text message. There’s also a Bitcoin blockchain IRC idea [15].

These kinds of systems would have various advantages:

- The transactions will just look like ordinary Bitcoin transactions on the blockchain
- Your internet traffic only shows Bitcoin traffic
- You can download the full blockchain locally and query it for messages offline, leaving no footprint
- If the broadcaster has secured their keys correctly, anyone reading can be 100% sure that the messages are legitimate.
- Since the ledger is open and distributed, you can access your messages on any platform or device, anywhere.

BITMESSAGE BROADCASTS

Bitmessage [16] is a distributed message platform that allows you to send and receive encrypted messages without email/chat service providers. When you send a message, it broadcasts it out to a pool of messages in the network and can be collected by the recipient at a later date. This means both the message content and meta data is private.

There are also services like DarkLogs [17] created by Adam Thorsen which allow you to anonymously create and update a blog using Bitmessage. You just send a message to the darklogs address and it automatically pushes it to your blog. The cool thing is that you can do all this through Tor [18] if you want, plus the code is open source [19] so it’s possible to create your own version too.

The disadvantage of the Bitmessage method over blockchain steganography is that if someone was specifically looking for your communications they may see a footprint left behind and may be able to infer further information from traffic analysis [20].

CONCLUSION

If the goal is information security and privacy, then you need to have good endpoint security (and general opsec), so if your devices are already compromised before you use a dead drop, then it is insecure to use. The same is true about how you initially generate and exchange information about dead drop locations and any encryption keys.

Besides that, passive communications give you a way to exchange information in an extremely secure way. Admittedly it’s impractical for most people to use, but I still think it’s an intellectually interesting concept. It gives you options, regardless of whether you want to pretend to be James Bond, or if more seriously, you live under an oppressive regime which aims to stifle your speech.

––
BY CHRIS ROBINSON