Malware researcher Dancho Danchev gone missing since August

http://www.zdnet.com/blog/security/we-need-help-with-the-strange-disappearance-of-dancho-danchev/7897

by AndrewWarner • 16 years ago

202 41 16 years ago

nitrogen• 16 years ago

The electronic transformer looks like it could be used for low-voltage lighting. The wires look like they're running into mini LED or halogen lights.

madmaze2• 16 years ago

I suspect that means someone is supposed to find that transformer. Presumably there may be something of interest with/in/near it. Its easy to hide a microSD

Pyrodogg• 16 years ago

This sounds more reasonable than thinking that they photos are showing eavesdropping devices.

cag_ii3• 16 years ago

Presumably? If these photos were taken for proof/evidence they just don't cut it, especially coming from a security specialist/professional.

... Or, they could just be a photos of a shoddy light fixture installation.

crocowhile• 16 years ago

Either that or some form of steganography is the pics were sent as digital and not paper forms.

catshirt• 16 years ago

This could also explain why "current situation in my bathroom" is in quotes.

taylorbuley• 16 years ago

I had trouble figuring out what those photos actually show.

elbrodeur• 16 years ago

Both of the photos are confusing, but the photo depicting the wires more so.

If you count the wires it seems right until you notice that the hacked up blue and white wires are not going to the lighting device at all. Or where the power (phase/neutral) are coming from. They go out of the frame to the left, instead.

I'm not sure what I'm looking at, but it looks like something is in the wall that requires power.

A couple of things come to mind:

- The man might be paranoid and mistook sloppy electrical work for evidence of ... something funny? A threat? I tend to think this is unlikely, as he's a security researcher and probably pretty well versed in these things. If he found a bug, taking a picture of it wouldn't mean anything.

- He's being extremely careful and photographed something that would only mean something to someone specific.

- The two wires that are kludged together seem to go into the wall. The white side is taped to what looks like standard romex, which seems to be where the phase/neutral for the lighting fixture comes from, but those wires travel outside of the frame to who knows where.

- The blue wire that's exposed doesn't look like CAT-5, but the color of the shielding is the same color as some bulk CAT-5 used in construction, though joining the wires under that blue tape seems like a really bad way to connect two exposed ends. I'm leaning towards it not being data cable, but being simple copper wire. Which, yes, could carry data.

- It's unlikely that the images contain information that would be easily deciphered. It's an in-case-of-emergency-break-glass message and it's not explicit as to what these images mean. It's probably intentional.

Anyway, fascinating story and I really hope this guy stays safe. Espionage and cyber crime are huge industries full of all sorts of bad actors.

foenix• 16 years ago

One more note about the wiring, it seems to be outside of a bathroom or bathtub of some sort. Note the toilet paper and its reflection in the tile.

I don't know if that's helpful, but it's good to understand all of the details; thanks for your analysis, elbrodeur.

A1kmm2• 16 years ago

One interpretation of the wiring:

* Wires coming through the wall are mains voltage. * Exposed wire is ground, the other two are active and neutral. They connect to two white wires. * These two active and neutral wires are connected to two white wires running into the transformer at the left of the photo (although you can't tell whether anything else is connected left of there). * A black double-insulated wire comes out of the transformer, and a brown and blue wire come out of the double insulation. * The brown and blue wires go into the first connector box, which connects via the black double wire to the second connector box. * Two white double wires come out of the second connector box, one going to each light.

GTV seems like it was a transformer manufacturer - it had a US trademark on the name for manufacturing many things until 2008, including for "electric transformers for lighting lamps".

One weird thing: the transformer purports to be a step-down transformer, but the black cable with blue and brown wires (standard colours for mains active and neutral) connects to the low voltage end, when it is probably supposed to connect to the mains end. It is almost as if the step-down transformer is being used as a step-up transformer. The transformer ratio is between 220V/11.6V and 240V/11.6V - so about 20. 240V*20 = 4800V.

If it was configured to produce 4800V on an easily accessible light, perhaps he is trying to say that someone was trying to electrocute him.

Update: I found this, which I think is a more recent model of a similar transformer, from the same manufacturer: http://gemini-technology.en.alibaba.com/productshowimg/30345... - this seems to confirm that the black double insulated wire is supposed to be the 240V input, not the low voltage output.

madmaze2• 16 years ago

This is worrisome, I am curious whether publicizing his case may make matters worse than better. I would also be curious to see if someone would manage to contact relatives or friends in the area,

updog4• 16 years ago

The ICC color profile in the PNG has a copyright string of Apple 2011. If he took them mid-last year, this doesn't make a ton of sense.

Perhaps someone at ZDNet re-saved them. If that is the case, they should release the originals.

cag_ii3• 16 years ago

The article makes it sound to me like the original letter/photos were actual printer/paper, not digital.

wang-chung• 16 years ago

A simple explanation of the transformer/wires is that he could be documenting an attempt to electrocute him.

redthrowaway• 16 years ago

Or, more likely, kill him in a fire that looked accidental.

LordLandon• 16 years ago

Why is “current situation in my bathroom” in quotes like that?

aquarin2• 16 years ago

It is quite common view of halogen lights wiring here (Bulgaria). I have the same in my bathroom. First photo is standard transformer and second photo is a job done by some electrician not doing his job well. I do not see anything suspicious. And yes, we are EU and NATO members. Most USA citizens visiting here happily spend they time and really enjoying the visit. Without more information what was the case with Dancho Danchev (Данчо Данчев) it is nothing more then paranoia.

A1kmm2• 16 years ago

Have you got one of those transformers too? Is the black double insulated side supposed to be the low voltage or the high voltage side of the transformer?

mitko• 16 years ago

In Bulgaria there is a list of people declared for national investigation (обявени за национално издирване). In this list there are people who need to be arrested, who need to be a witness in a case or who are missing(i.e. they are kidnapped or disapeared). If Dancho is truly missing since September then he should be on that list.

I tried to search for this list online but I couldn't find it (maybe it is not available yet). The article doesn't say anything about the official situation. It will be great if anyone can provide some official information.

uptown• 16 years ago

If "several" photographs were attached to his pleas for help, why did they elect to only include two of them?

runjake2• 16 years ago

I don't mean to insult Mr. Danchev, but let's not dismiss the most obvious answer: He may be having psychological issues or otherwise be pulling some shenanigans.

There's no evidence to suggest otherwise at this point in time. The pictures don't suggest anything to me and he's perfectly capable of not answering the phone, email, or instant messages.

I hope he is ok, both physically and mentally.

runjake2• 16 years ago

If you're going to downvote me into oblivion at least counter my points with facts. What does the real evidence show here?

jimrandomh• 16 years ago

Both of the images are large PNG files, which leaves lots of room for steganographic data. Given that they're meaningless if interpreted literally (but seem to vaguely hint at meaning, which makes them good as red herrings), that seems like the most likely interpretation.

So the question is, who has the key? It seems like if anyone has it, Ryan Naraine should. But if he did, his post would be quite different.

EastSmith• 16 years ago

According to Dnevnik.bg (http://www.dnevnik.bg/tehnologii/2011/01/17/1026425_ekspertu...):

Dancho Danchev, an expert on cybersecurity, is placed in a psychiatric hospital in Bulgaria. The information was confirmed by two sources of "Dnevnik", although the hospital refused to comment.

[...]

[...] according to reliable source of Dnevnik he was placed in a Bulgarian psychiatric hospital since December 11.

Malware researcher Dancho Danchev gone missing since August

Related Stories