Malware researcher Dancho Danchev gone missing since August • Hacker News Board

Re: Malware researcher Dancho Danchev gone missing since August

#31

Post by A1kmm » Sat, Jan 15, 2011, 10:27 AM UTC

elbrodeur wrote: post #13

nitrogen wrote: post #2

The electronic transformer looks like it could be used for low-voltage lighting. The wires look like they're running into mini LED or halogen lights.

Both of the photos are confusing, but the photo depicting the wires more so. If you count the wires it seems right until you notice that the hacked up blue and white wires are not going to the lighting device at all. Or where the power (phase/neutral) are coming from. They go out of the frame to the left, instead. I'm not sure what I'm looking at, but it looks like something is in the wall that requires power. A coup…

One interpretation of the wiring:

* Wires coming through the wall are mains voltage. * Exposed wire is ground, the other two are active and neutral. They connect to two white wires. * These two active and neutral wires are connected to two white wires running into the transformer at the left of the photo (although you can't tell whether anything else is connected left of there). * A black double-insulated wire comes out of the transformer, and a brown and blue wire come out of the double insulation. * The brown and blue wires go into the first connector box, which connects via the black double wire to the second connector box. * Two white double wires come out of the second connector box, one going to each light.

GTV seems like it was a transformer manufacturer - it had a US trademark on the name for manufacturing many things until 2008, including for "electric transformers for lighting lamps".

One weird thing: the transformer purports to be a step-down transformer, but the black cable with blue and brown wires (standard colours for mains active and neutral) connects to the low voltage end, when it is probably supposed to connect to the mains end. It is almost as if the step-down transformer is being used as a step-up transformer. The transformer ratio is between 220V/11.6V and 240V/11.6V - so about 20. 240V*20 = 4800V.

If it was configured to produce 4800V on an easily accessible light, perhaps he is trying to say that someone was trying to electrocute him.

Update: I found this, which I think is a more recent model of a similar transformer, from the same manufacturer: http://gemini-technology.en.alibaba.com/productshowimg/30345... - this seems to confirm that the black double insulated wire is supposed to be the 240V input, not the low voltage output.

Re: Malware researcher Dancho Danchev gone missing since August

#32

Post by A1kmm » Sat, Jan 15, 2011, 10:45 AM UTC

aquarin wrote: post #30

It is quite common view of halogen lights wiring here (Bulgaria). I have the same in my bathroom. First photo is standard transformer and second photo is a job done by some electrician not doing his job well. I do not see anything suspicious. And yes, we are EU and NATO members. Most USA citizens visiting here happily spend they time and really enjoying the visit. Without more information what was the case with Danch…

Have you got one of those transformers too? Is the black double insulated side supposed to be the low voltage or the high voltage side of the transformer?

Re: Malware researcher Dancho Danchev gone missing since August

#33

Post by fdhjtyjkty » Sat, Jan 15, 2011, 11:32 AM UTC

●------ http://u.ly/73I ------●

Gold autumn, personality Mes clothing + Shoes, Travel bag that grabs an eye coat + Chao packet Free transport

●------ http://u.ly/73I ------●

Re: Malware researcher Dancho Danchev gone missing since August

#34

Post by redthrowaway » Sat, Jan 15, 2011, 12:48 PM UTC

wang-chung wrote: post #20

A simple explanation of the transformer/wires is that he could be documenting an attempt to electrocute him.

Or, more likely, kill him in a fire that looked accidental.

Re: Malware researcher Dancho Danchev gone missing since August

#35

Post by mitko » Sat, Jan 15, 2011, 1:56 PM UTC

In Bulgaria there is a list of people declared for national investigation (обявени за национално издирване). In this list there are people who need to be arrested, who need to be a witness in a case or who are missing(i.e. they are kidnapped or disapeared). If Dancho is truly missing since September then he should be on that list.

I tried to search for this list online but I couldn't find it (maybe it is not available yet). The article doesn't say anything about the official situation. It will be great if anyone can provide some official information.

Re: Malware researcher Dancho Danchev gone missing since August

#36

Post by uptown » Sat, Jan 15, 2011, 2:19 PM UTC

If "several" photographs were attached to his pleas for help, why did they elect to only include two of them?

Re: Malware researcher Dancho Danchev gone missing since August

#37

Post by catshirt » Sat, Jan 15, 2011, 4:06 PM UTC

madmaze wrote: post #4

nitrogen wrote: post #2

The electronic transformer looks like it could be used for low-voltage lighting. The wires look like they're running into mini LED or halogen lights.

I suspect that means someone is supposed to find that transformer. Presumably there may be something of interest with/in/near it. Its easy to hide a microSD

This could also explain why "current situation in my bathroom" is in quotes.

Re: Malware researcher Dancho Danchev gone missing since August

#38

Post by aquarin » Sat, Jan 15, 2011, 5:18 PM UTC

foenix wrote: post #19

elbrodeur wrote: post #13

Earlier quoted context omitted.

Both of the photos are confusing, but the photo depicting the wires more so. If you count the wires it seems right until you notice that the hacked up blue and white wires are not going to the lighting device at all. Or where the power (phase/neutral) are coming from. They go out of the frame to the left, instead. I'm not sure what I'm looking at, but it looks like something is in the wall that requires power. A coup…

One more note about the wiring, it seems to be outside of a bathroom or bathtub of some sort. Note the toilet paper and its reflection in the tile. I don't know if that's helpful, but it's good to understand all of the details; thanks for your analysis, elbrodeur.

It is not outside the bathroom, this is the lighting in the bathroom above the mirror above the water tap. You see the paper mirrored in the mirror.

Re: Malware researcher Dancho Danchev gone missing since August

#39

Post by tptacek » Sat, Jan 15, 2011, 6:24 PM UTC

fooandbarify wrote: post #25

updog wrote: post #22

Earlier quoted context omitted.

Changing my vote. I think the guy is nuts and/or running away. Stuff doesn't add up. -He claims a particular LEO is after him for pro-western views. This is the hardest hit to his credibility. If he said that botnet authors came after him for outing them, that might be plausible. The Belgian government does not hunt and 'disappear' pro-western people. -There is no stego in this image like some have suggested. If it w…

Belgium != Bulgaria The rest of what you said makes sense, and it is possible that this is a script kid trying to make a name for himself - I would be very weary about making that assumption though without more serious evidence.

Nobody who does software security professionally would suggest Dancho is a "script kid". Your first tip-off might have been the article, where you'd learn that his disappearance was featured in the ZDNet security blog, where he is a contributor.

Re: Malware researcher Dancho Danchev gone missing since August

#40

Post by fooandbarify » Sat, Jan 15, 2011, 7:32 PM UTC

tptacek wrote: post #39

fooandbarify wrote: post #25

Earlier quoted context omitted.

Belgium != Bulgaria The rest of what you said makes sense, and it is possible that this is a script kid trying to make a name for himself - I would be very weary about making that assumption though without more serious evidence.

Nobody who does software security professionally would suggest Dancho is a "script kid". Your first tip-off might have been the article, where you'd learn that his disappearance was featured in the ZDNet security blog, where he is a contributor.

I don't do software security professionally, or have any other way of validating Dancho's legitimacy. It's not that I don't trust ZDNet - I was simply ceding the possibility that the parent was right on that point since I had no "proof" to the contrary. I apologize if it came across as me lending credence to the idea that Dancho may be a hack, I meant it in the sense that I was unable to positively confirm his reputation in the field (since I am not in it) but I should have been more clear :)