MSN Handwriting Interception.

First, sorry for the lapse in posting, I've been busy with LIFE and a few very time consuming projects.

Recently I was talking with a friend over msn messenger. They had some sensitive information to relay, but they were a little nervous about doing so from their wireless lan. This made me smile a little, always happy to see security concious minds, and I was about to tell them to call me when they sent the information using the MSN Handwriting feature. Her justification was that, text could easily be sniffed on the wire, but not an image. I knew this was a false sense of security so I set out to find an easy way to intercept MSN Handwriting.

Having no prior knowledge regarding the technologies involved, I decided to start by having a look at the packet traffic involved when sending a handwritten msg. An example payload follows:

MSG REMOVED@hotmail.com sp00kz 580

MIME-Version: 1.0

Content-Type: application/x-ms-ink



base64:AP8CHAOAgAQdBLAC7gICDQRIEUVkB0gRRP8BRWQZFDIIAIAyAhzHsUIzCADgEg
IcxzFCFauq00GrqtNBAFjVPgCAlT4eBwaC/HH43AAJAQp3vAGC/gDz+APbZq0iJcVLEsA
ksssBcqCVNmy2UAAAEC5TLJZLls0oVNSrZSpO4VKiwlgXNgJYsWAAgv4EC/gQO1bZ2ZsX
NS2REpSLiEWRYMWCxYsShZZNlmy1ZSxZKJUQIZYuVYM0TWaZ3LKzUspYXNkNhUVKlsUJA
AosPYL9yfuUAAEVKlibKAbCBJQWAIL+AIv4Ajlkqbl0KlyiVLJZYsJRZZZKKgAKJiuC/g
Aj+ACUWLJRaiwsWVKWJZKAgv4Aw/gDGWUDYkM2BsKKlSwACiUugv4A2/gDmWblgElKSgB
LJuUsgv4Aw/gDEEAUVKWTLNllSpQACiElgv4BW/gFcAEAJUsqaACC/gC7+ALZSVdiy4Bl
JublWaAKFhKC/dn7rJJ6VdtroIL+AZP4BlsWAKQ=

okay, first thing to note is the mime type: application/x-ms-ink. Googling this doesn't give me a lot of information. There's barely any references to the mime-type at all. The last peice of data from the packet is the most interesting, this is our data stream, base64 encoded for safe transmission. First we decode it in order to see if we can make heads or tails of the format. To do this I used b64dec.exe (http://www.4mhz.de/b64dec.html). A very handy tool, we cutpaste the encoded data into a text field, and it allows us to write the decoded binary data to a file.

At this point I'm hoping to see some image format I recognize. Could msn messenger be forwarding the data as BMP?

00000000:  00 FF 02 1C-03 80 80 04-1D 04 B0 02-EE 02 02 0D    ☻∟♥ÇÇ♦↔♦░☻ε☻☻♪
00000010:  04 48 11 45-64 07 48 11-44 FF 01 45-64 19 14 32  ♦H◄Ed•H◄D ☺Ed↓¶2
00000020:  08 00 80 32-02 1C C7 B1-42 33 08 00-E0 12 02 1C  ◘ Ç2☻∟╟▒B3◘ α↕☻∟
00000030:  C7 31 42 15-AB AA D3 41-AB AA D3 41-00 58 D5 3E  ╟1B§½¬╙A½¬╙A X╒>
00000040:  00 80 95 3E-1E 07 06 82-FC 71 F8 DC-00 09 01 0A   Çò>▲•♠éⁿq°▄ ○☺◙
00000050:  77 BC 01 82-FE 00 F3 F8-03 DB 66 AD-22 25 C5 4B  w╝☺é■ ≤°♥█f¡"%┼K
00000060:  12 C0 24 B2-CB 01 72 A0-95 36 6C B6-50 00 00 10  ↕└$▓╦☺ráò6l╢P  ►
00000070:  2E 53 2C 96-4B 96 CD 28-54 D4 AB 65-2A 4E E1 52  .S,ûKû═(T╘½e*NßR
00000080:  A2 C2 58 17-36 02 58 B1-60 00 82 FE-04 0B F8 10  ó┬X↨6☻X▒` é■♦♂°►
00000090:  3B 56 D9 D9-9B 17 35 2D-91 12 94 8B-88 45 91 60  ;V┘┘¢↨5-æ↕öïêEæ`
000000A0:  C5 82 C5 8B-12 85 96 4D-96 6C B5 65-2C 59 28 95  ┼é┼ï↕àûMûl╡e,Y(ò
000000B0:  10 21 96 2E-55 83 34 4D-66 99 DC B2-B3 52 CA 58  ►!û.Uâ4MfÖ▄▓│R╩X
000000C0:  5C D9 0D 85-45 4A 96 C5-09 00 0A 2C-3D 82 FD C9  \┘♪àEJû┼○ ◙,=é²╔
000000D0:  FB 94 00 01-15 2A 58 9B-28 06 C2 04-94 16 00 82  √ö ☺§*X¢(♠┬♦ö▬ é
000000E0:  FE 00 8B F8-02 39 64 A9-B9 74 2A 5C-A2 54 B2 59  ■ ï°☻9d⌐╣t*\óT▓Y
000000F0:  62 C2 51 65-96 4A 2A 00-0A 26 2B 82-FE 00 23 F8  b┬QeûJ* ◙&+é■ #°
00000100:  00 94 58 B2-51 6A 2C 2C-59 52 96 25-92 80 82 FE   öX▓Qj,,YRû%ÆÇé■
00000110:  00 C3 F8 03-19 65 03 62-43 36 06 C2-8A 95 2C 00   ├°♥↓e♥bC6♠┬èò,
00000120:  0A 25 2E 82-FE 00 DB F8-03 99 66 E5-80 49 4A 4A  ◙%.é■ █°♥ÖfσÇIJJ
00000130:  00 4B 26 E5-2C 82 FE 00-C3 F8 03 10-40 14 54 A5   K&σ,é■ ├°♥►@¶TÑ
00000140:  93 2C D9 65-4A 94 00 0A-21 25 82 FE-01 5B F8 05  ô,┘eJö ◙!%é■☺[°♣
00000150:  70 01 00 25-4B 2A 68 00-82 FE 00 BB-F8 02 D9 49  p☺ %K*h é■ ╗°☻┘I
00000160:  57 62 CB 80-65 26 E6 E5-59 A0 0A 16-12 82 FD D9  Wb╦Çe&µσYá◙▬↕é²┘
00000170:  FB AC 92 7A-55 DB 6B A0-82 FE 01 93-F8 06 5B 16  √¼ÆzU█káé■☺ô°♠[▬
00000180:  00 A4      -           -           -              ñ

unfortunately, This is not data I recognize. I run searches for common image file format signatures found here: http://www.garykessler.net/library/file_sigs.html and here: http://www.wotsit.org. But still, this yields nothing.

At this point I notice something interesting. I click the handwritten msg my friend sent me and drag it into my handwriting space. The eraser tool is different than most eraser tools. Try it out right now, you'll see what I mean. It remembers each 'stroke' and erases them the way they were drawn. The interesting thing I notice is that MY msn messenger client remembers the 'strokes' that my friend used when writing HIS msg. That means this information is sent in that base64 encoded data stream. Interesting, what type of data would require that information? Well I know that 'graffiti' on my palm needs to know the order of strokes in a letter in order to determine effectively which letter was being written...

A little research tells me that Microsoft's XP Tablet PC edition has built in handwriting recognition. The format they use is called Ink Serialized Format, or ISF. I download a freeware ISF viewer from Agilix.com, rename my msnhw.out to msnhw.isf, and attempt to open it...

BINGO. So, by sniffing the wire, or reading packet traffic, it's trivial to view MSN handwriting. Also, this format is used for handwriting recognition, so It would likely be very easy for someone who understands the format to change this data to text, possibly adding word recognition to traffic monitoring systems. I assume this also forshadows future features to the msn messaging client.

Happy Hacking :)