Is the XKeyScore Code Released in Germany Faked?

Expert analysis uncovers serious misrepresentations and possible fakery

Following up on our post about the wildly exaggerated claims made about the purported XKeyScore source code released in Germany this week by hacker Jacob Applebaum, here’s a very interesting post by cybersecurity expert Robert Graham with evidence that the code may have been at least partly faked: Errata Security: Validating XKeyScore Code.

The burning questions about the XKeyScore “source code” is whether it’s real, and whether it come from Snowden. The Grugq (@thegrugq) has some smart insight into this, and I have my own expertise with deep-packet-inspection code. I thought I’d write up our expert analysis to the questions.

TL;DR: we believe the code partly fake and that it came from the Snowden treasure trove.

A slightly longer summary is:

  1. The signatures are old (2011 to 2012), so it fits within the Snowden timeframe, and is unlikely to be a recent leak.
  2. The code is weird, as if they are snippets combined from training manuals rather than operational code. That would mean it is "fake".
  3. The story makes claims about the source that are verifiably false, leading us to believe that they may have falsified the origin of this source code.
  4. The code is so domain specific that it probably is, in some fashion, related to real XKeyScore code - if fake, it's not completely so.

Here’s a point that jumped out at me immediately upon looking at the code: all over the Internet, people are claiming that the code identifies linuxjournal.com as an “exremist forum” — but that’s simply false. As I tweeted two days ago:

Graham’s post agrees with this evaluation:

Another misrepresentation in the story is that the source calls the Linux Journal an extremist forum. That’s not true.

A comment does say that TAILS is “a comsec mechanism advocated by extremists on extremist forums”. This is true, as the picture (from the Grugq) demonstrates on the right: it’s a picture from an ISIS/jihad forum advocating the use of TAILS. But nowhere does it claim that the Linux Journal is one of those extremists — that’s something willfully made up by the authors of the story.

That the story already misrepresents the meaning of this source code hints that it may already be misrepresenting the provenance.

Exactly. Something smells very fishy here. Read the whole thing. And for those interested in the highly technical details, here’s Graham’s post going through the code line by line.

Jump to top

Create a PageThis is the LGF Pages posting bookmarklet. To use it, drag this button to your browser's bookmark bar, and title it 'LGF Pages' (or whatever you like). Then browse to a site you want to post, select some text on the page to use for a quote, click the bookmarklet, and the Pages posting window will appear with the title, text, and any embedded video or audio files already filled in, ready to go.
Or... you can just click this button to open the Pages posting window right away.
Last updated: 2016-01-01 10:29 am PST
LGF User's Guide RSS Feeds Tweet

Help support Little Green Footballs!

Subscribe now for ad-free access!Register and sign in to a free LGF account before subscribing, and your ad-free access will be automatically enabled.

Donate with
PayPal
Square Cash Shop at amazon
as an LGF Associate!
Recent PagesClick to refresh
Another Democrat Starting Trump Impeachment Process Come on guys, get behind the bill. All of us. we should get behind this bill as it emerges as fast as we attacked the BCA. Following Donald Trump’s equivocating of white supremacists and those who oppose them in ...
Unshaken Defiance
22 hours, 43 minutes ago
Views: 328 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 1
Comments: 0
: 1
How Militias Became the Private Police for White Supremacists Magazine Guns to a protest? Clubs? We can not tolerate anti American militias. The bloody weekend in Charlottesville that began with several hundred chanting white supremacists on a torch-lit march will long be remembered for the searing image of a ...
Unshaken Defiance
23 hours, 49 minutes ago
Views: 272 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Starting in 2018, Police Dogs Injured in the Line of Duty Can Be Transported by EMS to Veterinary Clinics ST. CLAIR COUNTY, IL – Ambulances are for people. It’s always been the law of the land. In Illinois, it'll soon be "almost always". Illinois Governor, Bruce Rauner, signed House Bill 2661, Tuesday. It will allow police dogs to ...
Birth Control Works
1 day, 2 hours ago
Views: 267 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
At Last, a Big, Successful Trial of Probiotics - the Atlantic Aside from preventing sepsis, it also reduced the risk of infections by both the major groups of bacteria: the Gram-positives, by 82 percent; and the Gram-negatives, which are harder to treat with antibiotics, by 75 percent. It even reduced ...
Birth Control Works
1 day, 3 hours ago
Views: 299 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
The New War on Birth Control - Pacific Standard Although it wasn't clear at the time, the attack on Phillips marked the beginning of a new anti-contraception movement—conceived in the U.S., but unfolding in Africa, where women's frustrations with the dearth of safe, effective family planning options are ...
Birth Control Works
1 day, 3 hours ago
Views: 353 • Comments: 0 • Rating: 0
Tweets: 1 • Share to Facebook
Shares: 0
Comments: 0
: 0
M83 - Do It, Try It (David Wilson Video) M83 - Do It, Try It video by David Wilson. Following the video's premiere at Sundance Next Fest it is now available to watch online. The track is taken from M83's seventh studio album Junk, available to buy & ...
Thanos
1 day, 17 hours ago
Views: 249 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Marvel’s the Defenders It’s all coming together. Learn about The Defenders from the stars themselves: Charlie Cox, Krysten Ritter, Mike Colter and Finn Jones. Marvel’s The Defenders premieres globally August 18, 2017, only on Netflix. Watch The Defenders on Netflix: netflix.com SUBSCRIBE: ...
Thanos
1 day, 17 hours ago
Views: 269 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
AG Madigan Issues Guidelines for Responding to Sexual Assault Crimes “We took a comprehensive look at why sexual assault survivors rarely report their crimes to law enforcement, and it was clear that our criminal justice system can and must respond, investigate and better support survivors,” Illinois Attorney General Lisa ...
Birth Control Works
1 day, 23 hours ago
Views: 276 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
This 91-Year-Old Woman Just Earned Her Bachelor’s Degree After 10 Years of Studying The back-to-school commercials have started airing. The summer reading lists are coming due. It’s almost that time of year. And if students aren’t quite looking forward to getting back into their classrooms this month for another school year, the ...
Birth Control Works
1 day, 23 hours ago
Views: 257 • Comments: 1 • Rating: 1
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0
Give the Gift of LifeCJ was a good kid, he was a gentle soul. I could see a little of his mother and father in him. I didn't know we were alike in one way, that we were both addicts, until he was brain ...
Shropshire Slasher
2 days, 1 hour ago
Views: 216 • Comments: 0 • Rating: 0
Tweets: 0 • Share to Facebook
Shares: 0
Comments: 0
: 0