This is worrisome, I am curious whether publicizing his case may make matters worse than better. I would also be curious to see if someone would manage to contact relatives or friends in the area,
It is quite common view of halogen lights wiring here (Bulgaria). I have the same in my bathroom. First photo is standard transformer and second photo is a job done by some electrician not doing his job well. I do not see anything suspicious. And yes, we are EU and NATO members. Most USA citizens visiting here happily spend they time and really enjoying the visit. Without more information what was the case with Dancho Danchev (Данчо Данчев) it is nothing more then paranoia.
Have you got one of those transformers too? Is the black double insulated side supposed to be the low voltage or the high voltage side of the transformer?
In Bulgaria there is a list of people declared for national investigation (обявени за национално издирване). In this list there are people who need to be arrested, who need to be a witness in a case or who are missing(i.e. they are kidnapped or disapeared). If Dancho is truly missing since September then he should be on that list.
I tried to search for this list online but I couldn't find it (maybe it is not available yet). The article doesn't say anything about the official situation. It will be great if anyone can provide some official information.
Dancho Danchev, an expert on cybersecurity, is placed in a psychiatric hospital in Bulgaria. The information was confirmed by two sources of "Dnevnik", although the hospital refused to comment.
[...]
[...]
[...] according to reliable source of Dnevnik he was placed in a Bulgarian psychiatric hospital since December 11.
Both of the photos are confusing, but the photo depicting the wires more so.
If you count the wires it seems right until you notice that the hacked up blue and white wires are not going to the lighting device at all. Or where the power (phase/neutral) are coming from. They go out of the frame to the left, instead.
I'm not sure what I'm looking at, but it looks like something is in the wall that requires power.
A couple of things come to mind:
- The man might be paranoid and mistook sloppy electrical work for evidence of ... something funny? A threat? I tend to think this is unlikely, as he's a security researcher and probably pretty well versed in these things. If he found a bug, taking a picture of it wouldn't mean anything.
- He's being extremely careful and photographed something that would only mean something to someone specific.
- The two wires that are kludged together seem to go into the wall. The white side is taped to what looks like standard romex, which seems to be where the phase/neutral for the lighting fixture comes from, but those wires travel outside of the frame to who knows where.
- The blue wire that's exposed doesn't look like CAT-5, but the color of the shielding is the same color as some bulk CAT-5 used in construction, though joining the wires under that blue tape seems like a really bad way to connect two exposed ends. I'm leaning towards it not being data cable, but being simple copper wire. Which, yes, could carry data.
- It's unlikely that the images contain information that would be easily deciphered. It's an in-case-of-emergency-break-glass message and it's not explicit as to what these images mean. It's probably intentional.
Anyway, fascinating story and I really hope this guy stays safe. Espionage and cyber crime are huge industries full of all sorts of bad actors.
* Wires coming through the wall are mains voltage.
* Exposed wire is ground, the other two are active and neutral. They connect to two white wires.
* These two active and neutral wires are connected to two white wires running into the transformer at the left of the photo (although you can't tell whether anything else is connected left of there).
* A black double-insulated wire comes out of the transformer, and a brown and blue wire come out of the double insulation.
* The brown and blue wires go into the first connector box, which connects via the black double wire to the second connector box.
* Two white double wires come out of the second connector box, one going to each light.
GTV seems like it was a transformer manufacturer - it had a US trademark on the name for manufacturing many things until 2008, including for "electric transformers for lighting lamps".
One weird thing: the transformer purports to be a step-down transformer, but the black cable with blue and brown wires (standard colours for mains active and neutral) connects to the low voltage end, when it is probably supposed to connect to the mains end. It is almost as if the step-down transformer is being used as a step-up transformer. The transformer ratio is between 220V/11.6V and 240V/11.6V - so about 20. 240V*20 = 4800V.
If it was configured to produce 4800V on an easily accessible light, perhaps he is trying to say that someone was trying to electrocute him.
Update: I found this, which I think is a more recent model of a similar transformer, from the same manufacturer: http://gemini-technology.en.alibaba.com/productshowimg/30345... - this seems to confirm that the black double insulated wire is supposed to be the 240V input, not the low voltage output.
I suspect that means someone is supposed to find that transformer. Presumably there may be something of interest with/in/near it. Its easy to hide a microSD
Spy devices are small, right? That's kind of the point. He said that someone might have hidden something small nearby, but if the real thing is small and hidden... why draw attention to it in the first place with a transformer? It doesn't make sense that "it was supposed to be found", as it alerts him to the fact that something's going on.
He would be far from the first geek to be overly paranoid.
The suggestion is that Danchev purposely sent a picture of what is obviously a large transformer hoping or knowing that it would mean something to someone - that the image itself is a message of some sort. I don't think anybody is suggesting that someone "covertly" installed a large transformer in Danchev's quarters to disguise a smaller device nearby.
You're right, it is of course possible that something is getting overanalyzed as we geeks are prone to do, but in the face of what is possibly a bad situation it's worth considering the worst case scenario.
That is very obviously what the photos appear to be. The discussion here is about whether, as the article claims, there is something else evident/hidden in these photographs.
From what's visible in the second photo, things look fairly legit (albeit shoddy) if the power feed is coming through the wall at the center of the image and the transformer is on the left below the ledge and the wires to/from it are going down through the hole and the wires heading out of the frame to the left are simply a splice between the feed line and the leads on the transformer.
Now if he cracked open the transformer and found a transmitter hidden inside - then it might get interesting...
Changing my vote. I think the guy is nuts and/or running away. Stuff doesn't add up.
-He claims a particular LEO is after him for pro-western views. This is the hardest hit to his credibility. If he said that botnet authors came after him for outing them, that might be plausible. The Belgian government does not hunt and 'disappear' pro-western people.
-There is no stego in this image like some have suggested. If it was in a letter, there is no data to be read. If it did not come from a latter, it was taken recently, according to the metadata. Also, if he is making direct accusations, he is not hiding information. Either the whole message would be cryptic, or none of it. If he isn't afraid to name the guy, he wouldn't be afraid to plainly state that he found a recording device or whatever else.
-He acts like the image has a smoking gun, and it does not.
-He has never had a real, credible job in the industry. See his LinkedIn: http://nl.linkedin.com/in/danchodanchev
It's either blogging, or "secret companies". And astalavista, which was warez/script kid forums and stuff.
-His blog is completely full of "cyber jihad" research and discussion of "cyber terrorist" nonsense. http://ddanchev.blogspot.com/
The rest of what you said makes sense, and it is possible that this is a script kid trying to make a name for himself - I would be very weary about making that assumption though without more serious evidence.
Nobody who does software security professionally would suggest Dancho is a "script kid". Your first tip-off might have been the article, where you'd learn that his disappearance was featured in the ZDNet security blog, where he is a contributor.
I don't do software security professionally, or have any other way of validating Dancho's legitimacy. It's not that I don't trust ZDNet - I was simply ceding the possibility that the parent was right on that point since I had no "proof" to the contrary. I apologize if it came across as me lending credence to the idea that Dancho may be a hack, I meant it in the sense that I was unable to positively confirm his reputation in the field (since I am not in it) but I should have been more clear :)
Yeah, sorry, I knew it was Bulgaria...just read an unrelated headline about the Belgian government and typed that instead.
I agree, it is worth looking into until there is real evidence either way. Hopefully he will come forward. Someone on twitter did say they heard from him on Dec 15th and he was fine.
My experience with these "independent security professionals" who are heavy on certification alphabet soup/government acronyms, and lacking in real credible work history, is that they are mostly playing "fake it until you make it". This especially applies to bloggers and those who heavily use terms like "cyber warfare" and "cyber terrorism". InfoSec is full of insecure charlatans who are broke or homeless and always making up outrageous nonsense.
Both of the images are large PNG files, which leaves lots of room for steganographic data. Given that they're meaningless if interpreted literally (but seem to vaguely hint at meaning, which makes them good as red herrings), that seems like the most likely interpretation.
So the question is, who has the key? It seems like if anyone has it, Ryan Naraine should. But if he did, his post would be quite different.
I don't mean to insult Mr. Danchev, but let's not dismiss the most obvious answer: He may be having psychological issues or otherwise be pulling some shenanigans.
There's no evidence to suggest otherwise at this point in time. The pictures don't suggest anything to me and he's perfectly capable of not answering the phone, email, or instant messages.
