top | item 2105439

Malware researcher Dancho Danchev gone missing since August

202 points| AndrewWarner | 15 years ago |zdnet.com | reply

41 comments

order
[+] updog|15 years ago|reply
The ICC color profile in the PNG has a copyright string of Apple 2011. If he took them mid-last year, this doesn't make a ton of sense.

Perhaps someone at ZDNet re-saved them. If that is the case, they should release the originals.

[+] cag_ii|15 years ago|reply
The article makes it sound to me like the original letter/photos were actual printer/paper, not digital.
[+] madmaze|15 years ago|reply
This is worrisome, I am curious whether publicizing his case may make matters worse than better. I would also be curious to see if someone would manage to contact relatives or friends in the area,
[+] aquarin|15 years ago|reply
It is quite common view of halogen lights wiring here (Bulgaria). I have the same in my bathroom. First photo is standard transformer and second photo is a job done by some electrician not doing his job well. I do not see anything suspicious. And yes, we are EU and NATO members. Most USA citizens visiting here happily spend they time and really enjoying the visit. Without more information what was the case with Dancho Danchev (Данчо Данчев) it is nothing more then paranoia.
[+] A1kmm|15 years ago|reply
Have you got one of those transformers too? Is the black double insulated side supposed to be the low voltage or the high voltage side of the transformer?
[+] mitko|15 years ago|reply
In Bulgaria there is a list of people declared for national investigation (обявени за национално издирване). In this list there are people who need to be arrested, who need to be a witness in a case or who are missing(i.e. they are kidnapped or disapeared). If Dancho is truly missing since September then he should be on that list.

I tried to search for this list online but I couldn't find it (maybe it is not available yet). The article doesn't say anything about the official situation. It will be great if anyone can provide some official information.

[+] wang-chung|15 years ago|reply
A simple explanation of the transformer/wires is that he could be documenting an attempt to electrocute him.
[+] redthrowaway|15 years ago|reply
Or, more likely, kill him in a fire that looked accidental.
[+] EastSmith|15 years ago|reply
According to Dnevnik.bg (http://www.dnevnik.bg/tehnologii/2011/01/17/1026425_ekspertu...):

Dancho Danchev, an expert on cybersecurity, is placed in a psychiatric hospital in Bulgaria. The information was confirmed by two sources of "Dnevnik", although the hospital refused to comment.

[...]

[...]

[...] according to reliable source of Dnevnik he was placed in a Bulgarian psychiatric hospital since December 11.

[+] jimrandomh|15 years ago|reply
Both of the images are large PNG files, which leaves lots of room for steganographic data. Given that they're meaningless if interpreted literally (but seem to vaguely hint at meaning, which makes them good as red herrings), that seems like the most likely interpretation.

So the question is, who has the key? It seems like if anyone has it, Ryan Naraine should. But if he did, his post would be quite different.

[+] nitrogen|15 years ago|reply
The electronic transformer looks like it could be used for low-voltage lighting. The wires look like they're running into mini LED or halogen lights.
[+] elbrodeur|15 years ago|reply
Both of the photos are confusing, but the photo depicting the wires more so.

If you count the wires it seems right until you notice that the hacked up blue and white wires are not going to the lighting device at all. Or where the power (phase/neutral) are coming from. They go out of the frame to the left, instead.

I'm not sure what I'm looking at, but it looks like something is in the wall that requires power.

A couple of things come to mind:

- The man might be paranoid and mistook sloppy electrical work for evidence of ... something funny? A threat? I tend to think this is unlikely, as he's a security researcher and probably pretty well versed in these things. If he found a bug, taking a picture of it wouldn't mean anything.

- He's being extremely careful and photographed something that would only mean something to someone specific.

- The two wires that are kludged together seem to go into the wall. The white side is taped to what looks like standard romex, which seems to be where the phase/neutral for the lighting fixture comes from, but those wires travel outside of the frame to who knows where.

- The blue wire that's exposed doesn't look like CAT-5, but the color of the shielding is the same color as some bulk CAT-5 used in construction, though joining the wires under that blue tape seems like a really bad way to connect two exposed ends. I'm leaning towards it not being data cable, but being simple copper wire. Which, yes, could carry data.

- It's unlikely that the images contain information that would be easily deciphered. It's an in-case-of-emergency-break-glass message and it's not explicit as to what these images mean. It's probably intentional.

Anyway, fascinating story and I really hope this guy stays safe. Espionage and cyber crime are huge industries full of all sorts of bad actors.

[+] madmaze|15 years ago|reply
I suspect that means someone is supposed to find that transformer. Presumably there may be something of interest with/in/near it. Its easy to hide a microSD
[+] taylorbuley|15 years ago|reply
I had trouble figuring out what those photos actually show.
[+] LordLandon|15 years ago|reply
Why is “current situation in my bathroom” in quotes like that?
[+] uptown|15 years ago|reply
If "several" photographs were attached to his pleas for help, why did they elect to only include two of them?
[+] runjake|15 years ago|reply
I don't mean to insult Mr. Danchev, but let's not dismiss the most obvious answer: He may be having psychological issues or otherwise be pulling some shenanigans.

There's no evidence to suggest otherwise at this point in time. The pictures don't suggest anything to me and he's perfectly capable of not answering the phone, email, or instant messages.

I hope he is ok, both physically and mentally.

[+] runjake|15 years ago|reply
If you're going to downvote me into oblivion at least counter my points with facts. What does the real evidence show here?