Encrypted world war II droppings

The public's imagination has apparently been captured this month by stories of an encrypted World War II message found attached to the leg bone of a carrier pigeon that had apparently been lodged in a chimney in Surrey for the past 70 years.

There doesn't seem to be complete consensus on the identity of one or two of the letters, but a transcription of the message looks essentially as follows:


AOAKN  (.)  HVPKD   FNFJW    YIDDC
RQXSR        DJHFP      GOVFN   MIAPX
PABUZ        WYYNP   CMPNW  HJRZH (.)
NLXKG       MEMKK   ONOIB    AKEEQ
WAOTA (.)  RBQRH    DJOFM    TPZEH
LKXGH        RGGHT    JRZCQ     FNKTQ
KLDTS         GQIRW    AOAKN

The dots in parentheses probably aren't part of the encoded message as such, assuming word/phrase/sentence boundaries were not explicitly encoded. But they may be a clue to such boundaries, with the scribe inadvertently inserting them as they came to the end of a sentence/phrase. They suggest that at the time of transcription, such boundaries were still present, probably ruling out a system akin to today's modern block ciphers.

Notice the sequence "AOAKN" appearing both at the start and end, which is presumably not part of the encoded message, but possibly a reference to the encryption key, some kind of "message start/end codeword", or some kind of authentication sequence.

So what does the message say? Can it be decoded with modern computational methods? Simple schemes such as letter substitutions and even variants of the FairPlay cipher apparently used at one point during WWII could potentially be deciphered.

But despite various rumours and hypotheses I have seen on a few Internet forums, unfortunately, the distribution of letters in our mystery message appears to be consistent with encryption using a one time pad. In a one time pad, one "mixes" each letter in the message with the next letter of a secret randomly generated sequence known only to the sender and recipient. If implemented properly (meaning the stream of letters forming the one time pad has to be genuinely random and never re-used for multiple messages or parts of messages) then this scheme is completely secure. (Modern stream ciphers are inspired by the technique, but rely on a generating a pseudorandom sequence from a relatively small secret random key; as with modern cryptographic techniques in general, they are "secure enough in practice for the use to which they are put" if their usage guidelines and limitations are properly understood.)

One hope for "cracking" the message would be if the such a scheme was not implemented properly (for example, using as "secret" one time pad a sequence of letters based on a known text such as the American Constitution, or indeed any text in a common language with well-studied letter/word distributions.

One other thing seems clear: if the message is crackable without more information, the people with the tools and knowledge to crack it are GCHQ if they can be bothered.  So my guess is that (a) with minimal resources and standard tools they have decoded the message and this is a recruitment drive, or (b) GCHQ have ascertained the scheme is some variant of a one time pad (or not something they can trivially decode with the resources they can be bothered to devote to some one-off 150 character message from World War II) and what is being sought is some of the "social" knowledge around locating the key/clues to its generation in case they can then idly decode it with close to zero effort.

And in the worst case, the story has revived public interest in history, mathematics, computing etc while being a temporary distraction from the humdrum financial turmoil and political scandal which otherwises graces our news outlets.

Reading environment variables and system properties in Java

The first of a new section of forthcoming tutorials "miescellaneous and system" features of Java, a new tutorial has been added on reading environment variables and system properties in Java.

The tutorial looks at issues such as:

what technically is the difference between OS environment variables and Java system properties?
commonly defined properties for cross-platform use
how to enumerate environment variables and properties, including how to unify the two separate APIs.

As usual, comments, feedback and requests for new tutorials are welcome via the Javamex forum.

Java 7 patched, although there are still reports of vulnerabilities

The reported vulnerability in Java 7, which allows untrusted code to override the SecurityManager and hence run malicious code on a client machine, was patched by Oracle on Thursday. Java 7 Update 7 fixes the vulnerability in the form in which it is actually known to be being exploited "in the wild".

General users can download the update to Java here.
Developers can download the update here.

There still remain reports that the patched version still contains a vulnerability allowing the SecurityManager to be overridden, but not in a form currently known to be being exploited. You are advised to "watch this space"...!

Serious vulnerability in Java 7: another nail in the coffin for Java as a client-side web technology

On Monday, an "extremely critical" vulnerability was announced in version 7 (i.e. all versions 1.7.x) of the Java Runtime.

The vulnerability is effectively that Java's Security Manager settings, controlling permissions that govern critical operations such as file access, network connectivity, running external processes, can be overridden. In particular, the Java web browser plugin normally sets security restrictions ("sandboxing") meaning that arbitrary files cannot be read from the host machine and arbitrary processes cannot be started by a Java program embedded in a web page. The vulnerability discovered in Java 7 effectively allows these restrictions to be bypassed (specifically, this example code does so by making reflective calls via the Javabeans framework).

This vulnerability-- more so than previous cases, it seems-- has sparked a strong message from many commentators that Java applets are no longer a fundamental part of the web infrastructure. The advice given by many industry commentators is that Java is not needed by most users and should be disabled: the security risk it poses outweighs the benefit for non-specialist users.

If for you, Java is still a "core" piece of web technology, then less extreme action you could take:

• using Google Chrome, go to chrome://plugins and ensure that the Java plugin is not set to "Always allow" and only run Java on sites that you trust;
• use another browser, with Java disabled (or a device such as the iPad that doesn't support Java) for browsing sites that are not in your "trusted" list;
• when using a public network (e.g. in a coffee shop etc), use a browser or device that does not have Java installed (e.g. your iPad is safe);
• if you have to use your laptop over a public network with a Java-enabled browser, do so over a VPN.

Of course, whenever you browse to an untrusted web site and/or use a non-encrypted connection over a network with components that are easily controlled by a third party (e.g. in a miscellaneous coffee shop) there is a tangible risk from various possible vulnerabilities. What arguably makes this vulnerability different is that: (a) it is relatively easy to exploit by an attacker; (b) in the race to close the vulnerability, the Bad Guys currently have the "upper hand": an exploit has already been integrated into standard hacking tools whereas no patch is available or announced (at the time of writing).

So... check your Java settings and watch this space!

Update: a patch has been released which partially addresses this vulnerability.

LetterMeister 0.72b

A miunor update to LetterMeister was released today. Version 0.72b of the word puzzle game for desktop makes an improvement to the rendering of certain on-screen prompts (such as level announcements) to improve the anti-aliasing of the text.

Version 0.71b of LetterMeister word puzzle game

LetterMeister, the free word puzzle game published on this site, is now in version 0.71b and includes German as one of the language options. Full details, including some details of how German has been implemented specifically, are given in this blog post.

Version 0.7b of LetterMeister released

A new update to the LetterMeister word puzzle game for Windows, Linux and Mac was released today. The new version is a minor update to the version released the other week which now includes French and Spanish in addition to English.

Thus, the game should provide a fun way for language learners to reinforce their French and Spanish vocabulary.

LetterMeister word game is also available for iPhone/iPad and can be downloaded from the App Store in the usual way. The latest version for iOS also features the option to play in Spanish and French in addition to English. It also features Game Center integration, allowing you to pit yourself against friends and other LetterMeister players!

For those looking for a more structured way to learn and practise their vocabulary, you may be interested in French Vocab Games, also available from the App Store.