How to lose your anonymity. (Frog Admin and the APAS Troll)
Anonymous Sender
Table of Contents
1 Overview
1.1 History
2 Misspelling Categories
2.1 Accidental Finger Slips - Typo's
2.2 Miscomprehension
2.3 Country-Specific Spelling
2.4 Deliberate Misinformation
3 Background
3.1 The "APAS Troll"
3.2 The "Script-Kiddie"
3.3 Message Filtering
4 Methodology
4.1 Phrase and Word Filtering
4.2 Spelling Anomalies
4.2.1 Finger-Slips - Typo's
4.2.2 Miscomprehension
4.2.3 Country Specific
5 Analysis
6 References
6.1 Personnal
6.1.1 Additional References:
6.2 Litterate
6.2.1 Additional References:
6.3 Functionnalities
6.3.1 Additional References:
6.4 Favor
6.4.1 Additional References:
6.5 Attachements
6.5.1 Additional References:
6.6 Millenium
6.6.1 Additional References:
7 Summing Up
1 OVERVIEW
The aim of this posting is to highlight the dangers of repeated poor
or country specific spelling within an anonymous community. For the
purposes of this document, I am using the ongoing suspicion that Frog-
Admin and the APAS Troll is the same person. I am not attempting to
prove this one way or the other, nor will I provide proof that the
two are really a single individual. However I will indicate how
spelling can be used to exploit or unmask an individual: In this
instance, Frog-Admin. The validity of this document is left with
each reader to formulate an opinion whether it is a case of
exploitation, coincidence or genuine guilt. Throughout the document,
I will attempt to provide an impartial view as there is no undeniable
proof given here or within any other public references I have seen.
1.1 History
Prior to this document, there have already been a number of attempts
to link Frog-Admin with the APAS Troll. Most of these have been of a
"finger-pointing" nature whilst providing little evidence to support
their claim. The one very notable exception was a lengthy document
produced to compare them and similarities in their grammar, spelling
and prejudices. This document was posted with the following Message-
ID, given here for reference.
734498b47ce736a3...@remailer.segfault.net
Although having read this in the past, I am making a conscious effort
to avoid doing so prior to posting this document. I'm therefore
sorry if some of my following references are identical to those given
within that document; if that is the case then they have been arrived
at independently.
2 MISSPELLING CATEGORIES
This document will focus on the following weaknesses as they provide
the easiest means of demonstration and are also the easiest to track
without specialised software.
2.1 Accidental Finger Slips - Typo's
Where the finger lands off-target and strikes one of the surrounding
keys. This is a relatively random act and provides little continuity
in terms of proving that one posting was made by the same individual
as another. It does however on occasion give a suggestion as to the
locale of the originator due to the country specific nature of the
keyboard layout.
2.2 Miscomprehension
Repeated misspelling of a word due to a conception that the spelling
employed is correct. This is a very traceable error that can easily
be tracked on Usenet by means of Google archives.
2.3 Country-Specific Spelling
Most commonly seen between American and European users where words
have evolved into different spellings. Examples: "Color" and
"Colour", "Favor" and "Favour", "Program" and "Programme". These can
aid in identifying the locale of a poster.
2.4 Deliberate Misinformation
Words erroneously spelt on purpose in an attempt to hide the true
locale of the poster; a counter to the "Country-specific" section
above. Another possibility within this section and very pertinent in
the examples to follow is deliberate misspelling to copy the style of
another poster.
3 BACKGROUND
3.1 The "APAS Troll"
The figure that has become commonly known to regulars as the APAS
Troll has a very easily identifiable writing style. This is
undoubtedly a conscious effort by the individual to build a form of
identity whilst still remaining anonymous. This enables the reader
to associate certain postings with the troll, whilst at the same time
the style is sufficiently synthetic that the troll can easily drop it
and assume a different identity, whilst leaving little or no tell-
tale signature for readers to link the two identities. Although not
provable, I think it is a fairly safe assumption that the troll is a
regular to the Remailer Community and also posts messages under a
different identity. He also has a good understanding of the Remailer
system and its workings, although he demonstrates a lack of in-depth
knowledge with regard to the Mixmaster system and its protocol. This
was clearly demonstrated in a recent posting, reference:
7f76ec249f44f8df...@dizum.com
3.2 The "Script-Kiddie"
This person or identity is responsible for the large scale flooding
and abuse of alt.privacy.anon-server and other related Newsgroups.
This has occurred infrequently for a number of years and has been
refined over time to make filtering harder for the readers. However,
a filterable characteristic has always been maintained within the
message body throughout its history. This is presumably an act on
the part of the instigator to ensure he can personally filter his own
flood. Another assumption can therefore be made, that the Script
Kiddie has a means to filter on message content.
This document will make no attempt to tie this identity to either
that of the "APAS Troll" or Frog-Admin.
3.3 Message Filtering
Over the years, regular readers of APAS have found methods of
cleaning their incoming News feed by filtering postings that contain
characteristics of the troll's identity. The effectiveness of these
filters depends on the methods employed and the amount of time an
individual is prepared to spend on analysing the troll and
subsequently creating effective filters. There is also a risk-
assessment made by each individual on how strict these filters should
be in relation to the possibility of breaking threads and filtering
well-intentioned postings.
The identification of a filterable characteristic that is completely
unique to the troll is very difficult to find; if not impossible.
Poor spelling and grammatical errors provide a reasonably accurate
means, but as the content of this document will demonstrate, the same
errors can seemingly be made repeatedly by more then one individual.
Of course, the alternative is that those individuals are in fact
multiple identities of a single individual.
Other filterable characteristics of the troll's identity come in the
form of phrases that are used repeatedly by that one identity. Some
of these are very strong characteristics that provide excellent
filtering material for those with Regular Expression capabilities.
Some examples of these characteristics can be found within this
document. As with the spelling characteristics, there are plenty of
instances where these characteristics are used to either exploit Frog-
Admin or unmask the troll, depending on your opinion. However, this
document is concerned with spelling anomalies rather than analysing
these phrases, hence their inclusion within this text is only to
highlight how they can be used to extract messages containing these
anomalies.
4 METHODOLOGY
This section demonstrates the methods that I have employed to extract
troll postings and where required provides an analysis of my
reasoning.
4.1 Phrase and Word Filtering
Many APAS regulars would curse me for documenting here the exact
phrases I employ to extract messages. This would provide the troll
with information he could exploit to provide further disruption of
the group by making subtle changes to his stock messages and phrases
which would "break" the filters of others. The following are
therefore only very basic and obvious examples of troll phrases that
can be extracted with little danger of filtering valid postings. As
stated previously, this document is not directly concerned with these
methods.
FASCIST
GROTESQUE
[Qq]uick[Ss]hit
IRRESPECTUOUS
BOSCHLOO
CHAMPERTY
SEXUAL\sORIENTATION
Postings containing any one of these phrases can be reasonably safely
attributed to either the APAS Troll or a follow up to a posting by
him. As well as providing a filter, phrases such as these and others
help to compose the troll's identity.
4.2 Spelling Anomalies
This section categorises the regular spelling anomalies made by the
troll. References to these anomalies are provided later within this
document.
4.2.1 Finger-Slips - Typo's
Alreadt (Suggests t is next to the y on the keyboard)
Grewlins (Little meaning, w is not near m on any keyboard layout)
Privavy (Suggests v is next to c on the keyboard)
Didtribution (Suggests d is next to s on the keyboard)
4.2.2 Miscomprehension
These are all words that the troll frequently or always spells
incorrectly. They are personal traits of the individual rather than
the identities he attempts to assume.
Personnal
Personnalities
Litterate
Succesfull
Concived
Functionnalities
Attachements
Revulsed
Millenium
4.2.3 Country Specific
Colors (American rather than European spelling)
Favor (American rather than European spelling)
5 ANALYSIS
Section 4.1 above provides little value to the identification of the
troll. Although containing reasonably accurate filtering properties,
they are specific to the troll's identity rather than the person
behind that identity.
Section 4.2.1 provides little of value except to suggest that the
troll is using a relatively standard American or European keyboard.
The misspelling of "already" does indicate that the user has a
straight keyboard rather than a natural keyboard upon which the t and
y keys are on opposite halves of the layout.
Conversely section 4.2.2 provides an insight to the person behind the
identity. These suggest mistakes that the poster makes regardless of
what identity he is trying to assume. There is also the possibility
that the troll is deliberately making these errors to provide
misinformation. This possibility has to be considered when one
checks the references given later which highlight that a considerable
number of these errors are common to both the troll and Frog-Admin
Section 4.2.3 is interesting in that it suggests the troll is of
American origin. However, an analysis of Frog-Admin postings
highlights that he also employs the American spelling of these words.
This is poor evidence however as these are very common spelling
errors within European countries.
http://groups.google.com/groups?as_oq=favor%20color&safe=images&ie=UTF-8&oe=UTF-8&as_ugroup=alt.privacy.anon-server&as_uauthors=frog-admin&lr=&hl=en
6 REFERENCES
This section concentrates on the spelling anomalies that are common
to both the troll and Frog-Admin. For those who wish to form an
opinion, this is undoubtedly the meat of the sandwich. Some of these
errors are common, whilst others are unusual or even unique within
APAS to just the troll and Frog-Admin. I leave it to the reader to
decide if this proves Frog-Admin and the troll are two identities of
a single individual, or that it simply highlights the cleverness of
the troll in copying Frog-Admin's idiosyncrasies to further a cause
that we can only speculate upon.
6.1 Personnal
QX8ULO943741...@Nyarlatheotep-frog.org (Valid Frog-Admin Signature)
2000060223...@berlin.neuropa.net (Valid Frog-Admin Signature)
575IA4GG37679.5015856481@Gilgamesh-frog.org (Valid Frog-Admin Signature)
dbd7faba915ef9ba...@ecn.org (Troll Post)
TUTN3KK13771...@anonymous.poster (Fake Frog-Admin, Fake Signature, Troll Post)
G8T16I9Y37...@anonymous.poster (Troll Post)
2003030823401...@nym.alias.net (Troll Post)
1997111818...@basement.replay.com (Very early Frog-Admin posting, No Signature)
6.1.1 Additional References:
http://groups.google.com/groups?q=personnal+group:alt.privacy.anon-server&hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&start=0&sa=N
6.2 Litterate
7Y5SC2DX37704.5443518519@Gilgamesh-frog.org (Valid Frog-Admin Signature)
2000053107...@berlin.neuropa.net (Valid Frog-Admin Signature)
2000052709...@berlin.neuropa.net (Valid Frog-Admin Signature)
ca4476039821863f...@ecn.org (Troll Post)
4W55XBBF37448.8208217593@anonymous.poster (Troll Post)
6.2.1 Additional References:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&q=litterate+group%3Aalt.privacy.anon-server
6.3 Functionnalities
CN020KR437577.9018287037@Gilgamesh-frog.org (Valid Frog-Admin Signature)
KMA6JJBY3764...@Gilgamesh-frog.org (Unsigned Fake Frog-Admin)
QJ93K12D3762...@Nyarlatheotep-frog.org (Valid Frog-Admin Signature)
9PPEI4913758...@Gilgamesh-frog.org (Valid Frog-Admin Signature)
fcd943355c2584b0...@anonymous.poster (Troll Post)
ZJTPL4EF3771...@Gilgamesh-frog.org (Troll Post)
f2bb6f224a78a98c...@anonymous.poster (Very early Frog-Admin posting, No Signature)
6.3.1 Additional References:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&q=functionnalities+group%3Aalt.privacy.anon-server
6.4 Favor
6331D16757@Nyarlatheotep (Valid Frog-Admin Signature)
FDYGXG053767...@Gilgamesh-frog.org (Valid Frog-Admin Signature)
SQGP2HVU376...@Gilgamesh-frog.org (Valid Frog-Admin Signature)
b809f3a6604a69ba...@remailer.metacolo.com (Troll Post)
459eb5be2894e0f1...@remailer.privacy.at (Troll Post)
78fea7120f2b26a3...@ecn.org (Troll Post)
6.4.1 Additional References:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&q=favor+group%3Aalt.privacy.anon-server
6.5 Attachements
YP3XRH043757...@Gilgamesh-frog.org (Valid Frog-Admin Signature)
7KMM735C3753...@Gilgamesh-frog.org (Valid Frog-Admin Signature)
9MLEDU2U3732...@frog.gilgamesh.org (Valid Frog-Admin Signature)
fcf4c7d57ed09717...@remailer.metacolo.com (Troll Post)
QWAWI53A376...@Gilgamesh-frog.org (Troll Post)
O46V5MYJ376...@anonymous.poster (Troll Post)
6.5.1 Additional References:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&q=attachements+group%3Aalt.privacy.anon-server
6.6 Millenium
18Y45TLZ368...@frog.nyarlatheotep.org (Valid Frog-Admin Signature)
20000319180120....@nyarlatheotep.chello.fr (Valid Frog-Admin Signature)
593d22d636e396ad...@melontraffickers.com (Troll Post)
2003030700000...@nym.alias.net (Troll Post)
SIN0JZGE3729...@frog.gilgamesh.org (Troll Post)
6.6.1 Additional References:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&scoring=d&q=millenium+group%3Aalt.privacy.anon-server
7 SUMMING UP
This document is intended to provide an insight into one of the
reasons that Frog-Admin is often openly accused of being the APAS
Troll. There are many others that people should consider before
reaching their own conclusions. Those with an open mind will reach
the conclusion that there is insufficient evidence to make a definite
decision one way or the other.
Whilst this document fails to provide proof of Frog-Admin being the
APAS Troll, it does hopefully highlight the serious implications of
adopting personal characteristics within an anonymous community. A
Spell checker is a readily available tool and there is little excuse
for erroneous spelling of simple words, year after year. Whilst Frog-
Admin has the excuse of posting in a second language, he should also
recognise that he has seeded the suspicions within APAS simply by
errors such as these.
A.Melon
Frog-Admin knows that he has a problem with spelling anomalies.
Frog-Admin's statement: 'The *one* modification I would like to add is
using Office's spellchecker.
If somebody can supply me with the necessary hints for SpellChecker, I
would probably find the motivation and resources to supply a full JBN
2.14frog (sources + exe + install program) featuring Spellchecker
Magic Button updated initialization data SMTP auth and the fix to
your problem if it really exists.
If there is a need for development, JBN2 code is easy enough to raise
many vocations as programmer, maintainer, leader or whatever you call
it. The tools (source, VB compiler, .ocx) are available. There is no
such need at the moment.'
But it was of course not possible.
-----BEGIN PGP SIGNED MESSAGE-----
On Sun, 6 Oct 2002, Mister Heex <Use-Author-Address-Header@[127.1]>
wrote:
>What a pitty after all that JBN2 does not work together with PGP711. I
>know that you do not like this thought. But it would be nice.
>
>Can you implement it?
Probably NOT:
I miss the time, the tools, and the motivation for it.
Even if it were easy, it is not *desirable*
(I can hurt my foot very easily, I won't do it though).
And AFAIK the proper SDK is not available from PGP7, nor the source for
SPGP.dll.
>'If there is a need for development, JBN code is easy enough to raise
>many vocations as rogrammer, maintainer, leader or whatever you call
>it. The tools (source, VB compiler, .ocx) are available.'
>
>If I use national setting German (standard) I get an error message 'Not
>connected'.
>
>Can you fix it?
I would have a hard time fixing a problem which I cannot reproduce on
my machine. Which is quite strange because, when Reliable was under
test, my French machine characterized very well an internationalization
problem (dates), which got fixed. I ran JBN2 on French, Spanish,
Italian and UK/US machines without a hitch. (Win95 / Win98 / WinNT /
Win2K)
Native JBN works very well for me, and I only added one modification
Modify Potatoware
http://www.privacyresources.org/frogadmin/PotatoX_Gen.html
The *one* modification I would like to add is using Office's
spellchecker. Unfortunately, the relevant API are not exposed anywhere,
and asking the question in MS newsgroups raises a barrage of "copyright
violation" objections before I hit the "Send" button. (I want the
spellchecker's API, *not* an instanciation of Word)
If somebody can supply me with the necessary hints for SpellChecker, I
would probably find the motivation and resources to supply a full JBN
2.14frog (sources + exe + install program) featuring Spellchecker
Magic Button updated initialization data SMTP auth and the fix to
your problem if it really exists.
BTW, I am looking for MSDN Visual Studio6 (French or English). If
somebody has a link ... programming without Help File is a bit
difficult for me.
-----BEGIN PGP SIGNATURE-----
Version: N/A
iQEVAwUBPaCB24DgT488d3zFAQG6Ewf+NUEd8TdwPSzNfXeTZOdMazlWo8YaFtxa
iaegimGP1AjtJCp3pU9o2LHPs/liOIf15j/zGQFTHPnvKi2XKUQjMrXd6q0kaNUS
6V1TucH1u/YGYGEfMr8aXttxVaMJRC97EnITLE/1X0vGM+5Jb3BSxnrLBZY2gUvZ
y7TH5mcW1fY+l37xJkJsGHr30xURgWkt587RnyeQxV1ayftsqx08FjQfeRuIxtw5
woUDxLLrzYnXH0ARDlLrQihzNLkDjvfreaQVEkOjWI3Re+NyUB1tbrOaRapjOyUo
Q7edU0BVKeuaD7TMvxUMc5/pEngoY30g7NChdKfYOBa419dMp/INMw==
=pcL7
-----END PGP SIGNATURE-----