:: Deepquest ::

English Prime minister tried to convince europeans countries to join “efforts” against Saddam Hussein. This document is a pure plagia from academic article. We won’t go talk about the political aspect, lameness but on the technical part of the report provided in ms word format.

English Prime minister tried to convince europeans countries to join “efforts” against Saddam Hussein. This document is a pure plagia from academic article. We won’t go talk about the political aspect, lameness but on the technical part of the report provided in ms word format.

If you’re interested about details just go [url=http://www.commondreams.org/headlines03/0207-02.htm]here[/url] or [url=http://news.bbc.co.uk/1/hi/uk_politics/2735031.stm]BBC article[/url].
The original report from [url=http://meria.idc.ac.il/journal/2002/issue3/jv6n3a1.html]Ibrahim al Marashi[/url]

Opening the “official” report from the british prime minister office [url=http://www.number-10.gov.uk/files/word/Iraq.doc](here)[/url] with a simple text editor on mac for exemple [url=http://www.barebones.com/products/bbedit/index.shtml]BBedit[/url] or notepad on windows. yes you’ll see the source of the document not only text but other things we won’t worry about. Look around line 484. Here comes the interesting things:

– PID_GUID AN {5E2C2E6C-8A16-46F3-8843-7F739FA12901}

What is a GUID?
“Every word document contains a global unique identifier (GUID) that uniquely identifies the network card used in the computer that created the document”. This GUID is a controversial feature that enables to identify the source of every office document.”

Back in 1999, the author of the melissa virus was [url=http://zdnet.com.com/2100-11-514170.html]arrested because to his GUID[/url].

What else do we find in the prime minister’s report?
We can see who modified the document:
after line 484 on the right you’ll see the following information:

cic22J C:\DOCUME~1\phamill\LOCALS~1\Temp\AutoRecovery save of Iraq - security.asd
cic22J C:\DOCUME~1\phamill\LOCALS~1\Temp\AutoRecovery save of Iraq - security.asd
JPratt C:\TEMP\Iraq – security.doc
JPratt A:\Iraq – security.doc
ablackshaw C:\ABlackshaw\Iraq – security.doc
ablackshaw C:\ABlackshaw\A:Iraq – security.doc
ablackshaw A:\Iraq – security.doc
MKhan C:\TEMP\Iraq – security.doc
MKhan C:\WINNT\Profiles\mkhan\Desktop\Iraq.doc
WebMaster C:\WINNT\Profiles\webmaster\Desktop\Iraq.doc
WebMaster Microsoft Word 8.0C

So what’s the problem?
When the british PM released the report on feb. 6th the name displayed in the properties of the ms word document were: P. Hamill, J. Pratt, A. Blackshaw, and M. Khan. In fact the document was “updated” the names were removed since this document is a pure plagia. The actual updated official document is still available [url=http://www.number-10.gov.uk/files/word/Iraq.doc]here[/url]. But the name are still there. Anyone could lurn the PM’s office or so called Intelligence services how to use ms word?

The other interesting point is that we who changed the document, in which order:
-P.Hamill received the document
-The document Iraq - security was transmitted to J.Pratt then copy to floppy disk.
-Transmitted to A.Blackshaw, then re-copied to floppy disk.
-M.Khan opened the document from floppy then copied to his desktop.
-The document was transmitted to the webmaster of PM’s website and rename to Iraq.doc.

SO What’s next?
Nothing much than British Politics tried to convince Europe , with a single MS word document, and still many security or rather privacy issues.
I’m not pro or against Iraq, France, Uk or event USA this not the point. It’s just another sunday afternoon on the internet where people look where they are told to look, but never read the source.

credits for GUID from securiteam article [url=http://www.securiteam.com/securitynews/2YUQ2QAQMS.html]Melissa author found?[/url]