Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

Jump to top

Create a Page

This is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.

Or... you can just click this button to open the Pages posting window right away.

Last updated: 2015-08-02 10:58 am PDT

LGF User's Guide RSS Feeds

Help support Little Green Footballs!

Subscribe now for ad-free access!

Recent Pages
Thanos
Tech’s Biggest Names Unite to Create a New Video Format
THE LIST, WITH a few notable exceptions, is a roster of some of the biggest names in tech: Amazon, Cisco, Google, Intel, Microsoft, Mozilla and Netflix are teaming up to revamp the way video works over the Internet. The ...

10 hours, 39 minutes ago
Views: 133 • Comments: 0
Tweets: 2 • Rating: 2
I Stand With Planned Parenthood
WHAT RAPE CULTURE? Women Sue for Humiliating Vaginal Search (RAPE) From State Troopers (Video)
Once again, probable cause used as an excuse for Rape. Excuses for pulling over the women: throwing cigarettes out the window; speeding; failed to use turn signal in the three articles referenced here. All times, the office "thought" he smelled ...

23 hours, 38 minutes ago
Views: 160 • Comments: 0
Tweets: 0 • Rating: 1
Great White Snark
The Strange Saga of the MH370 Plane Part — NYMag
Just when you think this will not get any more weird... Tomorrow marks one month since a piece of a Boeing 777 washed up on the Indian Ocean island of La Réunion, but French investigators are no closer to confirming ...

2 days, 20 hours ago
Views: 479 • Comments: 1
Tweets: 0 • Rating: 4
JmpMaster
Teachers as the Target in Schools and Media
As soon as you mention public education a barrage of soundbites and adages come flying from every corner at dizzying speed. Teachers are underpaid and underappreciated, teachers are all jaded cynics that don't care anymore, teachers are the cornerstone ...

4 days, 20 hours ago
Views: 475 • Comments: 0
Tweets: 0 • Rating: 0
VickieHaz
Spice Up Your Home Lighting
When many of us are in need of a new lamp, ceiling light or any other lighting application the first thing we'll do is jump in the car and head off to the nearest IKEA. This is the safest option ...

5 days, 3 hours ago
Views: 548 • Comments: 2
Tweets: 3 • Rating: 0
Bubblehead II
President Obama Remarks on Tenth Anniversary of Hurricane Katrina
In case you missed the NOLA Presidents speech today. President Obama Remarks on Tenth Anniversary of Hurricane Katrina

5 days, 14 hours ago
Views: 477 • Comments: 1
Tweets: 1 • Rating: 1
KiTA
Vester Lee Flanagan Guns Down News Crew on Live TV, Live Tweets and Films himself doing so.
Update: The shooter filmed himself performing the act and uploaded the content to several social media accounts. It was shared thousands of times before Twitter deleted it. Twitter auto-plays the video. Today would be a very good day to close ...

6 days, 22 hours ago
Views: 806 • Comments: 4
Tweets: 6 • Rating: 3
Lumberhead
Why the 2016 Republican Nomination Can’t Be Predicted Through History
This election season provides a fascinating frame to see if the polarization in politics, from Washington to the states to the public, is no different than what we have seen in the past; if the angry populism evident especially ...

1 week, 4 days ago
Views: 893 • Comments: 1
Tweets: 0 • Rating: 4
No Country For Old Haters
Unraveling the Enigma of Nintendo’s Virtual Boy, 20 Years Later
Twenty years ago, on August 21, 1995, Nintendo released the Virtual Boy in North America. The stilt-legged tabletop gaming console, which offered a unique red stereoscopic 3D display, attempted to ride a wave of popular interest in virtual reality. ...

1 week, 4 days ago
Views: 792 • Comments: 3
Tweets: 1 • Rating: 1
EiMitch
Cracked: The 6 Most Ridiculous F***-Ups In The History Of Science
cracked.com There's no doubt that science has made all of our lives much better, as evidenced by the fact that we wrote this article entirely from the men's room of our neighborhood Chipotle. (We'll be living here for the rest ...

1 week, 6 days ago
Views: 1,174 • Comments: 0
Tweets: 0 • Rating: 0