Kitiara Unmasked

One of the Interesting things about the Penet Remailer is that it is quite old. Not that this is a bad thing it being one of the few remailers which has lasted for any period of time anywhere in the world. It does however mean that some of the bugs in it are widely known. One of these is that anon@penet tends to send its mail on as soon as it has been received. What this means is that if you suspect someone of sending you anonymous mail. You can use the "last" command to get a listing of when they were last logged in. With this you can then determine how long mail takes to get from their site to penet. Then you can go through and work out whether your suspect is the one who has been sending you the mail by calculating whether or not they were logged on at a given time before the anonymous mail reached Penet. This isnt an especially good explanation lets see if we can do better with some facts and figures.

Below are the listings of when the Kitiara letters arrived at Penet.

Kitiara 1
Arrived at anon@penet at 00:10 GMT Wed May 01

Kitiara 2
Arrived at anon@penet at 07:54 GMT Sun May 05

Kitiara 3
Arrived at anon@penet at 22:13 GMT Wed May 08

Kitiara 4
Arrived at anon@penet at 20:57 GMT Thur May 09

Kitiara 5
Arrived at anon@penet at 13:23 GMT Sat May 11

Here is when the primary suspect was logged into tartarus.

Kitiara 1 assassin ttyxa gh-mac14.gu.uwa. Tue Apr 30 17:25 - 17:40 (00:15) Kitiara 2 assassin ttyqf gh-mac14.gu.uwa. Fri May 03 16:08 - 16:34 (00:25) Kitiara 3 assassin ttyx9 gh-mac14.gu.uwa. Wed May 08 15:26 - 15:53 (00:27) Kitiara 4 assassin ttyt6 gh-mac14.gu.uwa. Thu May 09 15:17 - 15:19 (00:02) Kitiara 5 assassin ttyuc gh-mac14.gu.uwa. Fri May 10 16:37 - 16:46 (00:09)

Heres those times again but converted to GMT.

assassin ttyxa gh-mac14.gu.uwa. Tue Apr 30 09:25 - 09:40 (00:15) assassin ttyqf gh-mac14.gu.uwa. Fri May 03 08:08 - 08:34 (00:25) assassin ttyx9 gh-mac14.gu.uwa. Wed May 08 06:26 - 06:53 (00:27) assassin ttyt6 gh-mac14.gu.uwa. Thu May 09 06:17 - 06:19 (00:02) assassin ttyuc gh-mac14.gu.uwa. Fri May 10 07:37 - 07:46 (00:09)

Ok so they werent logged on at the same time that mail arrived at Penet. However we can calculate the difference between the two ie how long the mail on average takes to get to penet from their account.

Kitiara 1
14hrs 30min

Kitiara 2
47hrs 40min

Kitiara 3
15hrs 40min

Kitiara 4
13hrs 36min

Kitiara 5
28hrs 09min

Now I can hear you saying. What is this shit? Theres way to much spread in these times to accurately determine whether this was the person who sent them. And you are right. Except for one thing. This method successfully eliminates the other candidates ie People like Daniel Oi and Bec Kirkman. Bec because she doesnt log on often enough to have sent all the messages. Daniel because he has a different anonymous ID when he sends me mail.

Acolyte has already removed himself from the argument by coming out and stating he is not involved. As did Shay about a week ago.

So who do we have left:

Anna Fagence: duchovny@tartarus.uwa.edu.au

Sasha Voss: assassin@tartarus.uwa.edu.au

Well Anna already has access to Sasha's account because she knows her password. Such good friends.

Also Anna has sent me anonymous email in the past her account at Penet is: an597420@anon.penet.fi

Which leaves the mystery player:

an602476@anon.penet.fi

and by deduction she must be Sasha Voss.

Next time use a cyberpunk remailer, they delay the message for a random time.... Darling.